8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Resubmissions

16-12-2024 23:30

241216-3hmjsstkgw 9

16-12-2024 23:27

241216-3frqqstkcy 7

16-12-2024 23:23

241216-3dmc8stqem 7

Analysis

max time kernel
597s
max time network
602s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

9^/10

discovery evasion persistence phishing privilege_escalation themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 25 IoCs

pid	Process
924	Solara.exe
4336	Bootstrapper.exe
4984	node.exe
4784	Solara.exe
4564	node.exe
456	RobloxPlayerInstaller.exe
2936	MicrosoftEdgeWebview2Setup.exe
1916	MicrosoftEdgeUpdate.exe
1540	MicrosoftEdgeUpdate.exe
5000	MicrosoftEdgeUpdate.exe
2036	MicrosoftEdgeUpdateComRegisterShell64.exe
4860	MicrosoftEdgeUpdateComRegisterShell64.exe
5092	MicrosoftEdgeUpdateComRegisterShell64.exe
4868	MicrosoftEdgeUpdate.exe
3428	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
328	MicrosoftEdgeUpdate.exe
4624	MicrosoftEdge_X64_131.0.2903.99.exe
2828	setup.exe
4076	setup.exe
3264	MicrosoftEdgeUpdate.exe
1836	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe

Loads dropped DLL 34 IoCs

pid	Process
3772	MsiExec.exe
3772	MsiExec.exe
876	MsiExec.exe
876	MsiExec.exe
876	MsiExec.exe
876	MsiExec.exe
876	MsiExec.exe
2728	MsiExec.exe
2728	MsiExec.exe
2728	MsiExec.exe
3772	MsiExec.exe
4784	Solara.exe
4784	Solara.exe
1916	MicrosoftEdgeUpdate.exe
1540	MicrosoftEdgeUpdate.exe
5000	MicrosoftEdgeUpdate.exe
2036	MicrosoftEdgeUpdateComRegisterShell64.exe
5000	MicrosoftEdgeUpdate.exe
4860	MicrosoftEdgeUpdateComRegisterShell64.exe
5000	MicrosoftEdgeUpdate.exe
5092	MicrosoftEdgeUpdateComRegisterShell64.exe
5000	MicrosoftEdgeUpdate.exe
4868	MicrosoftEdgeUpdate.exe
3428	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
3808	MicrosoftEdgeUpdate.exe
3428	MicrosoftEdgeUpdate.exe
328	MicrosoftEdgeUpdate.exe
3264	MicrosoftEdgeUpdate.exe
1836	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
4452	taskmgr.exe
2236	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe

Themida packer 39 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4784-3373-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3376-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3375-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3374-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3384-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3385-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3409-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3458-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3463-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3482-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3505-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3512-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3529-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3548-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3566-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3580-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3607-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3616-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3633-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3829-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3872-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-3917-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-4117-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-4572-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-4714-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-4803-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5012-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5065-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5230-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5253-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5265-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5286-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5311-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5345-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5369-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5381-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5393-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5415-0x0000000180000000-0x000000018110B000-memory.dmp	themida
behavioral2/memory/4784-5416-0x0000000180000000-0x000000018110B000-memory.dmp	themida

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 2 IoCs

flow	pid	Process
35	3572	msiexec.exe
37	3572	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
62	pastebin.com
304	pastebin.com
305	pastebin.com
306	pastebin.com
61	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
192	api.ipify.org
194	api.ipify.org

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
1836	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
4784	Solara.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
1836	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\columnify\width.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\fonts\Michroma-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\PlatformContent\pc\textures\plastic\normaldetail.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\TerrainTools\mt_replace.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\buffer\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarnpkg.cmd	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ControlsEmulator\Playstation5_Dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\particles\sparkles_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\textures\ui\LuaChat\9-slice\new-message-indicator.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\event-target-shim\dist\event-target-shim.umd.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-stars.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\reify-output.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\fonts\RobloxEmoji.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\SelfView\SelfView_icon_mic_disabled.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.99\Locales\vi.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\dist\abort-controller.mjs.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\base64-js\LICENSE	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\StudioSharedUI\statusWarning.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\TerrainTools\mtrl_water.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\period.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\textures\ui\LuaChat\9-slice\error-toast.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.99\Locales\fr-CA.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cli-columns\color.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\avatar\heads\headL.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\LayeredClothingEditor\LayeredClothingEditorIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\subclass.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpack\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_trustroot.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\http-proxy-agent\dist\index.d.ts	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff-apply\rollup.config.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\install.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmteam\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\test.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\builtins\package.json	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\TerrainTools\icon_shape_cube.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\xboxLT.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\create-config-gypi.js	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\glow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\ExtraContent\textures\ui\LuaChatV2\common_search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.99\msedge_100_percent.pak	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tootallnate\once\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\has-flag\license	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\MenuBar\icon_more.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.99\dxcompiler.dll	setup.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\verify\body.js	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.99\VisualElements\LogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.99\Locales\qu.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\InspectMenu\selection_rounded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\is-lambda\LICENSE	msiexec.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\LayeredClothingEditor\Icon_Pause.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\StudioSharedUI\search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\content\avatar\heads\headP.mesh	RobloxPlayerInstaller.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIFBFB.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE021.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBBB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF031.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2742.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI280E.tmp	msiexec.exe
File created	C:\Windows\Installer\e57da62.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE010.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3435.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57da62.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2AAF.tmp	msiexec.exe
File created	C:\Windows\Installer\e57da66.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFD1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECA5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFF2.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4868	MicrosoftEdgeUpdate.exe
328	MicrosoftEdgeUpdate.exe
3264	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4636	ipconfig.exe
3048	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133788655355596383"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-b71c150c7c1f40de\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3532	Bootstrapper.exe
3532	Bootstrapper.exe
3572	msiexec.exe
3572	msiexec.exe
924	Solara.exe
924	Solara.exe
3272	chrome.exe
3272	chrome.exe
4904	chrome.exe
4904	chrome.exe
4336	Bootstrapper.exe
4336	Bootstrapper.exe
4336	Bootstrapper.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
1832	chrome.exe
1832	chrome.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1140	WMIC.exe
Token: SeSecurityPrivilege	1140	WMIC.exe
Token: SeTakeOwnershipPrivilege	1140	WMIC.exe
Token: SeLoadDriverPrivilege	1140	WMIC.exe
Token: SeSystemProfilePrivilege	1140	WMIC.exe
Token: SeSystemtimePrivilege	1140	WMIC.exe
Token: SeProfSingleProcessPrivilege	1140	WMIC.exe
Token: SeIncBasePriorityPrivilege	1140	WMIC.exe
Token: SeCreatePagefilePrivilege	1140	WMIC.exe
Token: SeBackupPrivilege	1140	WMIC.exe
Token: SeRestorePrivilege	1140	WMIC.exe
Token: SeShutdownPrivilege	1140	WMIC.exe
Token: SeDebugPrivilege	1140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1140	WMIC.exe
Token: SeRemoteShutdownPrivilege	1140	WMIC.exe
Token: SeUndockPrivilege	1140	WMIC.exe
Token: SeManageVolumePrivilege	1140	WMIC.exe
Token: 33	1140	WMIC.exe
Token: 34	1140	WMIC.exe
Token: 35	1140	WMIC.exe
Token: 36	1140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1140	WMIC.exe
Token: SeSecurityPrivilege	1140	WMIC.exe
Token: SeTakeOwnershipPrivilege	1140	WMIC.exe
Token: SeLoadDriverPrivilege	1140	WMIC.exe
Token: SeSystemProfilePrivilege	1140	WMIC.exe
Token: SeSystemtimePrivilege	1140	WMIC.exe
Token: SeProfSingleProcessPrivilege	1140	WMIC.exe
Token: SeIncBasePriorityPrivilege	1140	WMIC.exe
Token: SeCreatePagefilePrivilege	1140	WMIC.exe
Token: SeBackupPrivilege	1140	WMIC.exe
Token: SeRestorePrivilege	1140	WMIC.exe
Token: SeShutdownPrivilege	1140	WMIC.exe
Token: SeDebugPrivilege	1140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1140	WMIC.exe
Token: SeRemoteShutdownPrivilege	1140	WMIC.exe
Token: SeUndockPrivilege	1140	WMIC.exe
Token: SeManageVolumePrivilege	1140	WMIC.exe
Token: 33	1140	WMIC.exe
Token: 34	1140	WMIC.exe
Token: 35	1140	WMIC.exe
Token: 36	1140	WMIC.exe
Token: SeDebugPrivilege	3532	Bootstrapper.exe
Token: SeShutdownPrivilege	1288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1288	msiexec.exe
Token: SeSecurityPrivilege	3572	msiexec.exe
Token: SeCreateTokenPrivilege	1288	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1288	msiexec.exe
Token: SeLockMemoryPrivilege	1288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1288	msiexec.exe
Token: SeMachineAccountPrivilege	1288	msiexec.exe
Token: SeTcbPrivilege	1288	msiexec.exe
Token: SeSecurityPrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeLoadDriverPrivilege	1288	msiexec.exe
Token: SeSystemProfilePrivilege	1288	msiexec.exe
Token: SeSystemtimePrivilege	1288	msiexec.exe
Token: SeProfSingleProcessPrivilege	1288	msiexec.exe
Token: SeIncBasePriorityPrivilege	1288	msiexec.exe
Token: SeCreatePagefilePrivilege	1288	msiexec.exe
Token: SeCreatePermanentPrivilege	1288	msiexec.exe
Token: SeBackupPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeShutdownPrivilege	1288	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4784	Solara.exe
1832	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
1836	RobloxPlayerBeta.exe
800	RobloxPlayerBeta.exe
2236	RobloxPlayerBeta.exe
4368	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 3272	3532	Bootstrapper.exe	86
PID 3532 wrote to memory of 3272	3532	Bootstrapper.exe	86
PID 3272 wrote to memory of 4636	3272	cmd.exe	88
PID 3272 wrote to memory of 4636	3272	cmd.exe	88
PID 3532 wrote to memory of 2852	3532	Bootstrapper.exe	89
PID 3532 wrote to memory of 2852	3532	Bootstrapper.exe	89
PID 2852 wrote to memory of 1140	2852	cmd.exe	91
PID 2852 wrote to memory of 1140	2852	cmd.exe	91
PID 3532 wrote to memory of 1288	3532	Bootstrapper.exe	93
PID 3532 wrote to memory of 1288	3532	Bootstrapper.exe	93
PID 3572 wrote to memory of 3772	3572	msiexec.exe	99
PID 3572 wrote to memory of 3772	3572	msiexec.exe	99
PID 3572 wrote to memory of 876	3572	msiexec.exe	100
PID 3572 wrote to memory of 876	3572	msiexec.exe	100
PID 3572 wrote to memory of 876	3572	msiexec.exe	100
PID 3572 wrote to memory of 2728	3572	msiexec.exe	106
PID 3572 wrote to memory of 2728	3572	msiexec.exe	106
PID 3572 wrote to memory of 2728	3572	msiexec.exe	106
PID 2728 wrote to memory of 4984	2728	MsiExec.exe	107
PID 2728 wrote to memory of 4984	2728	MsiExec.exe	107
PID 2728 wrote to memory of 4984	2728	MsiExec.exe	107
PID 4984 wrote to memory of 2344	4984	wevtutil.exe	109
PID 4984 wrote to memory of 2344	4984	wevtutil.exe	109
PID 3532 wrote to memory of 924	3532	Bootstrapper.exe	112
PID 3532 wrote to memory of 924	3532	Bootstrapper.exe	112
PID 3272 wrote to memory of 4656	3272	chrome.exe	119
PID 3272 wrote to memory of 4656	3272	chrome.exe	119
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 1636	3272	chrome.exe	120
PID 3272 wrote to memory of 3704	3272	chrome.exe	121
PID 3272 wrote to memory of 3704	3272	chrome.exe	121
PID 3272 wrote to memory of 3212	3272	chrome.exe	122
PID 3272 wrote to memory of 3212	3272	chrome.exe	122
PID 3272 wrote to memory of 3212	3272	chrome.exe	122
PID 3272 wrote to memory of 3212	3272	chrome.exe	122
PID 3272 wrote to memory of 3212	3272	chrome.exe	122

