8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
300s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
09-12-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

8^/10

defense_evasion discovery evasion persistence phishing privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

A potential corporate email address has been identified in the URL: css@3
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: js@3
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: search-insights@1
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 16 IoCs

pid	Process
3976	Solara.exe
3608	RobloxPlayerInstaller.exe
3216	MicrosoftEdgeWebview2Setup.exe
1004	MicrosoftEdgeUpdate.exe
3616	MicrosoftEdgeUpdate.exe
3000	MicrosoftEdgeUpdate.exe
3604	MicrosoftEdgeUpdateComRegisterShell64.exe
2896	MicrosoftEdgeUpdateComRegisterShell64.exe
3488	MicrosoftEdgeUpdateComRegisterShell64.exe
1108	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
3692	MicrosoftEdgeUpdate.exe
1220	MicrosoftEdgeUpdate.exe
3436	MicrosoftEdge_X64_131.0.2903.86.exe
1972	setup.exe
4452	setup.exe

Loads dropped DLL 26 IoCs

pid	Process
1068	MsiExec.exe
1068	MsiExec.exe
3780	MsiExec.exe
3780	MsiExec.exe
3780	MsiExec.exe
3780	MsiExec.exe
3780	MsiExec.exe
1168	MsiExec.exe
1168	MsiExec.exe
1168	MsiExec.exe
1068	MsiExec.exe
1004	MicrosoftEdgeUpdate.exe
3616	MicrosoftEdgeUpdate.exe
3000	MicrosoftEdgeUpdate.exe
3604	MicrosoftEdgeUpdateComRegisterShell64.exe
3000	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdateComRegisterShell64.exe
3000	MicrosoftEdgeUpdate.exe
3488	MicrosoftEdgeUpdateComRegisterShell64.exe
3000	MicrosoftEdgeUpdate.exe
1108	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
3692	MicrosoftEdgeUpdate.exe
3692	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
1220	MicrosoftEdgeUpdate.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 3 IoCs

flow	pid	Process
21	3388	msiexec.exe
22	3388	msiexec.exe
23	3388	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
37	pastebin.com
431	camo.githubusercontent.com
443	camo.githubusercontent.com
444	camo.githubusercontent.com
445	camo.githubusercontent.com
446	camo.githubusercontent.com
447	camo.githubusercontent.com
31	pastebin.com
448	camo.githubusercontent.com

