82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316

Analysis

user interaction
yes
max time kernel
96s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BootstrapperNew.exe
Size 8.3MB
Sample260511-2dn2dsez3r
SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
MD5 c9f1c55b26e7f781b65a96ea8190517d
SHA1 dad71e6ac2ad9e3ce30152f993d0c765008c6b5a
SHA512 aaef6d78bf342a8ba0d04aa9653ca2336e7e17c21159c7dde0f9df9c31e2eeaa625ed821f9a71e0f36217ad9169f030a437215a4952c906a959b0efbf8ccb17d
SSDEEP 196608:dFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJ+:bIPNSfMGPkSEoOY139nHt+
TLSH
T169961206B28AFD47D7322C345545E32D8A627E34EEE5A30B31BC39AD453B76D8848B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
183	4460	msedge.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	BootstrapperNew.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
5572	RobloxPlayerBeta.exe
5572	RobloxPlayerBeta.exe
5572	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_2054782398\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\avatar\characterR15DynamicHead.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChat\icons\ic-unpin-20x20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\Cursors\DragDetector\HoverCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\StudioSharedUI\spawn_withbg_32.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Controls\tab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\PlayerList\BlockedIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_8.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\PlayerList\StarIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\SpeakerNew\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_6.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_2054782398\_locales\et\messages.json	msedge.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\avatar\compositing\CompositPantsTemplate.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\Amazon_large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChatV2\actions_notificationOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\DeviceEmulator\emulator.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\places\MobileChatPlace.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\fonts\TitilliumWeb-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\StudioSharedUI\radio_selected_disabled_dot_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Controls\DesignSystem\ButtonStart.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Controls\PlayStationController\ButtonTriangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Settings\Help\BButtonLight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\StudioSharedUI\places.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\New\Unmuted40.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_2054782398\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Chat\Chat.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Emotes\Small\CircleBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\fonts\SpecialElite-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\MenuBar\icon_leave.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\SpeakerLight\Connecting.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\SpeakerLight\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\sounds\ouch.ogg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Menu\buttonActive.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\avatar\scripts\humanoidWalkFamilyWithDiagonals.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\PlayerList\ViewAvatar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_luobu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\AvatarImporter\img_window_header.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\GuiImagePlaceholder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\VoiceChat\SpeakerNew\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\ExtraContent\textures\ui\LuaChatV2\actions_notificationOff.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\content\textures\ui\Controls\PlayStationController\PS4\ButtonShare.png	RobloxPlayerInstaller.exe

Executes dropped EXE 10 IoCs

pid	Process
2936	RobloxPlayerInstaller.exe
836	RobloxPlayerInstaller.exe
2088	RobloxPlayerInstaller.exe
4672	RobloxPlayerInstaller.exe
5240	RobloxPlayerInstaller.exe
3172	RobloxPlayerInstaller.exe
2344	RobloxPlayerInstaller.exe
5572	RobloxPlayerBeta.exe
5844	RobloxPlayerInstaller.exe
2712	Solara.exe

Loads dropped DLL 3 IoCs

pid	Process
5572	RobloxPlayerBeta.exe
2712	Solara.exe
2712	Solara.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0007000000025353-1980.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230121209895439"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-bf6344c9c23446bf"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{BE8DCE27-958D-4BCE-BE54-B837CBA467C9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-bf6344c9c23446bf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-bf6344c9c23446bf"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-bf6344c9c23446bf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-bf6344c9c23446bf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-b087ddbc37e94847"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-bf6344c9c23446bf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
836	RobloxPlayerInstaller.exe
836	RobloxPlayerInstaller.exe
5572	RobloxPlayerBeta.exe
4220	BootstrapperNew.exe
4220	BootstrapperNew.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe
2712	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
756	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	BootstrapperNew.exe
Token: SeDebugPrivilege	2712	Solara.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
4220	BootstrapperNew.exe
2344	RobloxPlayerInstaller.exe
2344	RobloxPlayerInstaller.exe
2712	Solara.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 5620	4860	msedge.exe	88
PID 5620 wrote to memory of 1276	5620	msedge.exe	89
PID 5620 wrote to memory of 4460	5620	msedge.exe	90
PID 5620 wrote to memory of 980	5620	msedge.exe	91
PID 5620 wrote to memory of 980	5620	msedge.exe	91
PID 5620 wrote to memory of 980	5620	msedge.exe	91
PID 5620 wrote to memory of 5776	5620	msedge.exe	93
PID 5620 wrote to memory of 5776	5620	msedge.exe	93
PID 5620 wrote to memory of 6000	5620	msedge.exe	94
PID 5620 wrote to memory of 6024	5620	msedge.exe	95
PID 5620 wrote to memory of 6000	5620	msedge.exe	94
PID 5620 wrote to memory of 6000	5620	msedge.exe	94
PID 5620 wrote to memory of 6024	5620	msedge.exe	95
PID 5620 wrote to memory of 6024	5620	msedge.exe	95
PID 5620 wrote to memory of 4880	5620	msedge.exe	98
PID 5620 wrote to memory of 4880	5620	msedge.exe	98
PID 5620 wrote to memory of 4880	5620	msedge.exe	98
PID 5620 wrote to memory of 5840	5620	msedge.exe	99
PID 5620 wrote to memory of 5840	5620	msedge.exe	99
PID 5620 wrote to memory of 5840	5620	msedge.exe	99
PID 5620 wrote to memory of 4204	5620	msedge.exe	100
PID 5620 wrote to memory of 4204	5620	msedge.exe	100
PID 5620 wrote to memory of 4192	5620	msedge.exe	101
PID 5620 wrote to memory of 4192	5620	msedge.exe	101
PID 5620 wrote to memory of 5252	5620	msedge.exe	103
PID 5620 wrote to memory of 2704	5620	msedge.exe	106
PID 5620 wrote to memory of 2704	5620	msedge.exe	106
PID 5620 wrote to memory of 2484	5620	msedge.exe	107
PID 5620 wrote to memory of 2484	5620	msedge.exe	107
PID 5620 wrote to memory of 2484	5620	msedge.exe	107
PID 5620 wrote to memory of 1356	5620	msedge.exe	108
PID 5620 wrote to memory of 2936	5620	msedge.exe	109
PID 5620 wrote to memory of 836	5620	msedge.exe	110
PID 5620 wrote to memory of 2088	5620	msedge.exe	111
PID 5620 wrote to memory of 4672	5620	msedge.exe	114
PID 5620 wrote to memory of 5240	5620	msedge.exe	118
PID 5620 wrote to memory of 3172	5620	msedge.exe	121
PID 5620 wrote to memory of 3928	5620	msedge.exe	122
PID 5620 wrote to memory of 5128	5620	msedge.exe	123
PID 5620 wrote to memory of 5780	5620	msedge.exe	124
PID 836 wrote to memory of 5572	836	RobloxPlayerInstaller.exe	129
PID 5620 wrote to memory of 5040	5620	msedge.exe	135
PID 5620 wrote to memory of 5040	5620	msedge.exe	135
PID 5620 wrote to memory of 2288	5620	msedge.exe	136
PID 5620 wrote to memory of 2288	5620	msedge.exe	136
PID 5620 wrote to memory of 4992	5620	msedge.exe	139
PID 5620 wrote to memory of 4992	5620	msedge.exe	139
PID 4220 wrote to memory of 2712	4220	BootstrapperNew.exe	141
PID 5620 wrote to memory of 1040	5620	msedge.exe	143
PID 2712 wrote to memory of 756	2712	Solara.exe	144
PID 756 wrote to memory of 4400	756	msedgewebview2.exe	145
PID 756 wrote to memory of 816	756	msedgewebview2.exe	146
PID 756 wrote to memory of 816	756	msedgewebview2.exe	146
PID 756 wrote to memory of 816	756	msedgewebview2.exe	146
PID 756 wrote to memory of 2704	756	msedgewebview2.exe	147
PID 756 wrote to memory of 4256	756	msedgewebview2.exe	148
PID 756 wrote to memory of 4256	756	msedgewebview2.exe	148
PID 756 wrote to memory of 2452	756	msedgewebview2.exe	149
PID 756 wrote to memory of 2452	756	msedgewebview2.exe	149
PID 756 wrote to memory of 2452	756	msedgewebview2.exe	149
PID 5620 wrote to memory of 3824	5620	msedge.exe	150
PID 5620 wrote to memory of 3824	5620	msedge.exe	150