cURL User-Agent 8 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	308	curl/8.9.1-DEV
HTTP User-Agent header	311	curl/8.9.1-DEV
HTTP User-Agent header	312	curl/8.9.1-DEV
HTTP User-Agent header	313	curl/8.9.1-DEV
HTTP User-Agent header	314	curl/8.9.1-DEV
HTTP User-Agent header	315	curl/8.9.1-DEV
HTTP User-Agent header	344	curl/8.9.1-DEV
HTTP User-Agent header	645	curl/8.9.1-DEV

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4636
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\ProgramData\Solara\Solara.exe
  "C:\ProgramData\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 98CCAE4AEAF0058B2F0934629CCF99F5
  2⤵
  - Loads dropped DLL
  PID:3772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3D4DF053961F94526C3D9BDDDAA2DC7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EB631A7A2646CD50788317C4F978D314 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:2344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x45c
1⤵
PID:3624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc630fcc40,0x7ffc630fcc4c,0x7ffc630fcc58
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,17431140350576562287,6478474773140422996,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1824,i,17431140350576562287,6478474773140422996,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2008 /prefetch:3
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,17431140350576562287,6478474773140422996,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,17431140350576562287,6478474773140422996,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3364,i,17431140350576562287,6478474773140422996,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,17431140350576562287,6478474773140422996,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,17431140350576562287,6478474773140422996,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5084,i,17431140350576562287,6478474773140422996,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:540

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xf8,0xe0,0x7ffc630fcc40,0x7ffc630fcc4c,0x7ffc630fcc58
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2024,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1840,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4704,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4848,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3732,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3340,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4988,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3276,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4856,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5448,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5024,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5732,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5996,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5484,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5972,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6220,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6320,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5524,i,4165272383497765985,9971226428448807514,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:1832
- C:\Users\Admin\Downloads\Bootstrapper.exe
  "C:\Users\Admin\Downloads\Bootstrapper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c ipconfig /all
    3⤵
    PID:2856
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3048
- - C:\Program Files\nodejs\node.exe
    "node" -v
    3⤵
    - Executes dropped EXE
    PID:4984
- - C:\ProgramData\Solara\Solara.exe
    "C:\ProgramData\Solara\Solara.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:4784
  - - C:\Program Files\nodejs\node.exe
      "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" cb6df6c7dfc74dca
      4⤵
      Executes dropped EXE
      PID:4564

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc630fcc40,0x7ffc630fcc4c,0x7ffc630fcc58
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1852,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:3192
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6dfbc4698,0x7ff6dfbc46a4,0x7ff6dfbc46b0
    3⤵
    PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5060,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4020,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3300,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3388,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4512,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5480,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5652,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1676,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5960,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5944,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5972,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4576,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5556,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5492,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5616,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5840,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6244,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4432
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:456
- - C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2936
  - - C:\Program Files (x86)\Microsoft\Temp\EU84A4.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU84A4.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      PID:1916
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1540
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5000
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2036
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4860
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDkxQzAyMDItODZCQy00Q0VCLUI1OEYtMTRFOTA4RkY2QTg5fSIgdXNlcmlkPSJ7MzBCOTYxMDQtMjlCQy00RUM1LThFMzYtNkJDQkQ3QTUzRUE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswNDg4MDMzRC1FNkZELTQ2NEUtQkMyNS03MTREOTcwRjdDQzV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NjYwNDMzNjk0IiBpbnN0YWxsX3RpbWVfbXM9IjYxMSIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4868
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{491C0202-86BC-4CEB-B58F-14E908FF6A89}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3428
- - C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 456
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of UnmapMainImage
    PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5692,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5440,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:6TtbW5aXGJv99Eq-uOO1lpfSpnAu5G8386t0RslUIIHFu0cIQ1FPMudhGEc-gObvu-xVKlHDBS-XEVVzRTtPRDde8WLPMEXxkuOUdQwFnrrFmk1cKBw6Gp03bgAIIW2rnliW77Erd1Q83GVrsZuXl6gpX-b-YOpZBPP8Xdw6ubWFiFJkMdJ0RIOYwRrxnZm3eObyiNNojDn2ZIBTv_ODhX7wgMDL6M1PX61ArK46wGQ+launchtime:1734392384628+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1734392165947005%26placeId%3D16732694052%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D1a897150-5b89-47e7-90ff-496bd0704fb9%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1734392165947005+robloxLocale:en_us+gameLocale:en_us+channel:zflag+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of UnmapMainImage
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5228,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:s6QQzigJDNvZ13Z8NJpeztuA5a_NJXRyye-dNYsyz0PCjrkG0RJPSpJ5d4xaGGxGeqDsNNNZr7gSnf7bP4RBJj-kOl1Twg3E4jZbFd1-fJu3SaT7bsYhoq-18T28G1Q8K5Vb_ZUC21XT41QwFj3-ELvY5p2fh8NBScRni9EmJM6j6jJ96SUv4SUz2cj6M0uIEKsAP0NqRCFfKjDPttTerzQ4Wz3pea9Fg6njc09ms2A+launchtime:1734392422126+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1734392165947005%26placeId%3D16732694052%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D7c140416-104a-4994-9dda-6c93505e5678%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1734392165947005+robloxLocale:en_us+gameLocale:en_us+channel:zflag+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of UnmapMainImage
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6436,i,16207728169259729872,13137708519000175516,262144 --variations-seed-version=20241216-050106.959000 --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-b71c150c7c1f40de\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:2GsErLZOtAbQ-pZIDah72cDUjijYR82BOEoBVClBcHxq1-Wvssez0AXT-g3K2gX4jzS-yhOwtx9IIgimI8aQxs_LwltX_0xPD4uVUaVMWG-8DwNlNi6s1gwbErz6vGCdQbL5UPSC1SdJN9Cj3x-pBKCt0Nbfg6SlQU9ddBiUoKr6vME77OArdmRK5OB0CuZmLnmiRh7kz9jEoP6djk95LsQN9CGrOAzA8tYixVvySbk+launchtime:1734392442893+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1734392165947005%26placeId%3D16732694052%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D4c4d07b7-617b-4b3a-9011-35b5ed655d0a%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1734392165947005+robloxLocale:en_us+gameLocale:en_us+channel:zflag+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of UnmapMainImage
  PID:4368