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\fonts\families\Fondamento.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\run-script.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\shrinkwrap.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\verify\set.d.ts	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\9-slice\hello-button.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\glob.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-hook.html	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\DeveloperFramework\StudioTheme\search_20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioToolbox\ScrollBarBottom.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff\rollup.config.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\AnimationEditor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaApp\icons\ic-add-down.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-14x14.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU396C.tmp\msedgeupdateres_lt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\team.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\is.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\serialized.d.ts	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\DefaultController\ButtonA.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\ScreenshotHud\Camera.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\Controls\DesignSystem\ButtonB.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\mt.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\index.d.ts	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ControlsEmulator\PlayStation4_Light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\DesignSystem\ButtonControls.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\api-ms-win-core-file-l2-1-0.dll	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\node_modules\minipass\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\install.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\read\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmaccess\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-publish.1	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Emotes\Editor\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\icons\ic-robux.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npx.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\ext.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\sky\moon.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\PlatformContent\pc\terrain\materials.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\AnimationEditor\button_hierarchy_opened.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\TerrainTools\mtrl_sand_2022.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\agentkeepalive\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\list.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\StudioSharedUI\clear.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ViewSelector\front_hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\Controls\DesignSystem\ButtonX.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\node-gyp-bin\node-gyp	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\set-path.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\stream.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\content\textures\ui\Settings\Players\ReportFlagIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU396C.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\ko.pak	setup.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE23D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF9A7142EBBC512F2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF62146FE8D09EE419.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF385F46369BA8506F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC52.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC40.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDD6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Windows\Installer\e57a7aa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57a7aa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB878.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC32.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF468B887D0216F3A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD48.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\0956a836-e6a5-47ab-82cb-ec88cc41a992.tmp	setup.exe
File created	C:\Windows\Installer\e57a7ae.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\Installer\MSIB848.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFEA.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\MSIAC2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB578.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1108	MicrosoftEdgeUpdate.exe
1220	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4424	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133782520963539417"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CLSID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass"	MicrosoftEdgeUpdate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3532	Bootstrapper.exe
3532	Bootstrapper.exe
3240	chrome.exe
3240	chrome.exe
3388	msiexec.exe
3388	msiexec.exe
3976	Solara.exe
3976	Solara.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
3608	RobloxPlayerInstaller.exe
3608	RobloxPlayerInstaller.exe
1004	MicrosoftEdgeUpdate.exe
1004	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5084	WMIC.exe
Token: SeSecurityPrivilege	5084	WMIC.exe
Token: SeTakeOwnershipPrivilege	5084	WMIC.exe
Token: SeLoadDriverPrivilege	5084	WMIC.exe
Token: SeSystemProfilePrivilege	5084	WMIC.exe
Token: SeSystemtimePrivilege	5084	WMIC.exe
Token: SeProfSingleProcessPrivilege	5084	WMIC.exe
Token: SeIncBasePriorityPrivilege	5084	WMIC.exe
Token: SeCreatePagefilePrivilege	5084	WMIC.exe
Token: SeBackupPrivilege	5084	WMIC.exe
Token: SeRestorePrivilege	5084	WMIC.exe
Token: SeShutdownPrivilege	5084	WMIC.exe
Token: SeDebugPrivilege	5084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5084	WMIC.exe
Token: SeRemoteShutdownPrivilege	5084	WMIC.exe
Token: SeUndockPrivilege	5084	WMIC.exe
Token: SeManageVolumePrivilege	5084	WMIC.exe
Token: 33	5084	WMIC.exe
Token: 34	5084	WMIC.exe
Token: 35	5084	WMIC.exe
Token: 36	5084	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5084	WMIC.exe
Token: SeSecurityPrivilege	5084	WMIC.exe
Token: SeTakeOwnershipPrivilege	5084	WMIC.exe
Token: SeLoadDriverPrivilege	5084	WMIC.exe
Token: SeSystemProfilePrivilege	5084	WMIC.exe
Token: SeSystemtimePrivilege	5084	WMIC.exe
Token: SeProfSingleProcessPrivilege	5084	WMIC.exe
Token: SeIncBasePriorityPrivilege	5084	WMIC.exe
Token: SeCreatePagefilePrivilege	5084	WMIC.exe
Token: SeBackupPrivilege	5084	WMIC.exe
Token: SeRestorePrivilege	5084	WMIC.exe
Token: SeShutdownPrivilege	5084	WMIC.exe
Token: SeDebugPrivilege	5084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5084	WMIC.exe
Token: SeRemoteShutdownPrivilege	5084	WMIC.exe
Token: SeUndockPrivilege	5084	WMIC.exe
Token: SeManageVolumePrivilege	5084	WMIC.exe
Token: 33	5084	WMIC.exe
Token: 34	5084	WMIC.exe
Token: 35	5084	WMIC.exe
Token: 36	5084	WMIC.exe
Token: SeDebugPrivilege	3532	Bootstrapper.exe
Token: SeShutdownPrivilege	3240	chrome.exe
Token: SeCreatePagefilePrivilege	3240	chrome.exe
Token: SeShutdownPrivilege	3240	chrome.exe
Token: SeCreatePagefilePrivilege	3240	chrome.exe
Token: SeShutdownPrivilege	4644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4644	msiexec.exe
Token: SeSecurityPrivilege	3388	msiexec.exe
Token: SeCreateTokenPrivilege	4644	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4644	msiexec.exe
Token: SeLockMemoryPrivilege	4644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4644	msiexec.exe
Token: SeMachineAccountPrivilege	4644	msiexec.exe
Token: SeTcbPrivilege	4644	msiexec.exe
Token: SeSecurityPrivilege	4644	msiexec.exe
Token: SeTakeOwnershipPrivilege	4644	msiexec.exe
Token: SeLoadDriverPrivilege	4644	msiexec.exe
Token: SeSystemProfilePrivilege	4644	msiexec.exe
Token: SeSystemtimePrivilege	4644	msiexec.exe
Token: SeProfSingleProcessPrivilege	4644	msiexec.exe
Token: SeIncBasePriorityPrivilege	4644	msiexec.exe
Token: SeCreatePagefilePrivilege	4644	msiexec.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe
3240	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 4412	3532	Bootstrapper.exe	80
PID 3532 wrote to memory of 4412	3532	Bootstrapper.exe	80
PID 4412 wrote to memory of 4424	4412	cmd.exe	82
PID 4412 wrote to memory of 4424	4412	cmd.exe	82
PID 3532 wrote to memory of 1172	3532	Bootstrapper.exe	84
PID 3532 wrote to memory of 1172	3532	Bootstrapper.exe	84
PID 1172 wrote to memory of 5084	1172	cmd.exe	86
PID 1172 wrote to memory of 5084	1172	cmd.exe	86
PID 3240 wrote to memory of 2780	3240	chrome.exe	91
PID 3240 wrote to memory of 2780	3240	chrome.exe	91
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3260	3240	chrome.exe	92
PID 3240 wrote to memory of 3024	3240	chrome.exe	93
PID 3240 wrote to memory of 3024	3240	chrome.exe	93
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94
PID 3240 wrote to memory of 3804	3240	chrome.exe	94

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4424
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\ProgramData\Solara\Solara.exe
  "C:\ProgramData\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6075cc40,0x7ffd6075cc4c,0x7ffd6075cc58
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4044,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4712,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4980,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4892,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4792,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4600,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5204 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4304,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3500,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5112,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=868,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5808,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3400,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5688,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3472,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5828,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5084,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5780,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5268,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4840,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6256,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4404
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- - C:\Program Files (x86)\Roblox\Versions\version-a2fb906f52d742c1\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3216
  - - C:\Program Files (x86)\Microsoft\Temp\EU396C.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU396C.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1004
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3616
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3000
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3604
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2896
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3488
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTkyNzgwNDItNDdGQi00RURCLTlDMTEtNkQ5MUQ5MzRGMjZFfSIgdXNlcmlkPSJ7MUFCNkJEMDItMUVGQy00NUQzLTk5MzMtMjNBQjlFOTEzOEEzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2MDY5OTQxRS05NzE5LTRFRjctQUVENS05MzFEQTMwNzdDOUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxNzU1NDExNzciIGluc3RhbGxfdGltZV9tcz0iOTY0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1108
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{19278042-47FB-4EDB-9C11-6D91D934F26E}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=3452,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=3340,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6888,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=4000,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7180,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7320,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=3332,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5784,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7208,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=7220,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6564,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=7728,i,12411105473726110931,455445040759671823,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:5676

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 41D716CE9D884C46DB0034A45FA497EC
  2⤵
  - Loads dropped DLL
  PID:1068
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F6D8D8966D1B59355370DCB64752556A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 692A9EF1CC6C6268A63546F2E594CB58 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1168
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4760
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3736