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Solara\Solara.exe
  "C:\Users\Admin\AppData\Local\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\AppData\Local\Temp" --bootstrapperExe "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=2712.5704.16489088100872459042
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffaaef0b078,0x7ffaaef0b084,0x7ffaaef0b090
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,18127193239878831579,17104472414198453758,262144 --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1352,i,18127193239878831579,17104472414198453758,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1696,i,18127193239878831579,17104472414198453758,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3552,i,18127193239878831579,17104472414198453758,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffab381c188,0x7ffab381c194,0x7ffab381c1a0
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12847972912769166915,13237216910039225775,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,9209738042803815791,12946582740288355164,262144 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,8187635508381655419,8233920813114430046,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,6829618369713407224,29889243623900602,2097152 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,17811770650897036847,9462357792095298151,2097152 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5168,i,10649124288783397523,16291824555466375708,2097152 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4868,i,11502858337041119516,13027988646512715145,2097152 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,4836565624025331805,12391398421743980479,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,2212232515424507574,1136452789591126108,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10413021230591755157,7069403628807783127,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10413021230591755157,7069403628807783127,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,8308896298466614307,18167199949234133226,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5032,i,9687479932044341725,17039094569666767806,2097152 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14323284086192627808,7798746863598077445,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:1356
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2936
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 836
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5572
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2088
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4672
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5240
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,12294812243696148414,13081070655796097417,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,9091235081816901183,8918696393146996086,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,3210287835308653119,4155529088008614696,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,5318301092092895069,8844865346908981954,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,13387048648756546707,5997982244471133298,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:8
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,521815829756148025,15519537355676754764,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,15462269164270955803,8185769021989338354,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,15462269164270955803,8185769021989338354,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2920,i,1684217344501575107,3210396172057111167,524288 --field-trial-handle=2288,i,10565253796688536685,5474265438931221216,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:8
    3⤵
    PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2428

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2344

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 1903289172692e64ea90f9e12d40aa15966eee72ac15fe5f01b633970f2e7401
MD5 5d2e6fcfa9376f75564a7c665e6e173c
SHA1 762c3288bbc30b80d3b87c363044e05f49e0e3c4
SHA512 6c8cdda87a0ead494981547f59a455ca709091f2ec649f5b32f62dab86e1235334f030400c7c94e596d333e24ee4ec5ab6412a1ba239e1e19dc08e5d2ea04ae1
SSDEEP 196608:jNwJ7D0vKgDRKSWPZGf1/KAamsxVUFsrRt6bSx7sBvwCa/hU:jxK4CAamsxKFCRt6b2oay
TLSH
T1EAA6BF22FA00C032E4C201B2A6BD9FBA993C99351B7950D3B7D45DB95A345D33B39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.dll
Size 20.3MB
SHA256 83ae55acd7112ff18b2a26158b719dcabf5b02d649e051c9e2b6bd2601212645
MD5 fd80e6e574a8ac7061bf43eb775ed5f6
SHA1 e0c4aefaa2f2cfd842d2fd72bbc4fa20948c16ef
SHA512 24a22e925404268d61fadf3e4af75d8c121c38f18ffee9ad51c5b70ce634bd5656c61552de90f55f9060051818e227c8ce98aa16525eb73efcd6f81c9077c606
SSDEEP 196608:Al+J7sidPao+4SDUlpdwngdo8bS0usfxgwpG626z+:S+J7PdPao+4RNeIS0uggQ26z+
TLSH
T13327CE8EE9D70AF4C5B24474E51F13E7EB62308C4A686AF746D40210367339E2699F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5620_748428351\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5620_748428351\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 719B
SHA256 ad2361fb0fae8524c070ae1b3b197249c7a7406ffb880346f02639a74dedfea1
MD5 4c2e1416543b42827ba097206762237d
SHA1 b3165cb92754a364dc5a75b83a24b92866822741
SHA512 e86d9c4ffef724428b7f9d37c571e15da22f9246d4774a5536c5447cba1db8b7d9a39f3e8c3890d788f145c3de585ae03e4ef3e2e6a01c6e16687a6bc9347f5a
TLSH
T1AB0199627C0068072F9E1684924E8B90B0A680B5121E746CF97157117740FDD114AE2C
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 727B
SHA256 340716ca0e51dc892677d18a46363861dc90e110a97c1676e1aa193d0b579d31
MD5 7d2b79461684540384c4182281a7d90b
SHA1 b901b5623ce58ef2dc5fbea7ccce5c67152b8135
SHA512 1628c52c3f0897e26a6f9ce060e03c4215ea5166f022eabeadd8dee015502fe647567d62fb8ac68ddd83dec03311603fdf366e106cbee8dea86386075b38cb34
TLSH
T1660165C612681C5429020C149CFA9C3208565DFB6E6E5A0B3AE5589A010B6BC701FD34
MD5 SHA1 SHA512 TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 446B
SHA256 06287adcd1bacacf2b737a4316cbff86db020e6048b97677858ccabaff0eb3f4
MD5 9e7469f4b370dbfdd8af5e0ae11649c9
SHA1 05921de0d4e9ad3f4a406f101853d110e3e6f50e
SHA512 c8bac81efd33e8a1552a449852d004656cc03c1f5e8f50524957171cc752db7946fab21e0f20029f2cd06abbda9a452298400493d960d899cecbb7dc55ad7100
TLSH
T1D7F02B5814AE002FE472D678D7D95AB2BE35E0023908BAA901E61215D605F862D51B68
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 478B
SHA256 58667f0f6adf36ee7fec8d9601acbabbdcb8a2717b0164dc2863814c942506a2
MD5 9444f3ce1922a490e3438fc2eb48327d
SHA1 6db5e9a794a9a406955432cbcaad787716239c3a
SHA512 ce8a0b5be2f03b04c843d9740d4b8acf1b9819ca6f108ad57f702837c8eb82331713fc540d50a880ed111240ac7f758d912f56d5985c90926b34253aa4a56ab6
TLSH
T1B7F05C5C2AEC113AD571DE34C6F9A5919C06B062259052B411830958D602EC4CD6205E
MD5 SHA1 SHA512 TLSH