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3808
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDkxQzAyMDItODZCQy00Q0VCLUI1OEYtMTRFOTA4RkY2QTg5fSIgdXNlcmlkPSJ7MzBCOTYxMDQtMjlCQy00RUM1LThFMzYtNkJDQkQ3QTUzRUE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyRDZGMUFBOS0yRDA4LTRGRTYtQTgxMC0yM0Q1MTAzM0UxRUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg2NjYxMjM2ODkiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:328
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EB12C77A-84C6-4FEF-BE18-AEE44403A63B}\MicrosoftEdge_X64_131.0.2903.99.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EB12C77A-84C6-4FEF-BE18-AEE44403A63B}\MicrosoftEdge_X64_131.0.2903.99.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EB12C77A-84C6-4FEF-BE18-AEE44403A63B}\EDGEMITMP_FD7DD.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EB12C77A-84C6-4FEF-BE18-AEE44403A63B}\EDGEMITMP_FD7DD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EB12C77A-84C6-4FEF-BE18-AEE44403A63B}\MicrosoftEdge_X64_131.0.2903.99.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2828
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EB12C77A-84C6-4FEF-BE18-AEE44403A63B}\EDGEMITMP_FD7DD.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EB12C77A-84C6-4FEF-BE18-AEE44403A63B}\EDGEMITMP_FD7DD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.140 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EB12C77A-84C6-4FEF-BE18-AEE44403A63B}\EDGEMITMP_FD7DD.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.99 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff68b452918,0x7ff68b452924,0x7ff68b452930
      4⤵
      Executes dropped EXE
      PID:4076
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDkxQzAyMDItODZCQy00Q0VCLUI1OEYtMTRFOTA4RkY2QTg5fSIgdXNlcmlkPSJ7MzBCOTYxMDQtMjlCQy00RUM1LThFMzYtNkJDQkQ3QTUzRUE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyNDkzRjlBOS00OEY2LTRDMzMtOTgwRi04MUJCREZDMjBBREN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy45OSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODY4MDcwMzMyOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg2ODA3NzM0ODUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MDE3MTUzMzI4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wZjZhNmRkMy0wYjIyLTRlNzgtYjA0Zi02MDQ5NGViNGM0ZTg_UDE9MTczNDk5NzA1NyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1DQUFaMWNDSzdXbW1aJTJmMUJCbks2aUZwcUNlRWtqRVc3WnRhRjQlMmI1QU9FS3R3QWhnaW9DVEJWWFFpWnY5anNtOHN0a2tINlV0ZE90Rmp4OXVzV1Y4S2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzY4NTU2NDgiIHRvdGFsPSIxNzY4NTU2NDgiIGRvd25sb2FkX3RpbWVfbXM9IjI2NjE2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTAxNzMzMzI4NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkwMzE4NjMwOTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2NjQxMTM1NTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5NTAiIGRvd25sb2FkX3RpbWVfbXM9IjMzNjMxIiBkb3dubG9hZGVkPSIxNzY4NTU2NDgiIHRvdGFsPSIxNzY4NTU2NDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYzMjIxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3264

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57da65.rbs

Filesize
1.0MB

MD5
3e73813da614bdcf922ee037d0de0dca

SHA1
70914ca0c6ebb0faea37863796bf47fdf2a77d7d

SHA256
fe9a5119aee612a08e12be29f9ff146dcb3e8f30134d9db5f61537d081cb3ea8

SHA512
742bbd55b7997edf12cfb64518cbfea2832722b3ca7e1c94e7510758552943a9d5afc0a8d9f2c6ff133df77e5240038058d25ed26b1761c08f26e3e1d685b5c9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.99\Installer\setup.exe

Filesize
6.6MB

MD5
f6ef6691c60c40c1b64c857aa7140f65

SHA1
0a18181edb6539ace366e7d804e37ec558c52b79

SHA256
df10339c63d2f24162ffa7d61c797f46a4ec4d91f1f74c3290646a232c7e9c56

SHA512
bf2829c18f109ee181518b7819a23782fdee4f81644a9d062e060ccac7a2df27d2f49cb3c26d63e6c9e2aed6ff166f2af596c0365284ef1dc0a70363ea8fd404

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
7.1MB

MD5
f7f075d6cca390dbb3195330dced1bfc

SHA1
2a6624ae08c077034b3b41dca1376287f7e0cb43

SHA256
97c03bfa6193f0d5f897eb78b1867c17790b085fe610d0e1130e9a80e36d5577

SHA512
bbb4389ef71eda38ca80a999b5a6616484547b72974b906a7b26939eb5b5d911dc68d046a371a3791e8b2c7557b987e94a52fdc9cd7cc9e6996e3ca5371004f6

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
d3c17d591e4cf2d3229120142f224cc8

SHA1
68100a27459131204985d329c8a28b657a1afd48

SHA256
33257894648f882fd82740c1ccdb8bacaf13dbd9e08df70f30a11bae6ea241dc

SHA512
34fb76f66bf0b34a4b5ea1ffb23b5660f3135f57a505b2253bd7d654a518e7fee07bd47996a6cc1f5a04da836fef97627f687f63c7159affc5f232e455a54b6c

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
94KB

MD5
5760b1ca12f9f8706ae9a10524417e71

SHA1
4a00ebe8c3d1c046e0fb1bfdc4006cec306727c4

SHA256
e3914a1a79760919356cec788c1453ade7bb929bbe1959876a10f42fddaf8ea1

SHA512
f76140eb5a489d21c7b4f9eaa03ac9e6b9a40361184e9f2e881475569c42454a5febaf02536e2e5c9472af231b1d95216dadc38d1c84083d557a13472249320f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
73d076263128b1602fe145cd548942d0

SHA1
69fe6ab6529c2d81d21f8c664da47c16c2e663ae

SHA256
f2dd7199b48e34d54ee1a221f654ad9c04d8b606c02bdbe77b33b82fb2df6b29

SHA512
e371083407ee6a1e3436a3d1ea4e6a84f211c6ad7c501f7a09916a9ada5b50a39dcb9e8be7a4dee664ea88ec33be8c6197c2f0ac2eabe3c0691bc9d0ed4e415d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c42c987-356a-45ba-baf8-10b1637bffda.tmp

Filesize
12KB

MD5
d054e0b13ba4b49c8ff51ec6f683aaa9

SHA1
a02481c65c65828a9b8e54813cc5c9b085b4f200

SHA256
fac2b7deba4657220237ddfa3ff85905384d540e5c2c83b74662533485841a38

SHA512
0e322b321fd8e80655f46dade941e18547386acb9a005633f48b902a9498e2f9d48b93ee1e4664d3b1434b0351a6e10bf4c576645b8759194685975c75e6139b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\957fa013-e77e-4b76-afaf-58a607f9b747.tmp

Filesize
15KB

MD5
93cae2b20056c2b759e45cb6d29d0c72

SHA1
2613b9a6f4ec2c5a46e970083391631f6cfaf4a0

SHA256
3c40b2aa0f11c8910f54d0b0723b82a7a3c4b51d76368718087464224e589349

SHA512
7bcccc90d7f75e6b6cc0dd486001ed5aadab4a3d4f4c41d5ac7a48094578ef6f2cbd12c79388d1fa67ae2eb7159fa50875d66638378816ea8eff20f12536967c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
6af6cd6878bfab17d58d8dd1c5c8009a

SHA1
18aa463ee5d72f1740483b59a40c7a347929e5a3

SHA256
ab569938159af2444b7081910c4500d43763675f5eb68ad099c7b33ea1117c5a

SHA512
ef6c27af6c083343df20a5d1b9bf3808449c9d00924b64c76f0844e7dbfaca29f3ca495bffaf213982663bd71b803e40003663011f5cb80cfb40847d4de1ebc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
d0221ce76ac032991f7d78382ed80105

SHA1
fe9304246ea91a392ee0b5fc4a7978f5a0fe75a1

SHA256
3a9b7ae89b31738d0d298f1e0619cba608961ea9ddfbcce59c3d6a6640d48f12

SHA512
5952656d476632c6a18fe5dc19da334caf622c97a9ec735d952b4767f956e2f61ea52b787e71f86f6cf8568fe787195b7932817c39a44629d8314325eb3a8ea9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
6f373ec9108f2d0507823cdcd9530fc8

SHA1
72bc1c0dde6fae6edcf6fb052081db54b7bed474

SHA256
370f30db092e899cf81b29665ba39b243ac87e01c2b7072d16ca0f8f6b4c5952

SHA512
443544cb0606d467c4f7dc86f6ddcd96b7b9e4de5ff4a788276f701c7bd343ea2fea1704930c571a6943639c7dfe6af64bc6201a64777aba26401d3e3b55c492

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
9b879a7cab9e7019e4430feed8b1ea02

SHA1
ce5981fcafaa3b57e55ce1c068a5d076ea2f6f7e

SHA256
6daa46ccf1460e6dc42fc04326327e8aac7b126915ef2f320eca0da05fbbff05

SHA512
71665566b5ca23df826ce2f3505d78bf3d2761ecc19d0148c1283db805d35b3ebc97818b9187f393e94cc8e52fa928805157f8f9fd513d9d825fe12340484eff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037

Filesize
800KB

MD5
02c70d9d6696950c198db93b7f6a835e

SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2

SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039

Filesize
41KB

MD5
e319c7af7370ac080fbc66374603ed3a

SHA1
4f0cd3c48c2e82a167384d967c210bdacc6904f9

SHA256
5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

SHA512
4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055

Filesize
103KB

MD5
8dff9fa1c024d95a15d60ab639395548

SHA1
9a2eb2a8704f481004cfc0e16885a70036d846d0

SHA256
bf97efc6d7605f65d682f61770fbce0a8bd66b68dac2fb084ec5ce28907fbbdb

SHA512
23dd9110887b1a9bbdbcc3ae58a9fe0b97b899ad55d9f517ff2386ea7aac481a718be54e6350f8ba29b391cc7b69808c7a7f18931758acce9fbf13b59cee3811

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\05cf05598c8c9087_0

Filesize
280B

MD5
ef19c0177403e4aee5d5286bd830a873

SHA1
41ded6f779bfe56036719abc2409a72f035ef1be

SHA256
e08d85dc045a9f18a8410e3875683f89210abf12c71c8918f8ebf5a75cdb6c31

SHA512
0bdee083ef9a15ae4dbd336daf063c6efac144bc506340e99b1ae8b6408efbb61e38b0e293a9d9c8156e797c4bbd10ce6e4fff24a2da958e8461beaed461ff5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\23acf5c3970fde47_0

Filesize
19KB

MD5
12ad86c7fd180815bc89ce6bc05f6069

SHA1
cfb271c1c6592d3f1426e817f2fdd6e8a2e939dc

SHA256
79d756fdacc08aaec95b350082df8461a55d70a8832b635fbd6df7c50b9266ce

SHA512
549436d58a2ac8098d86f78304fa126697c361bd57b8bbb6fd8c7ce7565855de949e2822039c252d050afef4af90e488491ebd8f535f5d085d2a95afbbbdec57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
8e035d2ce898c7a53273a4588f29aa4a