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3692
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTkyNzgwNDItNDdGQi00RURCLTlDMTEtNkQ5MUQ5MzRGMjZFfSIgdXNlcmlkPSJ7MUFCNkJEMDItMUVGQy00NUQzLTk5MzMtMjNBQjlFOTEzOEEzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxQ0EzNkFGRC1FOEFFLTQ5RjktODY4NC0yNjJEQzZCQ0ZEOTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzE4MTMzMDk2MiIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:1220
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB8F2840-A9E2-489F-B9E8-25EAEA8E1734}\MicrosoftEdge_X64_131.0.2903.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB8F2840-A9E2-489F-B9E8-25EAEA8E1734}\MicrosoftEdge_X64_131.0.2903.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:3436
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB8F2840-A9E2-489F-B9E8-25EAEA8E1734}\EDGEMITMP_7ED09.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB8F2840-A9E2-489F-B9E8-25EAEA8E1734}\EDGEMITMP_7ED09.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB8F2840-A9E2-489F-B9E8-25EAEA8E1734}\MicrosoftEdge_X64_131.0.2903.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:1972
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB8F2840-A9E2-489F-B9E8-25EAEA8E1734}\EDGEMITMP_7ED09.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB8F2840-A9E2-489F-B9E8-25EAEA8E1734}\EDGEMITMP_7ED09.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.109 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB8F2840-A9E2-489F-B9E8-25EAEA8E1734}\EDGEMITMP_7ED09.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.86 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff75ff52918,0x7ff75ff52924,0x7ff75ff52930
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57a7ad.rbs

Filesize
1.0MB

MD5
3971b8d76c7e1d6be8ccc3cd5c849165

SHA1
5e0e2190482adc25572695ee365941b5c44d23fb

SHA256
09afcd7e0fded3d1f6825f26f6815419fd572667c23a6b4ff86ccb5081e942e9

SHA512
88a61a52e44b51d9a094886fe70ef8e685abd75034bfe1ba3119ec27abccf69649b1981f021520970fdf07851222420618f581df2a82e09b39c88ea5d3a6866a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Installer\setup.exe

Filesize
6.6MB

MD5
69221ee7ef83d7eb340857b5833eea14

SHA1
d7f27c64b62eefe2c204a323cc812fa56f58ce1e

SHA256
ad14d7268ee8a9c3c89e7cf62a8a9b713c9f37069fe85b3f8fe525dcda8cdfc9

SHA512
8df73f03d7438082b9e8793f5346a7385c91139d879703dd8c32acfdacb200c18231a5a9cedd7836c892ebb7a8888857c68653728b9027ca1f483a1751fbe2e3

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
7.1MB

MD5
e577d441afe20df31cc18ff84f607ee6

SHA1
68bce38c9f919f5a5b0e8de87c70cc0e377032bb

SHA256
adeda7d3636b45f5f4e5012fe8a43cf323de8a3f119961d3367e6a426916b45c

SHA512
f0debbe13fd22f2131f852f2156425f2b50e052be8b221059bd236fdd91e922fb908939d56c03e538a73b71a94628421827ef53d5bdcc06e71a8959f41222a8d

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
16KB

MD5
07b2eda7537cac53bd4066cc4f4e2d2e

SHA1
edc5f780ec1a69905c19f2d77c3ed6294d7846e0

SHA256
4b8efe52171b8cd0494cceb7b352371bcb7beaad6c67766e8dd39fbee1584724

SHA512
9ac4f22393199417404521b30f289b58ee06761f05e5fbfe42cc953bd70ca0e572ad94fb2a282684a3d70748e11837a12d4f46e70acb3cad5262ed630a3ec021

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\257674ab-42b2-4c95-a760-cc834e181f43.tmp

Filesize
649B

MD5
9bb9625be7e7a8d6f1fe56f52c80b1bd

SHA1
d0950c98b66fd68a63fda02423576ef839ad11b1

SHA256
490ddf9919ba14266a179e20ca96f23b9f0a50411754daf00ce528bdf2fe945a

SHA512
aaf4ab7e375341138ee84cc3d1b79f4d94d62c1dd72c280f976b4fcb861eec641dc6fe1f661333aeac9e889bc6aab0237b27453e6c680aa7f22bf73a3c541ae7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
72KB

MD5
1f604c22aaaab50f4eceb8ae3ab85d4d

SHA1
54056c7625201650aa6f9d69885580668be2e80d

SHA256
01c74bb64d5fc3c3e774ff45dd1c939267f58790444b9e6c946af9751d704c81

SHA512
21031ef427d59babef5ee45e54a79cf6a485188e6bb72e130403762f506664cb088be205e444d07212f0016c706499a54401caa6133bf9769b07e4c304af4a20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00015a

Filesize
41KB

MD5
e319c7af7370ac080fbc66374603ed3a

SHA1
4f0cd3c48c2e82a167384d967c210bdacc6904f9

SHA256
5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

SHA512
4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
35c1f8f21cd67043f557ce5c40e09afd

SHA1
ae020a0007e4adba5c8d6faa18c9969cf9aeeab7

SHA256
775cab106cfd5f3df9ad1fde750284e4b2df39577cd5f054cb7b318a5ae2729d

SHA512
1ccb53fc0abeddd645ffdfec29dcd6249b24f4a9bccfed4423251579b1af2591692f51b57a4c4423676584aaafd66b6f3ae3df819bd3b84fdee6696e797c2b97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e64b1a2a6529adb73d26c8d666773f67

SHA1
20d5038f192b8cc25aa0049f36c9960f7b4b5e01

SHA256
dea8cce2b03c84f6f774a07bb7083e85e1b427d67cc7cbaa89e47e160d5ef821

SHA512
2bea607acfc9e7fa948327e9ce648cf7c3bdd16e43f00bc43c2a7dcfb7d37dff52f2f5122d9aa6e79952c6cc3c5439997f0b23debdc0488d5c3c3f1064a22fc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
284c28665e64e3b8a72bcb4a97920e8e