Submit Download

bcaramj3.newcfg

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\bcaramj3.newcfg
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6d1c5302a585b53cab40260d5c0f4fb6f6193204c463e7a75c0ed37c2b8dcd23
MD5 791f9ac80c9dfbe42f2dd86008a6b4b5
SHA1 c8dae151ab0c7b4d4eca4bda75d57208191d6ed8
SHA512 4623a30868ba7b2530a9d9e3ce6a653622b8121dbc230891785f3dbba3084e78364489930d6a440c7125c4253a28e8c0039bf5d25eb0167b1126c41e4f7885c6
TLSH
T187E02BAAC9219C2B04F90B282012564AEB51135B1B50885B7B3D8148CFB16374555C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 007e72df72b374de94fc3fda1d13a57467664732028e4486b83c238b5d84bdf5
MD5 b77ff36a6620fa4c1d48a60758787909
SHA1 732929eaf651d34db08d1cf550277ddd5937f073
SHA512 c21aed5a10cce614a60e0bb286a13bed7f9c38cff0f1f5b258809616b94517a8cc93c7f175c488bb68ed6b915a58641cd4537e4ae14e01c6f6e7b8a2a322c5c8
SSDEEP 192:9ZfkKGzePBVhIlWr7oId0k8YewhpADZwzD6wzBJ4HDudP2geWqp/6ld44vJ8G+WH:9Zfk1zeBTIlWr7oId0k8hwhpADZwzD6W
TLSH
T169D1521049DAA5A8DFF5113F8CA10D39A1369B1548C2AF4771FFE6BF2A37FE42610414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589073.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589073.TMP
Size 2KB
SHA256 e7fc74e8e25b7ec2f8099c811689dd4c55f212cfd007720ffd0a66dacfd61264
MD5 78cc7ec092633fb17e8b0c19d57be4ea
SHA1 d6ad270590aa74a32f7c91c3d454def056fc779f
SHA512 5aa5668499afb21f73a6e5947297fbbe6322f31a56172bd4045ec9494638feb2384499b60f26b51843ef20e876e4cc76df62631827404133e7f26e4000960393
TLSH
T11C51A3945E88C4C9EBF960704AD10452723F9F1A4E46FF1B39FD75FF2A86B2C9510824
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ab6c10ce800ea7d9e501376a0f9abf4275e2ecb52bc6a74817173c6bd4a7371a
MD5 2403e01bdf6aa66cebab684bdc275047
SHA1 0b35593b39e15e303f454d41124ff260f5114706
SHA512 873e62c725063e199825d83a3f2f3b848a44298dee2a6aac8cd9af5e7eb263668c5f0b0c477198ec577947ec3e308cf0f56fff8a10010e24dfe4b0cb6e350ae2
SSDEEP 96:DDOdvdXj1adzBGO5HIAJGtjHjGMu2HxHGj6Vhnfw4laAW:Daddj1ad175oAJGtjHjGMu2HxHGj6Vhi
TLSH
T1E5B1BDF383B5856DDA1196F0AA18AE1BCF5D0521436C7C6A85E4BF07A3F3461E101B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 9aea90c5f67510aad5ef94652e366d788b7bb4f7834af61786798818d315de62
MD5 ac367389573b900a01acd10c2fe83c6a
SHA1 79310623dd22345579f994e8b61d8f11cbfad6f4
SHA512 f0929c5a8696a5bfc9213fa35c4309b68f5c44a4ad202f37d1df0e7b24edc071c382426c2eb491c66fca1ca92372b13c454e6d8e8a56896bdf8e5587e4be8cca
SSDEEP 384:sxZPnTahup/fBsDn3hvAMIB/k1GeNHbIE/3N+CoI:s3Ta0p/fqneMIB/k1THbd3N1
TLSH
T152820916AA34597B8DD7C619F9057B53D7F85163D6804E48AAFCCA0C08E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 e99bbcc7dfaffff907e6b0248c9d851d9e4ee6de7525ce07368e5b93c7c9b097
MD5 22b9b06ef7add544f4d1c8fd4c77ee59
SHA1 fd8a59fe28bf6b7378df14582c1c8e4b6e26209a
SHA512 333eb09701f0266d1834352aa1a3c38b173c70bb587698f0e86f82072cea844bfd859c453413b913beb6de5ec14a32ceb7bca50cb6bb6dbb8da974de1a909f00
SSDEEP 384:sxZPn3ahqp/fBs8n3hvAMIB/k1GeNHbIE/iN+joI:s33akp/fJneMIB/k1THbdiNW
TLSH
T16482F716AA34597B8DD7C619F9067B53D7F85163D6804E48AAFCCA0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9a88078a2172ed5d048cd64ab6e3921204dc78ee9122474a91f8d7989ac49991
MD5 9ea81d9419d9c847b056dce840b09c86
SHA1 5c8ca9238e1a448b7c02c266ac2dc420c5c8410a
SHA512 21c5d5a32c5376fce4cc324c2a1c2a3baba4542f7f9aff88a5c7eb8c891e734435221d5f047cbf8bfbe6a73e6cd0ac536d7a7ec7636f796c9319f0af0c886cf5
SSDEEP 768:A9sqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbEx4Llhf51YroF:A9sqZl+E/BlWvBDeTu1jaCEx4LXB1jyG
TLSH
T1B3F2FA3B6C0CCB7E4F804E9CEC2A7E8A7EE8018B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1f961fb5284d2b8e9bd2f51d21231684cc575233166f16a9c30a58efaff279c3
MD5 39127bba098f170541424f2fe4c28d23
SHA1 769b9ced244fb595b186d06ae87850093a4a9e0e
SHA512 a8700a05d44fe57ff89ab4030cc002e1d26ea92d4a807ffe357cde360fcc0e73a1281ed4f11d97a4eff1a5f55d55c3e779564b98c87859002a0e43f47e2f942e
SSDEEP 768:AasqZwY7pLuLnKlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXEx4Llhf51Yroy:AasqZwEEnKlWvBDeTu1jamEx4LXB1jSR
TLSH
T167F20A3B6C0CCB7E4F804E9CDC2A7E9E6EE8028B96D8895447F9841C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\96624b6a-d162-40b9-8a92-e680adedc754\index-dir\the-real-index
Size 72B
SHA256 775cb88da71396d7143d963fecba10cec38b30fd418da9ce3f4d8c25698d28dc
MD5 6507d59212672e464da4912ab9bf7e78
SHA1 fb4465774f353c7daab0e44602dfc74b9ad09615
SHA512 9d5a2f0ea986d3b9c59dd1b3f5ef030b1b3ce6f2aa04def6268c7715e01a3b25b2527facd11f013eca22681680c7c3116ff58e0a6999cb8c5cc6de692ab8beb3
TLSH
T11FA002A403E30955E12211B615A603411210CD201567A217A2910454CC50C44A54101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\96624b6a-d162-40b9-8a92-e680adedc754\index-dir\the-real-index