SHA1
78a92ddcff73b7c648592e62cdb2351789741620

SHA256
d3d34510a29e32cbf217724e8cbeaaf01157e3f7d3ae8576863919832160b6e9

SHA512
56708e7100d85249b99b18587c6452cb8d8229546b0b7ea57b7135e38603611995134ce224d339141cd6feb46aa7234292c38573377098f93e30510d02cd0f26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
22236718f8054d49ffe0f9ddd7ae74b7

SHA1
d5a5260b1339df5965a0de6e9ee8bdb56adf1a0d

SHA256
38bebdb7b936c1d9f0f8e549b6f80333fe6419173d7e1249a4d8248dcef538bf

SHA512
c80b1412ad43d4cbdf966970bb52a81a120ff535e935089152cfcbe6b2a505b55c6ee87efd7712dad3ac9894fe3dd14719d2c04af2dd86f75dfd2a49264831ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bcae5fc54cf6b2e2456c3f256e94698d

SHA1
8aae91733a08d1544aa112277ccc10d3bac89a03

SHA256
d3b48142ffb2b9fa2f2001d7008b43f87efbdae0fb90e4ad46bcfc2d233823cf

SHA512
6d8823412d09939a32e4985818e2425d7a336fa54ff415cf8238fdc85c863d4ba1ad9747e8bea5b0f8bf5377238d6c95befd94e8b930af6a961f40075887d827

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
1231523751677b62207b885201c7b62e

SHA1
0edd8e26ce24cb63546d7c6bc6955056656f0962

SHA256
41a7d0f1d6b33fd99aaa05f6c95c3fb3e4b1366e28fb512ab0f2f91e4f2b9123

SHA512
f5da583e198464e108923b0b895654877043142d809fcb1ab45290cf1d50a3f58d48d51a15887d3a5e3ed083bfb054b8c9d6beb5eb239935ac4ea5b44a178848

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
68ff8436d9d0b6a33db5c141ffb4c20d

SHA1
50d39bba3af30fabe97e4603cd14c5dcad85895f

SHA256
f8acbe0b07463df433a78b6daeb1bb72883629b52988ea6be7b3da8632d712e8

SHA512
1cc98ff299343a853423b7c4bd4caa026498416d0e3f64bc3430f7023a47d584a91595dccbb5e156bd799a9d1da89c12e679a8f00b34a5fe5ec743344fa0df87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
775905cdc7ca1ea5039a58231712d3c2

SHA1
2bbd2bdb9b006ec070ba82ac03a8d9f5755bac5f

SHA256
c962b4b15fc7eb7c656b0a838b3779ced5fc8b0c4cc4db923a3a15e924b45281

SHA512
624f814d4f998374597576f8cf49d8766a2adfb2e893ae11c89d14c31d3657163111d34ecac994099f3249383cbc2c89d2d6cdc2e8a5977d5388a4542c24568a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

Filesize
44KB

MD5
35638c35513548091e9a71c320185297

SHA1
130e52afe43d8f7849aed18cdffa5bfe8cc0b426

SHA256
1c706752603ad61fdee7d813ba1cb032ec8b4dd4cb6fa574cd854d5c84b3bbb3

SHA512
44b5456aff048ccd676073bfe7b8f7f4780fabf175174bd4f4f4e55b70e76f3f1d48453d0e766dff33d0833e32ad6986e13bcb76e2431da31b071d4a7ae37ac1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
6a44a2ee9f2e6f072abfbf59ba82f9ef

SHA1
33a2b8450baab295b09fe54ac1289c337613814b

SHA256
93c251bf8d605867f4b7877c6d67858a8f2cdd3f3a58ca5fee59f050db87abd5

SHA512
49a3ac274fa5393ec08f2ea3879c0005bad1117eb4a8071333dbbb0e364dc9a4d51ea5e11daeada832983d3f54fed2ba89dea5510d8f9e25ea2b78edaef3d751

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb

Filesize
1KB

MD5
b3ec210b162a2e12643d5c4fd1ce5913

SHA1
06de7d9e24a154f83518db1859dbf4f0106697af

SHA256
a602cd70b283f8d578b176622e250488c5087b53266b6104f34ba1851c63d10d

SHA512
a3aae09a77aae3d89758db11edd14b130759c01a77f6ad5c734f55311a44ac90cd4bc13156fc081b3762249022f9f14e26ed1d56a125f78149bfda04120c577b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
93dc310b7ac88ffb5219c56a3b11a17f

SHA1
6e33d983bf6ccf45c9b3501159058f50c000b3aa

SHA256
d977d91c166978b344f222a8fd5de2b8b73a6ca95fda127cab07e200d4b2f5ae

SHA512
7a220b54939a4c8264a25dec3f39a9dc512d2ac7fd3a193d784cfd04c94b1ab956a63c1b4aee4e74ee57f8aaece81d5a2207f04c27ebd69848b12de1160f8912

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
b2f5093e43eede454a37a1cfdd0efa7b

SHA1
4b9b8e9410d0424b30c0e0278c4e1d2f59263a8d

SHA256
842cc05568b5413f3696acd23261fad40eae499bc0d755cf9881dff866dcf8c7

SHA512
9da29ab2d40ac50f432f085887a8892c8b20262462dd72f5ccfdbce35075bb7839218e3d608cc232988e1d1b2b7ef296011c83821be3f18577ae80cf4c024f84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
ea17fba650e6f2492541457251df5a0b

SHA1
9d27c0ceef12daedaeedd81f86bf7f34f5a688c2

SHA256
5a33f56eea9c209325022a9132e8b524654eabc1a6ea16f84a706540766b5f10

SHA512
cc608c0f7f31a4a20e51cd8a8c236cd3b9a7b585e61e44957b9bea739075860d963a95797a2f8e36b11f56951a32451b45c5535f13bb735cf099d6891c79b191

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
db5ef59ee051c07dbf7044df813787c7

SHA1
7c197d5c7bc26cc55841354b2bd7cd4ecee6cae6

SHA256
9d82c8211a8d3ed7212f18b42b99c5b4ca27f669633926e7e13f48bd878fcf9e

SHA512
c1ab66014d6bda8b1154c63fee5299579b907f301afc4603e5556ba11edc91e95176f4203a8090e433c3444bf50492c3e0c3ab02967f4f23feb3bfe4953c22b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5cc6c2.TMP

Filesize
669B

MD5
ad7a960305e85cfd378c31b634b557bf

SHA1
0f6f44453ef48b82f352591408a742a3beb0e20e

SHA256
d2ea67431f5578b7d3f72cc3e146e1c9093a2270c9d7f442ae7d75fbfc983875

SHA512
9ed2676f9935874a2ad510bdacaa3bd0e0bfa3724fe04a9cba63aa7f60676c8a7c61e605708a49c0e961fd6d64438dbda303132ff9d0de078bb62baa4611d892

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
0625c2f22ce741d7e385b6667f527a9d

SHA1
b696ac8f6b97526e9117f10e2dd78db641120ca4

SHA256
ad01ec43332e541ccfffe367bbec6581d529faa9b160698ad417771279a07c0d

SHA512
2c3da846ac2e7314b769092ddce218d2c2e01dd28166c763acc65927bb2c052d5ca9ea72b5401f245eaab669d560b2c43e6c54271a789fd12dbce12e7f08dc93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
3a7850b11254b0d659efc6430596d432

SHA1
e4b4a43cc48a0a0dcf1ea39bc4122fc323728f76

SHA256
b008724b68b61cc1a3029180ab127ce957c08a2cf50e59cb3f5f48eda667d652

SHA512
ce1eaaf5cc3576d72408699bb2bc663987fddae555e3c02780c11d93b0e026ddb6894bc4e3066c0c4b0465f730a1628a31174f89fa238ffea66d82a62e4522b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\61a653e1-62d8-463e-90f4-88e7fff9e1f4.tmp

Filesize
1KB

MD5
12b1a78d41c31cf345c90a16c23cecd5

SHA1
113647f27e15e35719a771ef4d9e77d267d0ed52

SHA256
3c309d19936a5e096712ce27959682bf21d6969d85a01aa8aa85996a6c9ed740

SHA512
56e1f531540f7660cd8f3b2f4ff1d60d275ee11877fdcdce1620fa425bfffcc558f77f3b73d3fc3fcd12ffc7a7b2c1057eeec657437060f3487a5652e51a40d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
c0f1319f568ca4d9b12f103b8bf891d9

SHA1
6672d2e650a2704f89dfb3cae9fa9b4311d679b4

SHA256
15e5f3825f33f048c43f3ec148a137cf613c9d43f84733962ffd24533f48d17b

SHA512
c8ff72fec0486cc3fa8c6f5cd00187f8c8226a78df81d890f6331decf4c9a15d74821a2e243d60e10e87f8de7d4aa74caee47265b159a17c4192c2357892e90c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
6189c7659462743eaf954942c482ad67

SHA1
73816a66d329d4d130e8b2bd08195a52ccf2119c

SHA256
2519ff3d795be45d4a83eaad9d9c39cbfccbf67b3623e54aa784ec83620943fa

SHA512
bd3cb38087d894c536c1600ae9436405e6be27129d61dcd20b727f908e7310fa27270de8ffc90eca5043ece88c1150009d97fecec696191541b857f568b940fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
1032798883e38ee8c39ba66cd5003c8d

SHA1
e7dec211466df041254c52a1c2484d9b128fe3ab

SHA256
3e709d0b6cb420e447ecea69926a50362c42c09ab4ff964de1624e455c77418e

SHA512
368416f73dac205f0c7f2d287632e037a42b7e89fecb2b5e1b6beeebb543962a714cf8ebf41df31a795f8e8d8f533bbe3ecdfb285a8ba92c1c48dcd9ede530bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
19KB

MD5
502875b629420515ecd13d73131644cd

SHA1
dd58372edfa50e8cfc360f973168131e83ab2c2a

SHA256
a6d79319ed8341a38351e8edb48a023ded1854a97cb9becc64dcab30e5277dd9

SHA512
747660277280aed80b64fed1529c58f7ccb086cf5a532fad629565877cb25a9b95a17661023586271b93f2a60270650a47dbfd1fdb315d1d35747fbd1d8cced7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
dff5be72dd19dd44d1978b19de32f1dc