SHA1
eda1337d8805c939fe51458a1f54e811915d027a

SHA256
23a00cfd9c9db384cd0a5584aa968f940982ad1415ca934ab0687206c22f3ef0

SHA512
c1078fd6ae818daaa452b844186056df58d147b35d9cb250db28e28d9bb7baf1476d9f55325c58daadad2ea5f1929103c28ee51e2863eb427b757b586c1a8910

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5a5862.TMP

Filesize
669B

MD5
15107929858ebd4ce1b599c79a8127c2

SHA1
5c3d72d03472e3c3c79d5d0f4aceea0369bbf5b5

SHA256
661d5a779efbba2cfcc65628449b2675f8e0a374e1de01453dfa7247aea3de77

SHA512
6f119f0bfff462c92b9bb6e8996dd7b102a4917035adc19c4dbbe2fb86224e9376b8ac3dd500895e62ed910e82aec2f04936038bac4361fa0bd322c126a317d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
18098abe67c07da8ba82a28c4f645264

SHA1
2a97539499c4cd3ad0225d9a42c711f2c26fbc7f

SHA256
dfdeb41bef53aae56766192b58232c13612ffeeb7fd0261956acca21d239f402

SHA512
8eb5efea4dc08b3bcba0cf06a6c183520d047570edb6984e0821bda40d90e61dd3ec1a5d54e906a33f4e7ec32d05ba1b8366330ea4e0da9f63ec8b7efb88e8e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0f1fce4c00daaa39720ba3afffa01764

SHA1
366dfa2b9f13882d8c300c17b8a6bc979644affc

SHA256
714a06be12400e34f1a8e5f131d3998f96b4d555d3345227a1b36ed8cb174852

SHA512
0d4a3e4dfbb8ec63636218f88cfcb18e6af33e9f90d1decc5dead790ed903c9989544d096af00c41bb685834be07711f124eba256990e3f526d62e065d820310

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0ff040609708a82a2193c9b7e27debb1

SHA1
d49d804fb3c76f5733aaaa241388a45a7c1caac4

SHA256
99f9932dd07aa8e35a37235de5d447db80ea6f2cc8e699b3762a9d9a362a03e5

SHA512
0e794d75d236cea4cb272d474383d45511d5eff61d882a9c7fad5a6ba6b15f70931098b8a513e35906f33ce8312203d2edc85e5990a75b968ca625386b284dc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
18KB

MD5
1e0c041f86897288397221068ee64e19

SHA1
0b4e7bba986f6d1fed2624610f06dfc7bfe2caf0

SHA256
0d8b671a63651d68f0b6b89bf074c37c282f7472de96e9bef47810fed3f21b6f

SHA512
a12f28288a549205860628db1fe03d97e81f1920ef281469cb92ed2c5e1d0e74427d254da236cdb34bc501c1d550d65de17b0805f378c32303e52d3fec398be8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
fce0b6e08f8e0d7e013c23260bef22a3

SHA1
80d420347db541d02914c9ceb30ae2b70f95cc96

SHA256
7333e5061f0d2451d3c1fe1a008a20fc5f26f40e01fca6f4af5631f6b60e369f

SHA512
e7a0e583b7efb3247b415695f3fc5796bc2dd15883fdf8a1799b63316c233bd5e4a2012570cbf3a3ce81c53492e841914f14442237782dfeaba5fe0466605218

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
ee808e49f4df3ce3442ad362c1ea7053

SHA1
9ba8920d46a87d45dca23a55a0a62d8ec0bc8f76

SHA256
5ae112c2c8b4ee80cd48565a074d7012c0dd61979bfff0a71f9bcec7fd14f010

SHA512
73a432b0da3f6a870113adfadb3ec25b4b8a6de7534b6f820ee791045b0947ab5d873ea2354be682ae68ed4a91c904fc48f21cebca7cbe31bba099aa6573b1dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
7969887ef366fd3bbddb59135eb69ada

SHA1
42e2c9f2a166aba6e5bfdecad33121ebccfb8080

SHA256
c9817a48f9761ed5f0986a1bb7fbd48dd29c5e0442cd27a3ab2ce447f4761035

SHA512
3e0d1c0133678b9046c2fa43677366da1bdf4dfae5763e840d133f771916822fa2470f41c226a806f23d289e3884f98439e1dccc28c867b31078302b5528cb8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b49a13cd21faa8c0c42d8814dfa8789f

SHA1
242b3e976b13587311b842e32ca893ea6cd890ec

SHA256
7cda145924600542a065118543e59f8224596cb56272172e570124ec612f0e9e

SHA512
b576183ea269f40718b10312b763f6230b13b7f640a3ef29fef54fcbad78020a26a39b41efa8ef640a70aedb7c6b6ae2e32517132a6007a4aab821842cd27b44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
676761c163545bf9516eb2621f68ae11

SHA1
17e7fd40a8bbf34e4845bc85c7d759049fd93c50

SHA256
7c1f89d7bda0f0d8821b722b727b6dcaab7b6fc05072a221e14965d95a2cca01

SHA512
6788746db734db0d301a8017d081410aa3480f0b1f740484dd402728222e33594844adba064371875763d7767a67665e21085abde32af21acea40923bca92c24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
e81a8fa0fc436029a68f8e13345e55ee