Size 72B
SHA256 436806c20b565f63ccfe746dbe0017cc4cb433171093e9415e46309fb91b8d6a
MD5 dc540414322a7395419fca72ec66d51b
SHA1 80f3ccf0aafb29c77e8acf506a4431db216e1f64
SHA512 6913750b7f605cff97e1a68aeb0b24270065a758faf6293947912dc9018a7501556ba03a18665960693952e75eb4426174e1a0983cc6493ce7b28ffb3a537b36
TLSH
T124A00224CA880112C15212B5259B47422750DFD06206572B49911149CC60B454F4101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d864f7e2-3df7-400a-972a-26ff447d73c6\index-dir\the-real-index
Size 2KB
SHA256 b87d932ac19f29f06550576c75eb91d7a71c22c3097fe0e93b4a47fded64b629
MD5 f265561e9dd55a5b0e60d597bc3ba800
SHA1 98a7c8d978064ea1a63abebfb9e0a7af8ba817b8
SHA512 9b68f96efe2392a5881dd85b7df52d33ee804bc431af5198254951acbe184d8e1814f8634dac440d08d0d93e30f3901208227aa79b7364ed15eea80d9fda5b0c
TLSH
T13551D6CC8D4B9B6FE9BC01B214B6149133B44ACD166456130DBC5776784333E2D4B699
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 a152bd70a95da130ea7b8e446c95d4df32d4f8ec2d8c7d0bad9e87e1684226d9
MD5 88f1d2241057d230968510111fe8bd6b
SHA1 c9f4c0b37deb4fc4bac8eda94b3d9014bc433604
SHA512 9d8adcf9c42eebf9bbb69e9f02ceb2e614e468f96b5538f1c752e317e5cf95f9c360c807d6f9d2043243a3daa777259f73d6f648c4a39849e6e76e2343da7ea0
TLSH
T1A2F0277B3BF71804BE9F93D92471006544013C24D985ECAF6126B3A750F1319748AD63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a2ad94776ee3bb2f4811e326db1827e514d94e2112e2619e5426de6137406919
MD5 37a8fb244cb8a597c6499655b71fc861
SHA1 96ccdd3c53f48c6f9abbcc1065401c818d77ed7c
SHA512 87951ae8dbe3cfdafd6508a1f3a229d144a1e773b5f8918915797df57694b0ed4c8e68e2e1452979c8fdd4f56d4b1614dfe6d538cd4b39d18426ff6c0d137b0f
TLSH
T150A00212CA995019C90066B6D4C75A733350482D030A175394E0E0A9ACA2261917114D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a21c59720bee5e7ca08c1a267ad7076dbd6c246febdcbb655f7dac67eb7a3fef
MD5 87bb1c1be71adc27555a8d2baa73e3cc
SHA1 303e8fdb525e7c704efd6be8c6156b77942cc24c
SHA512 aea45d69993cd60bb40334c9ad45c8c904c1992e031c3b0fee3531cc95883a0f81994d3d581f3c1b74a7dbc8f9a14f75107928e2a686e7136159a857d10426ef
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnY:+BOVglYXrbtZqRvJLNi
TLSH
T173B24F11763B1380397E258E9194B46F62C270A37098B46B7BB944A64F6BF20CDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 88c466d3e4a3ff80cf5187539668988cd6d746c4edfffa1f97ab54621fbaa14f
MD5 b707cfe5c63e7c843384e1e3ce2d050a
SHA1 d674f1dadef5b960f4cfc61e9344d0e05fccaf26
SHA512 632c5bc0b53c405a6758456442aa26bb8a26db9c29ba81d65a3a56abe92c303b9b2b2085bbe9555911cbb2a7421e898b3eaadfe91b6cbe776b95799b9dbe8432
SSDEEP 768:uFccpWYwg9dJi6aY9xewLkvFjhkoFYS/EgZ:KWEdJlxeP9jhkoac
TLSH
T10FC24C31E894CDABECDA8B89F74A7647DEE04263C68C4AE4D6DD1E1C00DB19D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 836d9040dd3e7d33f0e23b2acb7380df94e3fe83277cdeff351e2da6b9c59046
MD5 a8a3e2dc24b5b1412191aa3335db7498
SHA1 cf76a780f83f894e9b90913c027f6c471182f182
SHA512 070f4965e204e197b81655a1bc8a99b5c13eb17aa1c305aa974b5b6fda2796321d7625bfcdd1201f58609d4ca98803289ae80a5235e80293d26b421c1a8bad4f
SSDEEP 384:nu1iFavqMg3sN98TUNTUlIm2RihY2Br8vfDYrpxewwaChd7QXzRUAJhvzNFsrN1o:u8Fayv3mwgTir8Y9xewLkyXzi6Eo
TLSH
T165C25B35EC68DEABECE74F89A7097B07DEE052A3C58C4AD4DAD81E1D109719E1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 696df072783f05a8982acd74c1fd88923f1d56737431f3a12f8af5760d71f6d7
MD5 d979cb70d0d025ef390fede58247eb26
SHA1 f9cf843b331e1906772998385dddf31623683c5e
SHA512 7dc4c942a8ce03ee8f28fac123fc3e7a6cfeda7356fc84e316ed78f4070e97c0986a38815d3efdde2a67e3771ee363e77714902c5c33c04b3246c83006cfa1c5
SSDEEP 768:7FccpyYwg9dJieaY9xewLkNFjhkoFYS/EgZ:7yEdJ5xePjjhkoac
TLSH
T143C24C31E894CDA7ECDA8B89F74A7647DEE042A3C68C4AE8D6DD1E1C00DB19D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 88d8c29022ac24efe7666f87b92de70e6b88b3b0865744c1a8c525076f3a577b
MD5 e512fa4738991a59a21379c9cb174bb6
SHA1 7c18688a69c8b024d4502bc7323f18c4af0713d4
SHA512 ea2312f2576fcce544c5630e2460958fd24c3ea998825cb94c93b8abec937a8225a3931bb7cd8dbc5d67f1a22e53f4a496a64b4d1bcf41bec9a61be18be7a458
SSDEEP 768:+FIcpqYwgRdJieaY9xewLknFjhkoFYS/EgZ:IqodJ5xePFjhkoac
TLSH
T1C4D24C31E894CDA7ECDA8B89F74A7647DEE042A3C68C4AE8D6DD1E1C00DB19D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3f2e11f68a96b1e1cf96c09018f703d8a6d0255e1457a30852fa34d0a8979d41
MD5 73be16da28d2644bf2979628dfc502db
SHA1 b6fbc9f49c1274c3533a77276cd9b3a53bad7ce8
SHA512 c2b705ec4e3eae17e635e3bcc87988acb7bc10267d8d02e5ff12470a23a8ba321571eedaa3d211eef9e916110ec2bb9fd2c7b87e3595eadc2a471c5b7903357f