SHA1
fe4f1cd92d12be5fcf943c5867217cda4baf0652

SHA256
c0a11a8b9f116e565dc5703d419f6ee4edb6441390c3085970369073f2515950

SHA512
63488d8781df7d7e88b0c57f0d5c3ca534ff5dad051cb43022ce62eaa4e1cc482f5edc5168d3e591ee45449085b595c3127a9e49c11269d337db084e2449f3cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
c10a80def1c87fa6ec64981ecfc5df6e

SHA1
d4aa51e406940aacb0ce2c719e7ea13b69da9e78

SHA256
070367be9a88a79d7cadf5b47f24f0dee4a8974ace443b9091ceb3cc139108ab

SHA512
c43777eb56da03501463a1e2e1a19a6eee4becf4c51582f4f9aa90c20be42b38132889aba584ea59a126edfe53e4e8d285d402ae6bea5bc19817ccd818737a60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
736a135838ea6edf2cd4824abbee6c20

SHA1
39cab73ecf10a8a50718357d0ec3589a7b985c8b

SHA256
14ee40d8f739dd5882b9a0a5897c42b6179a69772dff021803c1553d61d0352a

SHA512
fa82e5b8e84b8b4013161d3d2def762e8899d55ac2c9184fab14849b767863379f2552e5a99b4895814bf9b83417013ea427460bb3dd938e3533dd4c1cc34f11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
e0c46104bdaf4fd8eae962bb4ba7c1d5

SHA1
06bb9782b9fb84d4e0adbea6bc1c5a9765d23fc7

SHA256
b33291c5af76afee1d5fe98a1c8a2f31df2f06d53c997e35eecaf243863a0691

SHA512
33d2df532dd40d1813c19360f12a9a077f532fc1b669b6394e96367706260d7c23e8b5cb5ac170ef1c602bd0b9b681018cc55b2682622813408cb554f336185a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f802ad370759ca60b513917a9a59d179

SHA1
53eeb77d8083a8b162756ed1420b79d5e381bb80

SHA256
221e946b9614d50f1d424635a0c9a496503f272ab573a50302ef6f5041022220

SHA512
e2f36e4a638c07163fc64e14a442d26c6458541def1a23bea6cae0e096081e9040d7780e3351743e02f2f25f341fd3320d17c2af13dbb9777d926264ebbea79b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
4aa1392b3818db9c4d2f21b470ffdb99

SHA1
e676cecc94168646e8279ebae47d010d6e11bd9c

SHA256
c133d4c2841b548a0f06efe2f4a09d88181591b368baf69182dc3db5c833b1d8

SHA512
17a87538646e95d11c48955403934468af7835bdaa8778e5c5180ce316dd89286d80bd28e6f4c6d3cee6796102b2b90c4f06a91426e21ef3add1f039d168243a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
23fed7c58a020a89ddd390d4f2146139

SHA1
9556d1936d64086f5038b042f2e61aafeabbe188

SHA256
30661850536212ca4e478ab22cb0428e0027b96b683c49be54514b399b73367c

SHA512
864c4ad7008b313916df6532d2f08ca0086507b5bb506ff3b1d960eda8173ae292c000cda36d4d6ab0abc72fecb765cdb65a91d6f40852dc4da1ffb233e386ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
24a53fd99bfebb2460ffa149bcc20f73

SHA1
335fc5b5deb1ee76a7e88b76d2464576cc8e6438

SHA256
e2af056920b5a7c6631e766f52db84d2d8e450883cd099c72e3c97a8c6de2288

SHA512
2d6f72318c4045be99cf1801b5d9eced45a3ca4b52f6d5b020bcde8f3377ea646bf7356dc5a8366a22fd3915871fa9117eb2fa4be160425e565b4c66650467c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
1300bb17d0610a994d0fcc8a11bd858a

SHA1
a91c3bf69ef0e3499f61e012eba7a4aa9bef4235

SHA256
943d854a945b6e45c8a5c13463c55a2288e45152b12b7efa3eb120a246d403dc

SHA512
a719cb79692fbda08278dadf365379af6e3a1d5ab5d9a42191ce6fbbcb60ed7ee5ae1ca88f9e283ba82af2de365e72505d354dcbab8bcf7852459aaed5625d72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
e344bb0b98bce1e3b6306ce75bc8da91

SHA1
a1a40b1e88bacc1a6c2618e4cbb84cc53dc72b1e

SHA256
538e8d5308d6a3f4888510182362cf5d52592a5d3f8fdea8d5a1d5070ac2ab0a

SHA512
3656f6554415c154b0fd8609919df9aaedac086e764a0c65e3d450dcf4a1f4ffafcf28eb139948958fb350c4c24f83ecad96f63a8ef6489d48df39e3485880b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
ae5fb7234c73c380f18729daf185f7ea

SHA1
14b16cdf4da8a0e51e293cef05a619e0bfa82b7f

SHA256
2ae913e154c35e528dee27e514651507fb308b93e744e96315691bc343e6c147

SHA512
191834524997a2f435bb0229a2416acaa4297290c4eaccc7458778560733a916821385f81875b0c25c6972eaf6f4e973913c31c034dc485f713223aa662fdab1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9c627c79da49f044529742b41e41e10b

SHA1
4f2255993c612a6a9faeb231180c7a520e9ee6f1

SHA256
80fd079a38b56e3d2bc1a1ea61f23334438493f914ead0ed1d7bf095f1f991d4

SHA512
cfb426b83ec22812d04100e15184719c722ee6c7b9019cc61b80a98eee57a8cf9daa1dd85f921c846c21e1990afe1ae61a5b084009e6a54ef96d19e894866ccb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
756eb804219daf569d9f4f66d3429325

SHA1
22d7d524713e09b581343f331f3d42eca88ad9d7

SHA256
b9b263495c6f7a069e80ef59b56c8d283d3294f2175c4f141c0f61298c869162

SHA512
d1a5ebd2e049c40f39fb2c30b85f9bbaa2fb4539fdb75ebf180d5adb03899307b5ce082351f03cfc2ef07fcc21c65325231d2c4a79cb94e6dd16de6d91a0ae0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
95cbcaa321d1c17334f9a8603ed143f2

SHA1
e7ada7c92bb1a198903283c18a4c74b0b8f972f1

SHA256
999dfcce2108769e2636bb64be5376a7c230356195055441ac8cecad6f3a4bdc

SHA512
0af5e7a111fd6cc1707861b05ba6b2f59c33f82bb32b15426e961bee5f05d3305418f87d919f51a8131012e3fd32e01b64d544fb8fbb13767ff34e4ca9ac52c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
13f1898c18c49bde4dfa8575bca81433

SHA1
940d0bbc494a4747c36a9b4ecc56db1fa4d93377

SHA256
12340d1fca0eb3e5a1dcd3f1a18d4ece33652cf02af3e1f93391363088f08147

SHA512
08ea6810f712d3ebd138dc455b6d91fb08994b2dadd361004c60cdf611bbbedd81d6cf7ca2a6d5714e7bd9839e1e13d0ac0c8e21fb44bb0431e4a9726c3abaae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
bdf94dac9bbc712d56561586db61b6dc

SHA1
185d6e9c0213b8919bff9a4e690f038673fa815d

SHA256
768848e7440a2effddd0e63c3993ecb5eee7fb639df7d1949cb97a3372c98c9b

SHA512
8aa194b5daaffa5407e9fb389bc060cbc23a72b927b7be902a83fcf93f740335a841ac49f22659478352ece770f7f1bf680821a2a31168ee81f375c152ac1f4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
70b8be080c3bda97e91b185a339bdf0e

SHA1
610c8962e4c1212d54f597966a773b295014be16

SHA256
1c683119b013b8ce85e8ff833d529cee00684bf0d930b7ee52021025a0af0518

SHA512
296992785262b0f4e025b63e19dd76c8fb604d112a3aa920762466054feaa8f1bf28277ac59cb1404dee62180646b6aa3155533b8e8193dee980a67e8d150558

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
20892d6b9b5161a4dee864c4d9d47af0

SHA1
2636169e03d342da043ef98365455e7ac04c0b44

SHA256
3553e4591184ac4967bea0880d1cc98f0b2c5da0310b821893d1936f9002554a

SHA512
415b83641b0eccd5d9017ee7a4fab5e4583f330ed0774ba9f63cd97488b84d7b29b20c704e533a179549eb80c282448ed3ffdeb158568e61d12eba8f36b76b5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
a130e1d1daa84d00034685c17edf736b

SHA1
86ecdf853684d15e54793fb52ff7027677067e36

SHA256
8f23c9e27aff2849a363f2858aa5b405c3a63614c051ca39bdf1db6692cc1e35

SHA512
b1a44c043c509b9db2c888f2a64493cfaf2baf6e903e8751b16d301062adc702de4dabfefeb329977eb0c6a62af2b764460d2c005726fbb80bb2ba78e3fcae69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
0ccce43b9cf4828647fb1c738c1265f8

SHA1
ded7db0ca0d6e68c09c6740cb59deef08e4455cd

SHA256
128383abc23f0191134f69444742822b679f6259f0ccd752da9587af245743e7

SHA512
a90499349570feca01aad844692b14f0224c827b0f9f84d45b13a19af3cf70fe5b119f80a2995553fc23278a9682201f6fd63208c0c0a04380f016ea7a3519f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
6a10c5bf161233d6a2a6e172f29fbbba

SHA1
6fd5b99d4c511787272c178cafa0daa5342d12ba

SHA256
59402bc125e264e9958994a414bf30157549e8aa42d2d0ac30375948876537fd

SHA512
f783382646fbebcc43e7997e0efbed4f11418881be6d350db08a7f21b842a181494402d53fa5b8eade68a7cc6cbaaa0c4c74d869c79b1e526194c25a1e8a0b47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
68c94e417b43eccc2a073caa2f256f64