SHA1
4f52abea058fd7df1bfb605e13945ccb1425fa04

SHA256
7a1935659dfa53490dcdd5d18f0beb0fd17b654f89f2d0e2299fcbe6f177d13d

SHA512
a7e2e2af1e885943f98dff63372b9ad4a8ae06265d28620e2b7ef9da58e7f7fca30c21e1b86808d45f100f9a3039cc7519c3f2c8faec6cf9da1f6b412f5e6dab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
21c1db3f3c1b3e5fb45e2b051d52092f

SHA1
7dda73473bfd53ada49e924eac91805c66fa7604

SHA256
0fdd6021e939c90f3e63711591a9c15eff9be194751680d455c4dc6db46b3a51

SHA512
c571f6925b5cae7532239e86d7b0380058ba8af426a07c3e75fc96c1cd4d4b2fa061f8857f6d0d4624e44f68d9503fc2536c0307ffa38f2f784074c2e5a380d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
2f8a5f3cd7cfb4a1ab4aa2b9ba0ddc6b

SHA1
f39e39b81d00b3d223405717be465683871595e8

SHA256
3f7153f9e6d05ec7bea91078efd5bc3c666dacde898183bb44a96105362d980a

SHA512
4db592f97d24b054745f2dedde30b36c94d032c0779247264cd451138d1fabb2539936c201d2e1b82d7e880d9bc95a9eca59687b26d80658218227c4f38f7499

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
768fb9944a78411e2d2ed60258ed16cb

SHA1
2603c60434e40e6fed9e080a5ec6acd0360dc6fb

SHA256
374e8a3215f953bea3f214f8f45b38f507680d2386339414eb42ad27e403f716

SHA512
6e98afe24c4a9ce1d681e88981cf4016a1f21ae4677caf49e4863291195fe25caa28b0f1a18af26d050c10ad759e7a1b246ceaff5bb329ca7929f8d025dbc275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
1f89b55339ca14fd40683e48f3b1e312

SHA1
406d058f3144832084b01128d674c5c417011ef5

SHA256
6769f6efdd29fcb1493c30cc52edab09a0bd3d4236437e16cf1f4a60e382f662

SHA512
1db6b448e833cb699460b42a398045c849340190aa15df0cfad912bd46910d9f4704b32f566d3688bfc4287c50976f7d98f777272500fd0354b947d2702f9a07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
710c539a2b7a707c9701b176c48af84f

SHA1
edd10a461bf4c91cd1bab83ea83b7ee53fd731e4

SHA256
5d4a6ae9d1dc0322a54dbc644d62973d431a9222fa3bf429810522b72081b76f

SHA512
1fd423d3e8c5f653b4b4ac7bffb7d5cfa466274833a069c528d669e9ebe6bde3c59231ef184ea1032ca07173b863337f9cc1b7b2aa50e12a175e4f8acc1c3bff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
326b115f13d677ab6c41ef6f3193f0c3

SHA1
db936a90c3651b04685bd6aaa5d7e3bcd8faa1bf

SHA256
5550ede619404e3d291401d087319b58558ed9169995324bc87d1e9deb88f754

SHA512
d7b49c05582eae0cac2ea64980c345f9490bac3e947501747f8c1a20f592cb70799a5e4d872dee2802186e9ee4bbac5b10b4ebe73fb0515bbeb9d6f3db44c467

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
6e49d9c7813f111e2263c12c58aa8bd0

SHA1
9082bb068ed925f1119cab233028c0ab4964e2c3

SHA256
8bb271303d12f3010a1a952b8f1eca8b6bd86d8d55c5a620265cb6814d14185d

SHA512
def63c456b5c544a1041789fb8bb28be30a449a841b6067707cb0861a7f768626d73c50d0d921d1a71116154ccaa7967213ca07e593e294e3a7f44b03bcce8ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
ea7dd6599762bdac95c9e0088f170740

SHA1
954a1f7a7c3fa30e0c839dde714662d40c06a1ce

SHA256
c9dea02e49ff10afa7fe595089a0a16e076ede45a25fcf22aba7195aab69d325

SHA512
d934b0c084e48fa9acfcfe4089cbe82d870658c00476f595cb6e31521e338ab7c9a7fd08862175262f4b8d843bd2d7f1f3e5afa2eba10fd0b251634cd8282e7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
3f21cde90041c1b420f1ef639c21a6ff

SHA1
36ba1eabcea51b8e3c26e2d74f39edcc1efe2ec1

SHA256
0f6eb312f9d50fa55e5ae1588618c40ac62c71fbd7a81d8ef045b1d063ca2691

SHA512
888c20f2440b0c006cea568d0a652c9511081af6e3a71d2d1b8f49754ba80222a4054ef94119b37b357868130b1e0753075d2d2c5bdde32f80bfa5f89eb6ff8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
8f44a50e968a7755537f480130ea868c

SHA1
eaec72678d35dbce732d3a15b197749c8c5ab9c7

SHA256
3668d83d402318c3dcf817b5282bbbfaac349b4789c6f84aec31d7fb29806c40

SHA512
e518990cd89295135b566a71efe269dc4d6bb7172409ff94f939b4f49245adb5bfca0a57b82fa13d9ba88ae159d921cdd0bfbf4d35a2fc6a0d17e50af7b86e2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ed10fdca8cb99b8ed553ce1524e634d4

SHA1
fde1a9cdf7521b9d75a64164ee1e6439f9dd4217

SHA256
8931b0d0e95f11f6e03dc76b602b7c3c4e217bf8422acfe2f9a8509807ebd86b

SHA512
6fa5d39cc039889f7f12f0e6841ce9812b4b08275ec42c893731f0439a01a60f0347ac54578708b9f11b11798e608d18ecf7bd0571249a54057f8bca8693599a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2c23c6bf33842e8514354651bc40aa3e