SSDEEP 384:nDiFavqMMsND8TUNTUlI4pdaTOihOKc98vfDYrpxewwaChdYuTnFjxHTrN1k+rvi:uFayxYwgudJi6aY9xewLkvFjxHk
TLSH
T1DEC22931E8A4CAABECDA8BC9E7497643DEE042A3C68C4AD8D6DD1D1D00D719E570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a84486a996bdbbe48a77360297a996bdb860aecdeed592f926c376a597bced92
MD5 141acc5a2882efd27aca400b9c053be7
SHA1 c3fbb2f14159ca42b84ab8852211bc4614fa1a8b
SHA512 dc2dce4d551c364c5d923168875b977081e46797f8ea58228e4cfbe5a5dbcdf5f522cea9e4609c319bb9386d497e5bce05ea826760b9e7bef026ceefbf6be4fe
SSDEEP 384:npiFavqMg3sNn8TUNTUlIm2RihnxMu8vfDYrpxewwaChdYuFnFjzRUAJhvzNFsro:AFayv3owgTisXY9xewLk9Fjzi6Eo
TLSH
T1F8C25B35E898CEABACD78B89E7097603DEE082A3C68C4AD4D6D91D1D10D709E530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5a49bc7-cec1-4612-b03b-3d24ccf68529.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b5a49bc7-cec1-4612-b03b-3d24ccf68529.tmp
Size 27KB
SHA256 a3e5f3a1ac67987465f552c00faaf72c30758b55ec3cbdf7e3aa23a94b35ab2b
MD5 d697a633400477e9bc5cfea01174348e
SHA1 65e6b049d01d59ee159a4e49240883790a2fe9b1
SHA512 ba0e7bb1c582486a5099d646f5a55924dffe888ab5920a42735b5cf5c3f8b9bef91ea67b7692bdd1bfa5de7992bdd8fae662b530b3f6347ae11cd581ac0845e9
SSDEEP 768:7FIcpyYwgRdJieaY9xewLkNFjhkoFYS/EgZ:fyodJ5xePjjhkoac
TLSH
T129D24C31E894C9A7ECDA8B89F74A7647DEE042A3C68C4AE8D6DD1E1C00DB19D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f0d7c4004020ee6fb6ae66aa9c21e898e89dc8129209c9ddb69956de16fa6249
MD5 28e84f0be0ca8f2d4f6b20269f217610
SHA1 7ea2b55cf1bc0339d71e98566185779be7503630
SHA512 0e22b25d56aa8c38cc021540b5df7c8a5592573a09d0014e1138191fd366e4bfa4e33fa0f78ae046398621b1067d0a880c9d2d9ca7dadaed3f6f492fbfef6df1
TLSH
T1DC412858B6F92148B3B77E2A9BF7A96E487A79372F06C46D10110E4F0A62B40DC71737
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 144B
SHA256 7ee53d6ed8035393761c56a337b829f264d28f4b260b6a82629fe587c624c604
MD5 6bbbee39cb2bece2416fe2c6c33406fe
SHA1 ae3c42a5000419ffd41a835f7c0652b12ca850b9
SHA512 6e8c0db786771592c4a9e9ae012d6cf9d717cf4e6298a9b7dc8c44cc1bb7594883e2300165930bf94af7cf6fc0d25877965d059dac17b58feaf938ccdac9b9d6
TLSH
T18CC04C8103E4007A870758DFD260CD37D1470050195E522198D7599F6C7A54704A61C4
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 194B
SHA256 5e4e58e59c5b8cf8e21a28575b530c085ec02fb58f93ef2c9d1df038ad745a11
MD5 e79a348d73e8e8398d098c5fa440a8b3
SHA1 17e3178c3539f62c25c3646b70e11c0eeb4821a8
SHA512 7df52329fdb6c5961096aecda62f35ec1021b63fce9bf268b2c00a814b8a470f7741df38cee29e212347e76c507ada675342f000d0b4ffdc29ae801eb1389fe9
TLSH
T1CBC0028103E4007B8B0758EFE154CD37D1471050699E5231DDD759DF6C7E64704975C4
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 244B
SHA256 c108336f9c677606050b22891afc29d5f549a9f8744f6b2f886a924dd26b7e72
MD5 917bc7c8e8e98e986a994819e1680d64
SHA1 719dd2325f946aa12b4823ba586cdf373b6b76df
SHA512 1aa1cd049dc7df4e2c02e2f444900b74d3dc1785dcce17801faf26fcb27a055fe0fd591db4c6d9129c505f28642024fc6a1f1895adf849b0ebd78a4d63e564d0
TLSH
T192D09E8203E5007B8B0718EFE1508D37910B104069AE5230CD9A59DF6C79A4704971C4
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 88B
SHA256 5abafaed03075df7749c1a4dc6a2e5f40c5e8a6c3cdc8c88b8f2f0570f170830
MD5 1e8e43e89776cdf593390fbada437b4a
SHA1 57956a2a7b927abb600d3a0e7945f228059ded7e
SHA512 09c130bae157f0c4c22ddceb7f8c5591a4946bcb006f5ad91ffa3b3a5e6cc8c79362a6c4bf2333119476875ea6bde3039c6c915db61c229c273a32ecb2cfd415
TLSH
T182B002C41744003E374751EFD1655DA2510720C05B75531054C75C8E497150304824C5
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 182B
SHA256 1dbfdcc750754a06bb0f12e1f87975ae91051c4910659453751695867ae517d8
MD5 dd2e571715e58d875155c7520de6cc3f
SHA1 20f1838ddd5a37220816b490eb4a55c9e6e646f0
SHA512 9e74d6dcd70787c68df880c5f23d60c6ec35add3b3242ffcbf5a645a627e8ae85c015d465d201be89cff6f6fabb5ae6589dbaeb964e264ac9c34f219b1c8070a
TLSH
T169C002850BD4007F6747A5EFE1555D63510721801B7A521498975DCE4D71E8714831C6
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 232B
SHA256 0db176c13d3e9fcdf0643bba604acc0a26a9115a86535c3a5e664ab9e291db64
MD5 393de32ff761cf689c09e56b497ecab0
SHA1 b9e98749ea45d47e4d29f273efc2d6d390696ea3
SHA512 170605c0f0f65fb1c63b5d021e333e05a999c94fbb1a2e207350f29e224e5c255b5ff62885f4f1a2248d6f6878199eeb6126c4d3bba66a6024198d3006586fe5
TLSH
T117D0C7850BD4007F570769EFE1555D73910720802B7A922098935DCE4CB5EC704835C5
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 278B
SHA256 71b8bec9c3530a698ee721426c12986a4e7171b6fdc12715bc45178e96a9a735
MD5 7ee25ba57728203c320e57a478f59cc3
SHA1 ebf80b41e06f2ef0556d170389aaa7a71db56a55
SHA512 ca1bf817bb443cad4a879a246c4ba0191178789ecd7aae03734b93b4ec793ea88f4a1f4f5677df5e105640b6dd486cdcebca41dacbf773f39c11104c45557052