SHA1
73174600be7e53a2ce6610ec3b0a708a624ad304

SHA256
66a349a48a9e6078fffcc1c2100f9b5aa388b50d6eed43a2dbb4841c63f8c14c

SHA512
5a47636e3c2f88b67347fa2aa5d23fd4346c87980d523041ce3e9a56bed73fc9a2df85cac55dd5be15040ebf5f3f69ed702821129ec46a86da663de3404ffae5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
3bddddd9871372e96896dcb76f6b32c0

SHA1
d965dec1040caf051a1ac9ced3c02e645b524341

SHA256
06abe278e4f3c90aec36b1f5e769d7e168493cd6057b35a011b82c1e51241743

SHA512
b6dd6737e766e4a8c264b892fcd26687fd1ec9c2a0b53e1eda6d63fdb7eb8543f2ca4f2e97ce583b8efedc67c652bdcceb944771867ac92e7484fe49c10082b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
b31c1212759f453741f38d1cbe71a07c

SHA1
8ea77961eed812a9d19603633d44f02dde2e2cc6

SHA256
1c6ae8b6fa677a9486741841685e16ccc86ef40e00da9d12cb0782617c04487b

SHA512
2107a8e2f4778927dc80579e0c097b3bb4a30b2ec018a3a51727e07b3dbffd684f76dd57fb7646513df4c67248ac971960daad17703482cef86bc1664b59c670

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
c950d8f6dfbdc8716eea2fbcee3329bd

SHA1
1b9ac8d3fbcf7d7d2e4a0318e3319b3d8456959e

SHA256
f551957d35c759c2f864b2e4dc1c96412505029c36367f218309bf70a6ce840d

SHA512
f2ac92e49661a87975fde9c510cd9ede254062c4fd041b2f5daeb22e9729d0ad7496c183094cd7796705b86f749d9164cb63488f57ec68cb031a825ad041093d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
e8653f52e175b0330ceb9c2bdf439fe5

SHA1
b23f6a1ae803b1a2c1ed0fc82ba70b6dfda6030b

SHA256
57e26aca8bc5f08af019f168a8de0bdcb226d78798686c93e8be4ba0803a9b61

SHA512
3b94ba0113fc8113a04bd1cb5809a4f4119f55dd3fc943309ab617b077cdf7b80d1e2e85a74af9409f84018fc98671f36885d445d74321504c9225b19ecab116

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
1f0681814cd61583d24826332940595e

SHA1
c68f921c0725d6651c7e7d942a6dca660c2a03c6

SHA256
8d4f26d2cbe4107c1691d061db360fc2613066ebf38e33f758d4de55eacf675a

SHA512
154016e817b50f23a9ebb454b247e03fecc31e5a61724ad5555de60c97cbf4626cad136945239f7f41a71da4134f6c75647b11029b9a962cee0cc35eb5574a82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a2c8ed5783248f60bae394c6bfc9de7f

SHA1
41abf9b475ed762f901cdbc789abb769740582ba

SHA256
bd361b7b451f77f86350085ea3f91166f12f847d35b667bf5017e815be533f92

SHA512
a61c1affdd6644059ab8f0c262a41d84005975f48cc99c3f41194ccc11cf468b6300351be9764822800ef9349179872d86cb4248f113d9980edff4cdda62a311

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fa36af24eabb8725db4dcaa796120d27

SHA1
19dbee632e6099c5288d029d6ba7706b8b4bbbc1

SHA256
37a96a6ef3c239e6bf544f956a9f3a23aad837dfc2358c5843de03de1c38cddc

SHA512
501e60eea33ea72eb6c6ffbdbf62d119a3e82d61438e8f3da54917f8b86a45433805c604c9549add68374de7a00c1e802be6fe86fae9a5a4fa38b36e95669a70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
de634bd4935942a4d5dd977a2d56c5e7

SHA1
ce5b64a52becf5777f242e58bd045f47d220511c

SHA256
96087348d50bdbbdaa093066212193d524f861f6380460fcf5e51946b45a61d2

SHA512
6b3725e77ce1982f4e0d61ce065bff2b518fabf03476dbda5957920586b766003df70a118c3579b9faffcc255430ee03f93b4bea6a51a8594b269f2be63ea622

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4636d5855edb7dc5eb6e796a5f8cdb00

SHA1
22a0e00201a32c6f2037dfd7f4d39af0c158fd68

SHA256
84c15dc94dc35c0176d1cd6bc96db98b08f974fef48171bce467dbdd356fa003

SHA512
553863473e70b7888cc53e92163f4a3dc3acebcfe07ac1f792756f73aa47c7608d4728c684084f0cfe423be02893f83ea25b2b9b5def2c008464b8a56bb12c04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
debcd93980220d4e97aa4fb7417af48c

SHA1
c888604b5b6412a5c8b6abb24320ed861afd8b0c

SHA256
f283abe3bdbb92cc231488452233f39ff1132bb7c1b92d774301ded1476232b1

SHA512
199318ad40c9a9985882b6f027c35a608b21017afce72e715db542d0fd3581d558db433a935d4014ca113939e2cbf837926fda50a62524afe4f6ef3176c52960

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
2c894a980866e9d0413775d72d9c0770

SHA1
528dc6a3ca6faa776c53a9ad9f95dfcc98defda8

SHA256
1da42035db232d3a311bb2c37d26125e50d3e5c563a86d8eb80e9d0a1ec625af

SHA512
89d237c5e9ebd40d9b591ef874b5e4c2f2fbe7c8d87f6a4600fc1b928272c78734ab39cf5f9902a43f30c5d509338afcea6feff99de78e0d359eea3f851ef762

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
819a2afe8073988d06c22ec5bd58312a

SHA1
946fd562faf8be3c004b65a96bf1f1d71c8134f1

SHA256
50448cca3c067e93dce0b0e36c5e8a1318ea7927fd871644963d9c24f05939c4

SHA512
ff58f54215f75f446c1b6b6ff705d62f3359a8b405fd7168efe41c194c6b6dab57a96cf75cb1d3e968821f35487fbc5f4db2ad3eda5bdccd9544b66e795c087f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9a82e722e66bb4d4980441e68492de57

SHA1
38c3a832865c99b3d1a94880326ad584cb46874e

SHA256
b310bbd14326c48fcd7e4432d1cbf2fc8c20c86db7574ef073602527bb791b59

SHA512
29c46d13bdb1e2d8726c167860b7760513793b46d45ce097756f3133de22f00c2044eac3e17c82534fbfb2d537a59d61b67b7a8b40626875a96bebacd2d90c4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d76fa9a09caddbad455ed78b5ee77977

SHA1
1431883b9828a994b99dc9d8dda8917323f6d2f3

SHA256
05d1942fb6d9ee4e3d7d1f560cccbe215d72cec7e912f5ba7704ad7cff10eda6

SHA512
a4c21c1a5df852fc5012d386558390e4901a05d3921b24d27efefeb30c71a1fbd6d2240ec81352b46d909bc1838debc8fb3ac29dea87fac6949618c81517ac16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
2f5fb07b821866fe9aa3547fee829789

SHA1
a67d36258ca8c0d75f9c6ee339d56a09ec2c5374

SHA256
43f87cdd00c426331a1c30c0fcc836424b7b4d6352674ba03e40b199ee002624

SHA512
dea9379fdf7193d2e80ec6e42a63b590495bc0008ebd8a9fce792e72c8c190ab32ef5f9b14b2fd1b2f55d0e5eb34df115eefe8c90baf708dc925819fec6a9540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b3f7ff0fd7706b1a105911366ac64c29

SHA1
455c6c63672ce58956f0c41194562fd03fbba839

SHA256
b542f86c1a1567bf44e34a2b8ccc3b0aba07299744a8389ba5fcd038378e3f13

SHA512
2be17c9ecf74382360e5288c981f87884a24744ee78b22e625718362c4a8328090226fa68ff78c5fcc003e7501168ef8fac10c9da4bfb878ac7ebd1238aca089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b01e5f6403d67850d57bba6145c41667

SHA1
98f700aff0bcc7a01df5a0198b534e14f8355525

SHA256
1cca01c84dce8608a115220c2de59afa6bbb857ee46cafc6f01e20106a74094c

SHA512
fce6fbe2caf3f58ad64bc3f5a57445463a7f6c148e307f0f4ca54fb625534e481127f960b06abca61c21089451464f28804a9428b58e3c8693c1e4eb1d58bd83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
f5b6343e7ec93d7d46c50c7262a83472

SHA1
d8c9d0f482a90fc5c195fa1cea4cede73ab64950

SHA256
b33bf83708030f2f5c4521a9ebc6bf950cb7267cd4a7c838061502ed63e6ae5a

SHA512
77e27de29dd7dcdde3f2aeca606c926fe407bdd1fad043ad46abf54c8832e733f0b2dbabd54d0d9ce45386b312dbbe825ff3dd75217a78067907952d72b7c8a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
51c91e09cfef777e50d89f5ab0d3cfe6

SHA1
d2d6d5d9f59025a711e4283497d6a886bd9624d5

SHA256
748efcf649fb5d31da53ba9532a4236e5a55b04cfb50c366b5707efd66d18253

SHA512
1eedde315628d89e0377134c8222640fef04b374919ef1cb6f774234ef73697d5526829b9e995d54d5be9a7aa6b2e520e00c70b51370f45e42fd5e55eb2337ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
a834513b2de8e7c14d8b19d3035adf81

SHA1
cacb9cc2f6e509c81d5e4c0e1bbf918ce95628ef

SHA256
10db19c7eaf5c4cab121188625fb7001d3cf9affd43a09e0201888df1f721d09

SHA512
17ae675d45473428bda89bf81f9be8dbd3bf8c9ae04c634cc9faa207805c201dff10a29aaf785dea7acebaa591b8e1ffe7f470e8a3f2cfbb4f61fd145cd913ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
abf75fddd05bb22b971009ed35c3c53c