SHA1
939c1898f8d2c6ec6111dba8a735fc849ad511c4

SHA256
01f0b1ce3ef03a00ea48355614cc0cc8f1317b9d048393eedf0ffad02a2e040b

SHA512
2dd4ffce354605d3d3f9f220218a6584ccc93fd3d57a70130dfea3e47fc6e5fe5e6d0e0c8a251bbefea52e3a42088421fa4f046668bdce23cf8714bc16b5ee72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3f0a9e5855f3170fa3ed7e1077fcd2ab

SHA1
03016c2ccdb6c4cfafcd5cc36f0f9936674c1c1a

SHA256
a297a9e4240f2343f5a3b0e144ef6fafa8146649f88b329540613dedae59fce0

SHA512
498ca8286d6899ed78710816061a3bc074c158e075510a63a27cf32171188a511296ebc339d8f34ce5cdb1e9a222a83b8bf8752b0cb24b1a9563de8d307c671e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c9c8d8e66703b2207139df4589eb707b

SHA1
eb740ac6ce0222e1c296a73c87f199e9e50d244d

SHA256
2f7f2055b0e98598084935e7d393264253a31f046dfe69a3f27ba32049d71588

SHA512
4135a4da2279d8f0c6b095ac01c57e7b04f307975bc47b55ef3c89ca8f80362d1ec07ad491298a5d528f1b6cfdd3a5b6aafc0fc33607b8a67d4eeee88f886ee6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e4ad3c808fe0b92f24e1f8aa1b7f742e

SHA1
a2eb4ecbf8678ac308c4efec306bb615732c5b55

SHA256
40efd1b1d5aeb235919e91284bf7c7d5c2e1adc14be98e98992c37109418c5c9

SHA512
6cd28617da78a895ae35e7b5b589607626f02ff0f18426d57fa0259fe9c77962178c63f9901fef90919f687e018fbef9a2e95acfd5a687af48ad4cc8f2c617bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d819a59987c9f6258d2cee15e23ff9be

SHA1
d7550a84a3a23fc881bc42749dc9c09356b2df40

SHA256
91f903bf5eae670375ef655cee110a2f823b2c5c238f049ea728bf154c9dade0

SHA512
da34c8a3e2f82bd6ca1547ccbcd827a638497bdf83bf92c5a567aff50d51911869c6c4b361e921061c6e517004d7368d5454027b00998c268ddccdbbeaca95c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9c141ca38c6114be380524afe3495288

SHA1
c102e0265deba6a51aa0c25b0d2fef6b9c771aed

SHA256
f61e86d0da974e66850866006ad515196451a9e60cb4f29975a692c00e83c14f

SHA512
712fb8e1b3daba9035c996558af32574380b4f0173c4c41ead9c74530a0f6fd7d33312de32221f56709574a7bb83aacb625c21ce72f44690d06e138b1f886fb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
898614790ad36b0084ca9e9c00bdfc4f

SHA1
c3d3c9b26d4577567c7173410a653d137a6635c8

SHA256
59d8afa6e95d01f788dc24f16ed62eaa850e544d4edcc16388eea130117daeb1

SHA512
e37622910eb79f6fc9d039a5309bbe8c6f2b7c4531ec8282030cc89f001a83e7815048a7665e8c188e0fcbb6e8334ed90715c5e0ec2d64dfc664d79597c7e3e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
58cdafc2ae226c6bfb580288276782be

SHA1
771f5d1b0de4d99b1c59cc05f595b383dcbfc519

SHA256
b812b955919e9b265090c5c8d5b81680c6f3c5d4b9cdfe209488816c90c6ff2f

SHA512
1c76029ff6500da634df92641032ab54ee9567a7b2e43ff98c187304fe9a1e5cf15fdd290f4346970445870adb94af57d9f90223cf0e441f74ba6366ebc0d493

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e5a8433a384321f2e158879f3f58a1b2

SHA1
fb2926a26944b0ad76a131bd70a9ed219d6afc99

SHA256
e2b86797252beb1e3d26ae219daf8e7ec1529f7f85feea08cd0ceb3ac6d33665

SHA512
1a5100e15d6e46f0687b2ba09b657c2b69901d6f7b0de6578f39bf5c74d12d253ca8d6a3c44c46593a4505b07e2809b99df2125fd8ea49837473114f86d77e40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b40bd58b3cfce57d4da9a9fc5ffddbeb

SHA1
1e19feac7eca15befa1f446c2efc10e471f14e76

SHA256
3b71768c401ea213ae653db48eeb4a90e8884241aadcdad44b090025dd766d0c

SHA512
d86759fd47cc237afd6865cf13999a295ec65914b47a57425ef70ecc6493ac7eb79f99f3cff251e22c911dc4a069823aa5166289f67baf152eddf9738ccc9145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
528a9d83e20c5852e30f09bb58e15f6b

SHA1
9816abde0df0349e402ad0bce969d7b37b174319

SHA256
97094aef2c786787f4188f726687bd0adfcc3842862ad68db5de69575a8e4254

SHA512
fbd2ea4cb3cb6e8c3e37723dca0f19cb8e202e78dd8aa3ed3b671ed00fe708511768db9d0fc0f6332391c669df0a16d5919d66253ded33b9506aae686a20e2bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b654928ce3ade19b566f8c147ad7ddbe

SHA1
cf7958b71181a79e2fe04a80421406dbe2949542

SHA256
08c5eedd39dce7faffdf883dbc58ec2f62cb36044fd463b31e88518732b45cd8

SHA512
288b94e512cc0cfd511a71d0d01726c57bc6f25c307ed5bd0e282c11d88afadcc283b4f9a20ee0ff4467338dc904ff1e129f10e2ad7d09a539268956d3d30570