TLSH
T1D7D09EC54BD8407F670BA9EFE1995D73A20B20802BBA92219C935DDE9CB5F8748835C6
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 270B
SHA256 2ed7ae2c99f4e4595d19788d4f74b28d91dd7e0d10e8b3a53b89702cb87c60c2
MD5 1b7d66ef489f3402b4cb19da9ddc6266
SHA1 cfae862e4b6b1a4283c8c89e0d5f192e0bb9c189
SHA512 aa05b0241f8c690d07622b85cb25322201c4c7e877af681b82b3c37600b3e4ad238eb365fc78bbcb9cd703de843b496d7a14dd809c32b6b0e4e49016deac86fb
TLSH
T10FD012D5C7D8007A3B870AAFE2965932255760419ACB422AC4A6AC9D1C995A711930EA
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 942418bb3d6fef8ca2696e5ed16adb5520ef5c887902b29631a5488cb48ef21d
MD5 95288b183c0a5a39f6988e44670f81da
SHA1 c01e03f55cb3fc9a9095b57edc32d4a46dc812d9
SHA512 84d50b185a35e9b75eaa1e952e085e37f06f11dd4670eb50212bf636b9bf4acef58996b21fb0abdd5d9454a798c8b165dd6fbc0c27399b36ac8646bb07399dd3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8f76edab9fb42dab9e48930ed2145cdd71d6b7b84b0494f8f6e0d21439c42203
MD5 e756be829eabedc165202b4ff362916c
SHA1 02df3f188db969c49b1134778ce0482bd4b69db7
SHA512 3879da590e883a56bc299822774a551a0be1cec3c744894ef889990bf2b6be9b9f323ee702dd9672ed6b4ccc03aca297e893bf544a3b146d53b8486f3e1dfe8f
TLSH
T151D0121673110238C0103173041272081400C29F420541046429E65D1A140900A0EC81
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 1KB
SHA256 8d75b8dec0f3577ef874fe97c4b21a34623476372fcfa44f8d3d89b81575eb5a
MD5 130fbecdd85720756ece280099b95bd3
SHA1 81b0c4380b0bfd37c5e36a454dd1eda1d765dcda
SHA512 8d9c23a3154a188a87a5ad2cba3297e390cfd92614cf0fe67aa275fc792d190d818c8eac2b73b6281b73bc691efe400df2d2f6c8989278b847c0474ac8ea87a4
TLSH
T16F3192B2A8A8A73A4C816955B1517A532F2221EAC2510E4491DE471D01F3ACCF13ED32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 27e3b3dc06f0eb90d3d3cd98a9f679cf8458fdf961111e2a20e9422528314535
MD5 5420e55d6aebb3df7fb9dd9f91705f9d
SHA1 5329eedb9387cbe4f178dd8b687ccc8198375c6c
SHA512 4cb7c697a75aac16c79367017187035baa6bf502cc404da8dca49c30f5fdc23608882b3e587a8a669aa5e5c2d8dddf2d35c00b359e1fb9d0fee396c20de56386
TLSH
T14451C7736818E77B49D29D48F9453B136B7621E69B922F5089DD0B1C01E79DC3316C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 28dbeb2164eb69657bdbfb771d728a45220eeaa92c4ddfac2556db6033119156
MD5 d31f794bfa1ee6d86faf4d91374f6bbe
SHA1 44971fa587dbf2dd1e303aae9af7fa79755a170a
SHA512 a430becbdbc2570acaeb0565ed3ef3c1ca900499748477c9959605653fc4919ab968d68aad7475fe160d18d7dbebbd75bb5400dc95a31a3de9d78c134e5f7dfb
TLSH
T1707195226964E63B4DE2AD44F8852B0377A51167D6D13FA4C9ED0F0C01D76DC2312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 16KB
SHA256 8de94f2378cee434f46fc3033eeacf5c7a2e65a832d7d7ff20c30cf57103b5b9
MD5 e6587bb3691c5844e69fce914d99d058
SHA1 bc48fd926026fb0ebd7898d7a51c9aa743150bb2
SHA512 9eead20871e7618c6964746d81f34c923ec53273b7e13f70810cd531e78986001dffa6e7b0f38a496b64714bf7fbb0a065b632c096b013c4ea5da1c4baf73a10
SSDEEP 384:zVvsrvyOiyp4+IWA1eUVWGfvvLdNbu/OEQRUXuGb6Q5B:h0raxyp4sQe6WGfvC/iirb6W
TLSH
T19372BF710A74963B8CE6EC4AFC4A3A077FD564AACED12F80A5D8AB1E054B5CC1306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590a76.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe590a76.TMP
Size 1KB
SHA256 5c1aa7049c8f22c8594c362f8f39a76126ed9795d61d3c67a66d5327090014b4
MD5 448c09e9467af6f48e26c349b60a6b7e
SHA1 9e309b7d79bc65a1cc5b745354cf5643b5597a6e
SHA512 3f0ef1e01d823e456df10e1048df5fc1e12613d53c6c8c0196b8b91eaf5a15e256a92b60a317582fc58c0a73728bc5a56789dcd05ac3efc07e1fa3bc4e235328
TLSH
T1192140B398A8A77A9D816C64F151BA472F5021EA93514F1891DE031E05F7DDCE13EC36
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Solara\Microsoft.Web.WebView2.Core.dll
Size 634KB
SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
MD5 225af3c55fbb7376a11dbc4648a2b582
SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
TLSH
T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Users\Admin\AppData\Local\Solara\Microsoft.Web.WebView2.Wpf.dll
Size 80KB
SHA256 6d329162b460515a849c693518ff626a1a3363e79d549cfd6822e5601f24603e
MD5 d8e466f3951eb9a3d22eb098f4cced13
SHA1 8db2e9b72d72ee13c2059371a0b3026137118b7c
SHA512 6ea9f0ce48f5e3b31465e7dd6e7e808d590933d99242e040c28b260f9124b0f3662d7e7356798f7e9eb09120ec3900cf98277e315a783c07cacce93ce1d0fde1
SSDEEP 1536:aU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udr:hs+vLqrThx6spa8+DHfFy30bpc4Jjr4B
TLSH
T109836C8193AC8923CBEF1FFD7C6050140FB8FA83B652D7992985B5EC0DA379119197A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Solara\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Solara.exe