SHA1
3b22862027817c23daec615dd716047f34dfe81c

SHA256
aaca501d807259e435e6f8e1d404ec66e47bf9af5ea8e93da872557e9304fba5

SHA512
39a0938d019e719cdb91b4e9ace732cfa58d620c71f40f3db0ec4518c65fbc01a9c390d3c031610d7a4b215e167985bd65e5be2ed0119ef7b9f1553dac9dd2bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
7278a75b90594d32405f64193149dcf9

SHA1
f088bb2efde26625267a6cba7a77e790640bc4da

SHA256
6a909a26e6dcfb9a777ae3524ee0fd75fe30e2b4138ce5ff9824b1f5057e9b81

SHA512
0124c34a1dfc3408452f8f3368a7de79d0822c8a21b4b5eae9d1fd3f6a434019d7eb86c66b0b7698f3732690d6ed7e2ac5b5b00bde88d47ac9e3c33addfc9af3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
d8ec327ffbbeeea57f606b3eaf4cb792

SHA1
ebb06a571be673e53e4e1ab14fcf540670406a67

SHA256
5af6fdd74a6bae1c090e8cddc9a61bf2a03186f588c42078e86018da38f82255

SHA512
9e742dd08f3fc76e312f397451ec9e08b31907c991c98023f6c1e36b55841cc006cfbfdd57ff854dc3bba85026ce3fbc3a0e8784d006a366e2611ceb323f1d5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
872df68bf32fec413fa9319fabc206af

SHA1
6d1bd7b8a00cac96bed48da4428f3107f15d18bb

SHA256
3a582e73dbc020cb876985224bff25e708a60e249f9c980551c10de0a846e756

SHA512
b216b1f78df347245f545125653dc2ee6658a87f4ea077e526d0de3efe1e0456d0d062d2dcb124a4908471d757c6f1c3c710bd2959f312bd4de1a32b4696a185

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ef42cc9b8232cced1ffc0568f3019142

SHA1
c4df077cc827559518467597d4e61b8d0d663f7f

SHA256
56c336e1c5e3a6eead8a0280d783fabd7ee4e3a79c854b30afabf458a92e0a1c

SHA512
ee8a72adce480b73f214f2e0abd86cfd6e759505f73ab4ba52ee3e9764467cab507089bae439f4c54999c7a455789bab617716c70f1484825446047baa5b3e7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4c5deccfc976c53e0917582291782939

SHA1
7fe1eb4f7c85bf567ebc96e3455418c7a0c979ac

SHA256
3390a7faabf72a72076cbf316cb168905afb8711316460cacb8de53ad3db25f9

SHA512
0afc702bb02a7fc056076b37bef32d90fe26598ae5b711fd19fe890b805e0c0e5b3f0f1fd5185701f6c8baa34e9ad69917cae9b5de8d51c0a6c6995cc3af0bca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
c7f3726d4b3b84b4264d3dab3dfcdc5a

SHA1
0aa41e8f9201afea24ecf7764c4bea714374e258

SHA256
6bdd8b1382c2eb2bef414811c8921cd1d08082ddb0741e82dc7f369d7a6c5566

SHA512
0f172fe46ba341be58dc8d23a2fbbf5226481de39370839f2fba1722ea2aca6ae2cf29417bd832bf0e17d91a0b75030951000969e7a6c56a7a493dd6439b530a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
07063a393a2cf006b4fdcfcb0635a081

SHA1
fbee19faef37e29e9753eff0fc842d02b1630ff8

SHA256
df4939e11690741e8553e79d50794187a814c8da9fd1f3d3c3e5d0796d3965e6

SHA512
3fbf8a46fbbf7676f10f92858e011c78b696a2f0f525a180a884642a04812d8a6d87d6be88591214a8f74e40de4f1e5e6a7702a676f0ea6bca32e834db2219b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
6b6814841361225fa5dbd334235f3272

SHA1
7253849dd994db9649bbe8f327a1718f9eba370c

SHA256
7c0ce03272876af24265d413e83d5e877caf937409a672a6ca79436f4c41d2e8

SHA512
28bb819c9b68047799ee2a4a14ed726706d20cfcc87b0c3fea1b30da2a8ac904e983d75f5fcd3dec44b219f5c464d688740ba3e3835e325ccd8590126a8ae571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
81937b7d7d89fd038d6c6e91273a972b

SHA1
ad853cfd758d3e44f0f91417673bf80d06230446

SHA256
54f54a894761611a54f080aa001fac429d8a49b65ae63ab74c495dbbe2eefc95

SHA512
1bd28b25e1744d3d4e71e109ef10ae37626d2d25fe7f2462cbe72dec5aa056d99b453ad62256d83387e9c8c9fa6e2c225e7ab3cb54428bb2fb1bbb6938008390

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
165cb0c44d1832b735ddcac600b3b268

SHA1
c751f48a01534713311359db9ea869f92cdb03bc

SHA256
d64eda1dc2b63b4cc54ad7093fc1e0716cff2cd39ecce8fdde2dc25c445958f9

SHA512
f610fdec6bc0f9fa760a9df9bbe2a29e39b418d91e10ea8fe6d47c3fa673317ef11dfdedd04b3ba93d42bf0688a50b739443d28b34f24d45d13252156a18cf1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
5975df9ca4a4595944630b9ca533faa0

SHA1
dd5d743f30dcd9bf220433534f22b2e2d34d6537

SHA256
3d283dddbbe28832e78b935f0c990cd5d91c39101a3eca28693e6e6f959c4f45

SHA512
85abbeadd41febc9b33a16155a286f933077e41db4b9c7863a9d6a5c749aa3b765e668c6269d065e25387b1712f0a8c6f604eee505bc8eedb1cc1403e58628fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
c2b30395bc76e5452af1524b48717a8f

SHA1
d055dbca347f31a56dec1e081d854cb27fd20659

SHA256
fd68997e87c55e5d3aa70f00343c6e9e863526ddbb09dd3395f41ff0a33b5992

SHA512
b3d6f904c236211fde6672d2508f1976b3601d19691013ec554b938d19d89be46f6dbfce3c98b9f2e2260997065afdbe0264fb50c2ab13d3af33f2e62ed4c290

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
53506af2f01f55c638b083a3009c3cc0

SHA1
18efc1f6fdacca5a3cfd7cd0b0f436c55bceb25b

SHA256
810f12b997f287034f5f4937cd4cc62cc5cfa6e959cbefd6447b06f41f3b4776

SHA512
60bcf411a0f361e0d6a38f3c3322102b9f3f0ada7a381b6815c837eb4f9ee4a2e6c15f40d741512c52af20d9b70053577676cd2798a23caa72eeadb5cd5843e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
1e23150538a0a4e10db0857025498b14

SHA1
286910e1434f56bd21523fb1695707cc579c56d5

SHA256
70c0003cfc7bfaa994fe8fa0200e61edcda89c25dbe205428bfdac3302d2157b

SHA512
95af9c2543018a69778f572d80a9ce7bc71c03eb39d5b53db2073c14e6d637cd160e310d4eeeca2f78366457a71eb2357489121e1de6e2a6958ceae7428091a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
0328a34776d74ebf7261a8dcc4e293fc

SHA1
ec38bb892edfcde7a17099881b6b10cf144b7208

SHA256
ebf9daed1f2ca0781f288646e962a388831019e77b2b4eec84d0f8ed74105d03

SHA512
8d7f77f4d488050fc5692dd29642d858e94a9864a81b778ff5d2e6a4afcd1ec650f1c5f2c08ca986c1ac7347c3cea403cac7aaffcaa2204b0b57b73530cbbfa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
e7db1b5c9223b8859effc341f75dae01

SHA1
48432965a5fc3c34792dac4e7607c2b4db53d5be

SHA256
3df6aa16250ee0dc7dfde808b19a96717bdef7515ba535b33f137abf5d087333

SHA512
a721c7d28db97ea487c4d20aae740178ec3f4d18a768814722cb12bc1b9df1f843fdbf4a629c7f2e671e7101cfd5c16f04af3cacfe44b10ea39a7ff29c7d8fca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
44250a6bf3742bd96fb79b3b98e1f028

SHA1
9be34959ecb7bfa6b52e63ff7dbc915a5e9e1772

SHA256
964d600810904693a0e2c68cdd8c259fe9a2b11316e80ef607179b2e146b0c92

SHA512
ea133d32b580fae9808a1022044ad8479e9f7e6907e6fe2a9f0449cd1f69bd8839492ed22294d3bd842408c58695277bba9c1b99585efdcbd2d5913e3f849b99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
519516d3a6d046268bf7056f8a75d747

SHA1
e945290d2de8052fc8cb987e7a59d31d4c4c2c3c

SHA256
655c712c1a4869c7948a7ec42ac1ba022c7a2b6439ca8e87b89ea544a20d6d66

SHA512
dd68677ec5e49f80d616629857bbf431f5afc3b9950d4dc0f5f3c878fa6b07a4b67cc77a00f823221b370c15157155673292c42c1d14a1c96d9c8c3132f1036d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
336B

MD5
de78db3c9f9adc7d4f74de173866faac

SHA1
e0f24092de487bbf0885eca4422680832bf50c8b

SHA256
1fadcb689cb3c218430b980de24bf1ba03f71e51b6a98258ade5b6b7b5f4076f

SHA512
4a1c581710733a841ecb345e8d19c96981b9a60d75da9023bb0d23b54a1926d065581209b2628a1fedd0e240996375484765d995ba250055ea21d6827be8c7f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
348B

MD5
1b9a61bdbb220464fcd974ec932779fd

SHA1
3b37f20870a95393358bb666ffe3924511363ce3

SHA256
030d163ae70e2f198614f1b31d2158a70507ba39f59b67c1231dfe9cce4696b2

SHA512
3446f8f27f114ee302c05510bc27ccf6627287ac674a4b01d7edb169ed7aff4b5de7228ed3d87496dba4bddc4f9d7498a2ccf794aaf7f832fa9695159516850f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
324B