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
84797a37de9fea21b248315131aaa844

SHA1
1e1ffff0db06934992d9673691263734a7f653d9

SHA256
0d8826dc21e59f2c43bd0b65df9de8eb95ec454d1313c95dd58b0ff0c814951f

SHA512
df062bba7755ae2714a3a0a220650072ccd0bc2481856f901cba2fa9de84dbb7f05881387886fa153c1f2a26cd6ea7f61fa5d65e645f0bf6859ca2f377724b93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4dbc895db3ffbc3ebff5a2889acd6d9d

SHA1
9a13bfbdd6155fb70c09ebbbc54e3444735874ef

SHA256
8d4b2101d4e019024049a3eef00ebf7d719f431c5fbbedf1af5055c6013873a8

SHA512
384c2e97b0b90c12d08f631e4037cb6ea525b35a42d12444d223c2d0909c830dca00c1a1a75c49347aec74e6d98643a73eb3af3e4965720537561a5c55d77096

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8d19bcb83e144adc8d00319668c8d28e

SHA1
ae445de43b99c743f70c1b4965dc4a897aab0b63

SHA256
5ac3562371c97cd82033a24f7a501f9c9241b3478b205c815bb5ca6b3e1453de

SHA512
892e92967da4699df7f12183cc324f69d3e1b6703a98f27a27abe8aebedc9bd81a3670e736d17ba8e09646677a4d506ec05c94cae4108894864749cb88b25808

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
e86f979863eafd7ffab6fd0d2618403f

SHA1
01fdeb542f867d7b25d04ddb18e1ec65d44ef143

SHA256
baca1ac8bf6feedfbc1e59e783bb6d6e33cd51d2fc32f55e197801c0faa2ccb7

SHA512
185d61bf4ccd4551a476c5fd036102854a33f18394e1ff06b41c5255cf9d962273c74547afe33ccac8f512601b75b2fa5cc4330e59b967b9ed0b461a48bae6c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4f5ddd9d39b97d2d93a5ddc3f90d3d83

SHA1
756d909ab4fe143ed1e5a03b524e8cf6b2637792

SHA256
9786402864b4d9bc2f00793a466d7ff75d65eed3ca4676298827ffb3ade2aa9d

SHA512
0149047626a74e8b8989bf6a9fc08c126652e1c7424d5ebbe4bdf024d6e359cd5e74cd643738b8b16366364d88abf7ad6eef1c7b2d00559340e5736d0885af16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0cdd436334ce2e39dd705a551f337329

SHA1
437dd02049767fee5a229c8f1feb03ea0caa5022

SHA256
68da1815ecdfee8b2b17399aefa2823fee30442035d1099af209ff2ca5c085dc

SHA512
465841c49d7386712ca060c4a557dd0eb50c8684fd7f679a8ac7797dc6c2317be01406443c6846016efeb343f69a8625a98a1daf97be7166c86c52b8b9b8f287

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d5f47950b67df615951e318ce1414aa3

SHA1
ee9319c951c47fd96c4b3521bd897c50ee54204c

SHA256
6c0e2efcb428bc8dbe43568eda3dc06b36e37c628b2cd284fa9fc20460d38c10

SHA512
570eeb07818dfc38ef9676922f198435ae301a447c55ea5fd32d82f86b0cc70caff451104b5629e1867f590754c4647a6c14e9b2c8a2506f23909e6b593c7468

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f591bb618c1a1735ef7c3e4941a72fcb

SHA1
d577540a5c9d26660d4720935ca5bdb549550a58

SHA256
c71cf6f7e1667ef4bbd0a69b0ea9286d0cf42cd145b5f2ad680190b373253b4c

SHA512
0bbf9de144227c5ca147e60f94837a3d3cc089e41fa9d80760b54e81e46ca5b1063edb66dcdb791a532c2b3eb87e83cfba993947b9cd7239b33ae17564ef50fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6012c24ef911f7790734c2197d757aeb

SHA1
848e441ce9659476bd8afe6c21fceec1b689438e

SHA256
7378ef138e5b7af7a40cdedd38bb5b57b9378d576be5d639550c27750c79508a

SHA512
cdb1026665585488c069bc9450c01c5d22df8f473e01e1557f45617ee29ec12b67a496009a78c3710f6aa67161687ef278f3e74a016e75ab26f5a2ed2b21949a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt

Filesize
76B

MD5
46cb7641be727eb4f17aff2342ae9017

SHA1
683a8d93c63cfa0ccbf444a20b42ae06e2c4b54d

SHA256
944fff1dd6764143550534f747243ef7d84fdac0642c94135ab40f584520f63e

SHA512
dc1b5f363e90abff5c1663a82764296922c842820d2819805e87da6da1081f1b5f2d8debc83ac34a26ce289b7b22588b022433686b19b039074ae184968b9fda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5bdfbe.TMP

Filesize
140B

MD5
7a22573aa326f897ecd8e9fbd3952fdf

SHA1
c6de700251735969e83dad3858e58596f6bc1e0b

SHA256
2ecd675e4cc54dfa8c772691c14c4b4415d1a2a833cb619a2c0765d82ad5c766

SHA512
1857e240c6f69f2a4c87a118b18fbb114763a3740e951275977894fd8e703e739779c31a83d0b116c3724db9bbb403cab2bd14274c7b82c8129f722743e260e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
a916aa186d5460ca8b2e514556685c94