Path C:\Users\Admin\AppData\Local\Solara\Solara.exe
Size 1.3MB
SHA256 473032c443307738fa01a2dc1d636c81f7b2def5d48d0dde91b0b896230bc83b
MD5 312746de805dc64b1ab7fcf9f4c0f1ec
SHA1 23f28f0abc2227177f8fce565c02ec2f50ec744b
SHA512 85e17706968dfa10148060957a4098df6ba91b73d6f148255352838792dcd4102bcd1ce0aaeb321c429bae816f36e6ee16549c6105ee8495cbd54c6e68f697cf
SSDEEP 24576:kVyuDb36T6hkReLXUJWpQ+NGkIAm1/Q3QQl:kAjkIAm1W
TLSH
T17455E242A2C6FD1BD3362A358594F32D89257F31EEA6930B30BD35AC553BBAD8449343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Solara\SolaraV3.dll
Size 14.0MB
SHA256 43d3926dafe8b7c0656d580710078b7cecda073c15f8463ae38e3366aeacba49
MD5 b2194ba105bf0162891b7e45cd48af55
SHA1 7782f2c17f9c58159e10487d6f95299206a20c30
SHA512 ae2814109397e6811c1de4268dfd81023158ca498722b8cf4e6d33f65fbc6c2153ab6f1c8db4debe95f5c0706e395ddcb32ece2d8c792926e1900186df0f23f1
SSDEEP 393216:R5zwVq4G2clb1XbiKEdLh43LIjWrRlUF5L4:RBwVq4G2cHU2
TLSH
T1D6E68CE761D4559DC43AC57AC353A66BC2AF743B43318AE72354A2A20F23ED13A79F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Solara\WebView2Loader.dll
Size 133KB
SHA256 79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
MD5 a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1 dd109ac34beb8289030e4ec0a026297b793f64a3
SHA512 2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
SSDEEP 3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
TLSH
T13FD35B5B73A5007BE1778174C4A34A1AEB76B85117609BDF07A442692F63BD0AE3EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\AppData\Local\Solara\Wpf.Ui.dll
Size 5.7MB
SHA256 0ebff5461eb1984ea852566a59f08456e48909f4ea9b7ec064a219a28ece0343
MD5 1aa1a40418717dc04ada47b52a1c06ed
SHA1 4efd1787373497fe819116e2c0e81e2463cc1052
SHA512 14d632d1dbf77d4a11d21c2314a07faeaebbce3f257e36d79c63becc29b16cacd09e8b7928d79742c1ef346576134c589ece3af8d80e49def36b865cdd9b7ca8
SSDEEP 98304:1OYON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7lQ:/O9oNdvPpR
TLSH
T1BE565B9E23ED0D33D363837A8DA07323196919652142AF878F4ADB2D44BA0C5DDF16DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 345B
SHA256 a7cad3501a143965e6e76ea8ee2a2ea854269ebaeed16a7afe69dfad9597b247
MD5 c2cf2bf471d6f8e2ab35d58d2a8a7aac
SHA1 ba0be17be637ce0470fc1154e81d4b841287717e
SHA512 039963a3a823997823af2cda6263f4d4d07b9409cf4a6f42f305634f44a980635154bb99c2c34535e62d6b50ceb9d63bee66b4ec27d34957284c14ec2f3f4343
TLSH
T1AFE0762322BCA16F7622A1029A720FD08FC17A9315684CFC2A6991067B16C2A0E5B80F
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 1022B
SHA256 1d6f820d89c78cb4abf58734bd1223cdb26662d2f81ee754be4576b8bbafdb90
MD5 31a45aea2fe4dfd50bcbbe174f28761d
SHA1 ef087f54f0796f1edb94c43bce42aff5ac24a3f8
SHA512 75eb4ba97179d470a06247ce2b03c7e4af6e852eaaa4b32296cd21d7de69813710240706b0e5c54dba5a4e9957dd2568615e6544f5a2055987a335927bdd1c89
TLSH
T142116F1321FC626F3512A44296320FD09FD17AA325B48CECAE24A1117B16C7D5F1B92E
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 1KB
SHA256 781fc7194b278d0f175d5ca1175e47a00362bf0cac29fa041bc23436137ae830
MD5 07495e7b388a624595d23f26bf27688c
SHA1 28bb284f24a24b783c13e0c7560b0baf9b824cbb
SHA512 2de0f7ee6c80c2b74f9a2a0df1bb98d52af8d728ad290b3130e82fff3c4f43b6e473471ab69c797efb65a9ca6c5cbe919143775cb06bafd05bd8b372b81c4108
TLSH
T12021AF1321FC716F3561A442A6720FD09FD17AA319B48CECAE24B1117B16CBD6F1B91E
MD5 SHA1 SHA512 TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 cf35dc1b4e84be1dcd5d472040cce75c586a76868271db42f3f654be8c981567
MD5 512ac7c33a0fb522cd21ea405a265764
SHA1 508ccc7f8e233226ba74a683f92a3f1bfd5565e8
SHA512 9c9d813070cbfa4136c0350c403856bfd8fcf8967691cbd62c06c026247ddae6aeed71fc2bb19398d3a305a9f4d1c52798fb71703dde0708eafdcde0959a95da
TLSH
T17EA0025473297550D02744350961A6B5A1752CE41265A011613BCE9968055E15439F0F
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe.crdownload