MD5
e137e140411129dcf591436e1a85efd2

SHA1
1087db17e9d6c9f611e3eae3b0a2fa4892425b03

SHA256
b866e806c2f04350beb5e754dc0c203a4f1e4984d457865aa95fbebd3ecb3bd0

SHA512
7517898de670a08f8f52216e4676aa1549563302efcf1f916325f2da595518eb2ed1585a544f6f94a3510a1aebcd45909c2e2efce16819714e0f9258f10b52cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt

Filesize
94B

MD5
cc5215204b9000a990b4ca6a06fa3513

SHA1
4736218add7a44f165e576faa4cf705c56ac5d37

SHA256
e978c11ee9cc041b0d4b3325066d6cd6a7ae12cb553c454f96ba10e0209561d2

SHA512
530436a5e8817c17265c6fde68ff8b773a3b008bb60887f600f47ade48365da197e27697c11f80c3b807614b2d374faf6d1d90c0d702519feec1d675a7a0fa1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt

Filesize
158B

MD5
12139c4a7634b82f501d93c643367ba7

SHA1
ab6ca2734e3a4037612a12d98eae0d6132c48369

SHA256
84979337bef0572175e9cb1b5e2f0d018d1c5af59fbc006e757e10c18da8d6d0

SHA512
0f56ac42b0940a0c033d2dbd8d82766dc85b266d5b31d3a6a094a9460747e97a4f5bcef96e74c20daa979bb50eb5d24fdae9918ac1edb6cabcf70a0cd7d9ef02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5cdfc9.TMP

Filesize
158B

MD5
34606df811e8df499773f75056512845

SHA1
0e190c89f41672b5d58248f94ac918ac4260f20c

SHA256
16d41243c93343864d3495c466cca99f412c1dc3a991e228ded55157707cb5a3

SHA512
f7d9d19bf40d4d94d556a03c6b8bbd6e686ffef7f902e0a486512535fb84f3320b046e30371e54a838414dfb3692f1037c4528941c58f5394121919aa7218442

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e9c6f0d7-ff49-4636-8614-63084ea49d17.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
ef48733031b712ca7027624fff3ab208

SHA1
da4f3812e6afc4b90d2185f4709dfbb6b47714fa

SHA256
c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

SHA512
ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
174ab4240f7b32add5f2f967e8aecba4

SHA1
52d8471d06bbd53e8cc4aab98770c4be81528f7a

SHA256
7d3ceae74fcd50e933f819f504c28897baa724153413c9051adec34c7442db13

SHA512
47c4b71d913e80c12b1a4334540cc016274162c6015ee7ba8ffdfe83a382a155e7de980925a6575d0daa82b8084a0ddc93c434e473d13d002fe510f6f8af737d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
230KB

MD5
e8ead5ed5ca8119cef83741d8ccab42a

SHA1
ddf3fa9db800eccd034c4277fcc8361a81d302fc

SHA256
90076fc8d1e24278c16359a328bf4f3e2a404c028665ae9bb278c8b9e02fe7d7

SHA512
85bcf35e0b3e44d14323c4fbfb7804012cdaaab55048cef85fbd5d04d4f3391619b2541c4b4f6ffd91422dee7383fb5e8f54b53166527b9eec81196f9ccca1eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
230KB

MD5
0b7531f27cbee38bcc74da2f481a486e

SHA1
aec4713657c77980f80011d473eacf467481079a

SHA256
13f97604d5020b13f05caf6b807409d8c2ee2209d4f4bae179401a837087bb39

SHA512
5932d9b88a6533c27a679fa250d764c0df86b77b5554fad19c3b945ffe450a03cabb2b35a646876e318a8057cb32f214bfa7bea09302781dd267ae4bfeae83da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
651fa5e5f5819f827b26c73d39aafc6c

SHA1
1a337fbe89d7d596505e8b1edefd3ba8dc5c5743

SHA256
5ba8b95a5fab1c41d011fe11580ba73ac6bc26a6b1ac4ef3770a990da494b58e

SHA512
2c1bde60b8000df3c98c348f8f186c61629d40f7d6cb21eb5c28aa577b2c4e03df98a036ed7301b518e5708630a77cb43a678f5832f3ee69dcab79a2ba8532f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
39576db39a3276b325d9dfae79659aef

SHA1
49dedc22631f0bc9a08ed7e58c992da69846f495

SHA256
57198f683d3aefc1be32b2d9729912477cdef2d26e6f4840a7eb2f8ba7727702

SHA512
8b04775a46acaabaa21301b4ec608a106236bcf2a5ef893a661f28d712d92da26471572da55942ac3e4a99bdcdbd9bc56496b4122fb48a35483f9fab4302ca9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
1ef54c21054f092641418b77320b29e9

SHA1
dc2564ec597df264d5ddfde4350f7b0e1ebef9eb

SHA256
2054360f5ccb371a3570f54f4dc2f98f9df46d8ba0cdae157249206730344a25

SHA512
d926317718273228f2f91ab53049aaef3510058e32d94593da90984e6c7a25a418dd8c36d0396c42397e1bf76c21d34c73472145f610b3c04625bb48f0257de6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
b74cfda311e64c46ecca35ba165ce7cf

SHA1
01d1af30b65d5f1d6951b04803cf72b5b48202d4

SHA256
3ee1eb30f4c23117dc840f9aebd19dabf2071b5987ea5d2ac0f4976553644424

SHA512
a9d052e57e8d331154b2915c1d03c4a356a23324116741ea5739ffc0f1555025e03e3f1110b9806c0816e3c038241c1fc8a26c7c854bd578a1c653e98699fa8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\0589302f91aa343fbe0005be96fccbe2

Filesize
7.4MB

MD5
0589302f91aa343fbe0005be96fccbe2

SHA1
e522005b2f17a5e1686ec12c78c59f9ea97bf3a2

SHA256
24a86d06e182f61060442200d2e197a3bf1ae0757ccb60ba65137b66e63fe236

SHA512
63e5f206365b59426f9bd66bbed78ad0e74018f5d9485f69793fa1fbb78beb8baf3f182814c4938a123a6ea993b91f39a3d070e676bf146e622e99a4e2874279

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
7.2MB

MD5
a1c0810b143c7d1197657b43f600ba6b

SHA1
b4aa66f5cdd4efc83d0478022d4454084d4bab1d

SHA256
30f233f41ec825806609fb60d87c8cb92a512b10f7e91cdbb4bf32cee18217ae

SHA512
8f45702da43526c04b957f571450a2b53f122b840fa6118a446972bc824c8ee7acd6e197177b54236ce7f428fb73a7cbe4ed18d643c625c9f156463d51ee038a

Download Submit
C:\Windows\Installer\MSIDFD1.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIE021.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIEFF2.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
memory/924-2808-0x0000015BFF7B0000-0x0000015BFF862000-memory.dmp

Filesize
712KB

Download
memory/924-2801-0x0000015BE46E0000-0x0000015BE4704000-memory.dmp

Filesize
144KB

Download
memory/924-2804-0x0000015BFF980000-0x0000015BFFEBC000-memory.dmp

Filesize
5.2MB

Download
memory/924-2806-0x0000015BFF6F0000-0x0000015BFF7AA000-memory.dmp

Filesize
744KB

Download
memory/1836-5431-0x00007FFC71960000-0x00007FFC71970000-memory.dmp

Filesize
64KB

Download
memory/1836-5428-0x00007FFC71850000-0x00007FFC71860000-memory.dmp

Filesize
64KB

Download
memory/1836-5429-0x00007FFC71850000-0x00007FFC71860000-memory.dmp

Filesize
64KB

Download
memory/1836-5430-0x00007FFC71960000-0x00007FFC71970000-memory.dmp

Filesize
64KB

Download
memory/1916-5241-0x0000000073A10000-0x0000000073C20000-memory.dmp

Filesize
2.1MB

Download
memory/1916-5240-0x0000000000B70000-0x0000000000BA5000-memory.dmp

Filesize
212KB

Download
memory/1916-5423-0x0000000000B70000-0x0000000000BA5000-memory.dmp

Filesize
212KB

Download
memory/1916-5310-0x0000000073A10000-0x0000000073C20000-memory.dmp

Filesize
2.1MB

Download
memory/3532-0-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

Filesize
8KB

Download
memory/3532-28-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/3532-2805-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/3532-2-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/3532-4-0x0000024F3FF80000-0x0000024F3FFA2000-memory.dmp

Filesize
136KB

Download
memory/3532-1-0x0000024F3E000000-0x0000024F3E0CE000-memory.dmp

Filesize
824KB

Download
memory/3532-2383-0x0000024F3FFB0000-0x0000024F3FFBA000-memory.dmp

Filesize
40KB

Download
memory/3532-2385-0x0000024F58720000-0x0000024F58732000-memory.dmp

Filesize
72KB

Download
memory/3532-5-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

Filesize
8KB

Download
memory/4784-3548-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5416-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3633-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3616-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5286-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3607-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3829-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5311-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3580-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3566-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5253-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5345-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3872-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5369-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3529-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5381-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3512-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5393-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3917-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3505-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5415-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5265-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5230-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-4117-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-4572-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-4714-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5065-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3482-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3463-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3458-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3409-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3385-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-5012-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-4803-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3384-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3382-0x0000023436380000-0x00000234363B8000-memory.dmp

Filesize
224KB

Download
memory/4784-3383-0x0000023436350000-0x000002343635E000-memory.dmp

Filesize
56KB

Download
memory/4784-3380-0x0000023432610000-0x0000023432618000-memory.dmp

Filesize
32KB

Download
memory/4784-3379-0x0000023432690000-0x0000023432720000-memory.dmp

Filesize
576KB

Download
memory/4784-3378-0x00000234319D0000-0x00000234319E0000-memory.dmp

Filesize
64KB

Download
memory/4784-3374-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3375-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3376-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download
memory/4784-3373-0x0000000180000000-0x000000018110B000-memory.dmp

Filesize
17.0MB

Download