SHA1
4c4ed28aa2b013fc14c629f3a0543b1ad2c6c6e8

SHA256
f4aabc727e55e170563d1bf2bd19fcc6c76664bf008ef675944318f18b7e95da

SHA512
cd1d237be6d65aaa3db5eed850abce246f9cba177d5a36fe2a524d1c41d2e126813bbaeadb74104a31fcdd9ef6e9603a65ff274d35a2fa15ac27fd167f26ab7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
49a136b8d790810e4a3662f767a32b59

SHA1
e87982a7ed1c69289f5c419521c31bf40c150548

SHA256
8afe073d5a7191597ba5d5f3488fb303461e3b8a85ed66fab488146d609b0007

SHA512
3858aa117dab12c5895313c36632c532941cf4dc22b5ecb54f7b6503e6f241d54b02025025dfcfb7277738ba1cd944b6456d3f1c03b6b1a44835a594c7803020

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
e617ccbde8057831e699d61473ac95d4

SHA1
c61224b65533d0b4b19999b932c98c224a5e1800

SHA256
0b6b68c5353facac5eaffe52f7480f36dc84b38838d2963ddda4969c6d2fb416

SHA512
2988114501e662a6f025b625103df4760bb8799978007e39a1be9b281fcf627a43f84912014c4f9cd827550dd97396e7184916a98b1991cd265f3f859f59a475

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
bf91f3c098fcf61452b6476bde613e9e

SHA1
e1bfd82da3d03348e097445c71861a3eaba2de64

SHA256
e49bb4c7b20c67e430fd135c07e7d16f73fc4c3e389858424ecb62170ee2ae9a

SHA512
cc26126f08a938114189b6965e4a8e979158244e000046ba5c8646ee0ae28f6aa8f5cdba4c7893b41611abcf390c40aaae9eb8b0b2ecc59e7ee46b589716f739

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\f343dba6f4fd52298004828635a1e34e

Filesize
7.3MB

MD5
f343dba6f4fd52298004828635a1e34e

SHA1
a1e1c767209ed1913e4d40e8df0984d7087df9f1

SHA256
15eca24549dc201e53d468c478544d867f243e99aebe6b8399380d07b5c81978

SHA512
0188996c2f075dc3d32f6c707061db0e0ed878a41da4e41077b306238a000251e8360195c24b1d48200fb4d9325a680485d2433b530e8920a0de52ec4d3b9ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3240_1504780029\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3240_1504780029\a90aee61-d5c0-4aeb-ae1d-72936ba4980b.tmp

Filesize
135KB

MD5
3f6f93c3dccd4a91c4eb25c7f6feb1c1

SHA1
9b73f46adfa1f4464929b408407e73d4535c6827

SHA256
19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e

SHA512
d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
7.2MB

MD5
2a39b191557fe027454094fcb79e4c9f

SHA1
a8c2d42f149ec3d8b8ab2fb38e7b1bac786ca8da

SHA256
1cfa38c4091921ff9231b90989c616f9d73bf8f328a263e9e1621a42b1053201

SHA512
77df1c00cadf139dd4f791555abd927d16ddcc5e696a7760ef5a2901f277997f23b2334fd8b2b50c573567139b3f653afb7a8beef089084e2db7fe4fa10ccafb

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\Installer\MSIABE0.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIAC40.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIB848.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
4bf9849e924090269d806b136c2f7b07

SHA1
80b37b35688756cd5875d1201b08b291b16e1aed

SHA256
742528dc9556958910db3b62e690b73bfb06caa202767f530961fdf7e00e72b2

SHA512
6d1a9e77d4a9893c4f881705a8d6fcffb3151c3be07b121ae2981a7056d87b1021ed9e84f5b66bd9b7cece401ed7eddfbdb8bde7a593f19d70b4bc6d10ea2c04

Download Submit
memory/1004-5375-0x0000000073D60000-0x0000000073F70000-memory.dmp

Filesize
2.1MB

Download
memory/1004-5128-0x00000000004F0000-0x0000000000525000-memory.dmp

Filesize
212KB

Download
memory/1004-5129-0x0000000073D60000-0x0000000073F70000-memory.dmp

Filesize
2.1MB

Download
memory/3532-4-0x000001B0A6DD0000-0x000001B0A6DF2000-memory.dmp

Filesize
136KB

Download
memory/3532-2853-0x000001B0A8B60000-0x000001B0A8B72000-memory.dmp

Filesize
72KB

Download
memory/3532-5-0x00007FFD53DF3000-0x00007FFD53DF5000-memory.dmp

Filesize
8KB

Download
memory/3532-59-0x00007FFD53DF0000-0x00007FFD548B2000-memory.dmp

Filesize
10.8MB

Download
memory/3532-2851-0x000001B0A6EA0000-0x000001B0A6EAA000-memory.dmp

Filesize
40KB

Download
memory/3532-3276-0x00007FFD53DF0000-0x00007FFD548B2000-memory.dmp

Filesize
10.8MB

Download
memory/3532-0-0x00007FFD53DF3000-0x00007FFD53DF5000-memory.dmp

Filesize
8KB

Download
memory/3532-2-0x00007FFD53DF0000-0x00007FFD548B2000-memory.dmp

Filesize
10.8MB

Download
memory/3532-1-0x000001B08C590000-0x000001B08C65E000-memory.dmp

Filesize
824KB

Download
memory/3976-3271-0x00000212B0DA0000-0x00000212B12DC000-memory.dmp

Filesize
5.2MB

Download
memory/3976-3269-0x00000212961D0000-0x00000212961F4000-memory.dmp

Filesize
144KB

Download
memory/3976-3273-0x00000212B0A10000-0x00000212B0ACA000-memory.dmp

Filesize
744KB

Download
memory/3976-3275-0x00000212B0AD0000-0x00000212B0B82000-memory.dmp

Filesize
712KB

Download