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe.crdownload
Size 9.7MB
SHA256 2c2d56486960edf4acfff3d9d72037cad750a0afaf406d263a5c5f1f9e3f1b43
MD5 8b94667332d30a7f0ce55a09dfb99023
SHA1 43e82b7dddae03f821404f6ee26247cb30c60b06
SHA512 b101d3d5fe3de28e39dddd400bd8241822e2cd0bbfdc6aa3bc59207b9daa679ac2a35020a7e51483aa66c4dd92dd65b31a2686a899e417023f9368bfbcd5a232
SSDEEP 196608:PznQYCPMgZTVKhLfMvC+A2msxnJYAhwUnsqqKxcpcBq/EEbhAeM+e:P8HKoA2msxJNHqKxcbdhAeMD
TLSH
T1E0A6BF22FA01C032E4D201B2A6BD9FB6893D99341B3954D3A7D45DBD5A305E33B39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-2333-0x00000205E2440000-0x00000205E247B000-memory.dmp

Download

memory/756-2332-0x00000205E2410000-0x00000205E2437000-memory.dmp

Download

memory/756-2331-0x00000205D7DD0000-0x00000205D7DDC000-memory.dmp

Download

memory/756-2330-0x00000205D7DA0000-0x00000205D7DCC000-memory.dmp

Download

memory/816-2348-0x000001D86F740000-0x000001D86F7ED000-memory.dmp

Download

memory/816-2071-0x00007FFAD5E20000-0x00007FFAD5E21000-memory.dmp

Download

memory/836-1517-0x0000000000BE0000-0x0000000000C05000-memory.dmp

Download

memory/836-1135-0x0000000000BE0000-0x0000000000C05000-memory.dmp

Download

memory/2088-1136-0x0000000000CD0000-0x0000000000CF5000-memory.dmp

Download

memory/2344-1497-0x0000000000C40000-0x0000000000C65000-memory.dmp

Download

memory/2344-1469-0x0000000000C40000-0x0000000000C65000-memory.dmp

Download

memory/2452-2162-0x00007FFAD5E20000-0x00007FFAD5E21000-memory.dmp

Download

memory/2712-2023-0x0000016B3DDC0000-0x0000016B3DE62000-memory.dmp

Download

memory/2712-2029-0x0000016B3E9F0000-0x0000016B3EAA2000-memory.dmp

Download

memory/2712-2292-0x0000016B22F60000-0x0000016B22F6C000-memory.dmp

Download

memory/2712-2018-0x0000016B3D2E0000-0x0000016B3D2F8000-memory.dmp

Download

memory/2712-1991-0x00007FFAAC560000-0x00007FFAAD367000-memory.dmp

Download

memory/2712-1938-0x0000016B22A90000-0x0000016B22BD2000-memory.dmp

Download

memory/2712-1940-0x0000016B3D800000-0x0000016B3DDB4000-memory.dmp

Download

memory/2712-1965-0x0000016B3D300000-0x0000016B3D3BA000-memory.dmp

Download

memory/2936-1134-0x0000000000C50000-0x0000000000C75000-memory.dmp

Download

memory/3172-1164-0x0000000001E30000-0x0000000001E55000-memory.dmp

Download

memory/4220-1512-0x000001B2ACED0000-0x000001B2ACF82000-memory.dmp

Download

memory/4220-5-0x000001B2F0C80000-0x000001B2F0C90000-memory.dmp

Download

memory/4220-0-0x000001B2EE040000-0x000001B2EE886000-memory.dmp

Download

memory/4220-2043-0x000001B2F03D0000-0x000001B2F03DC000-memory.dmp

Download

memory/4220-6-0x000001B2F5440000-0x000001B2F5478000-memory.dmp

Download

memory/4220-1-0x000001B2F0C80000-0x000001B2F0C90000-memory.dmp

Download

memory/4220-162-0x000001B2F0C80000-0x000001B2F0C90000-memory.dmp

Download

memory/4220-1513-0x000001B2F1760000-0x000001B2F1782000-memory.dmp

Download

memory/4220-161-0x000001B2F03D0000-0x000001B2F03DC000-memory.dmp

Download

memory/4220-108-0x000001B2F0C80000-0x000001B2F0C90000-memory.dmp

Download

memory/4220-70-0x000001B2F0C80000-0x000001B2F0C90000-memory.dmp

Download

memory/4220-1519-0x000001B2F1790000-0x000001B2F17A2000-memory.dmp

Download

memory/4220-7-0x000001B2F5400000-0x000001B2F540E000-memory.dmp

Download

memory/4220-43-0x000001B2F0C80000-0x000001B2F0C90000-memory.dmp

Download

memory/4220-1520-0x000001B2F1740000-0x000001B2F174A000-memory.dmp

Download

memory/4220-4-0x000001B2F4E60000-0x000001B2F4E68000-memory.dmp

Download

memory/4220-3-0x000001B2F0540000-0x000001B2F0550000-memory.dmp

Download

memory/4220-2-0x000001B2F0C80000-0x000001B2F0C90000-memory.dmp

Download

memory/4256-2122-0x00007FFAD5760000-0x00007FFAD5761000-memory.dmp

Download

memory/4256-2121-0x00007FFAD70D0000-0x00007FFAD70D1000-memory.dmp

Download

memory/4672-1137-0x0000000001FD0000-0x0000000001FF5000-memory.dmp

Download

memory/5240-1150-0x0000000000F00000-0x0000000000F25000-memory.dmp

Download

memory/5572-1219-0x0000013387A70000-0x0000013387B1C000-memory.dmp

Download

memory/5572-1218-0x00000133879D0000-0x00000133879DC000-memory.dmp

Download

memory/5844-2027-0x0000000000F30000-0x0000000000F55000-memory.dmp

Download

memory/5844-2376-0x0000000000F30000-0x0000000000F55000-memory.dmp

Download