b2638f1fb2e824ee67668f971eb407f66ecb67266df8f337c6798b4780ce4a80

Analysis

user interaction
yes
max time kernel
282s
max time network
282s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fastflag_injector_gui_enhanced (1).exe
Size 267KB
Sample260528-3ccgmses4s
SHA256 b2638f1fb2e824ee67668f971eb407f66ecb67266df8f337c6798b4780ce4a80
MD5 2bd43119b30b514fddd1e2ece79cc6e2
SHA1 66e3b650684c11f20d448584f2afa9405e4ab612
SHA512 428f2933555089ba50db75a134341297d80054fd435451c00ddfd7c219fddc1a51d4ba535ae70ced12c8eb2b5faf4dd8e5cf62c4ffd6ec122ad6378f55ced340
SSDEEP 3072:8D8QaxqVO1TOF3yrZuJACbHgQApKjV3WLm17c7kkbcFilTiWLKYdiaNT6V4GlJ2E:+aT1SFiCKLm17c7ONaQV3p53
TLSH
T13144B51FEAA658E1D8B6C038D153B13FF8B074A6837197D797815A070B62BE4E83E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
147	3976	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
3064	RobloxPlayerInstaller.exe
1524	RobloxPlayerBeta.exe
4216	RobloxPlayerInstaller.exe
5748	RobloxPlayerBeta.exe
2596	RobloxPlayerBeta.exe
2860	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
2564	RobloxPlayerBeta.exe

Loads dropped DLL 6 IoCs

pid	Process
1524	RobloxPlayerBeta.exe
5748	RobloxPlayerBeta.exe
2596	RobloxPlayerBeta.exe
2860	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
2564	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
1524	RobloxPlayerBeta.exe
1524	RobloxPlayerBeta.exe
1524	RobloxPlayerBeta.exe
5748	RobloxPlayerBeta.exe
5748	RobloxPlayerBeta.exe
5748	RobloxPlayerBeta.exe
2596	RobloxPlayerBeta.exe
2596	RobloxPlayerBeta.exe
2596	RobloxPlayerBeta.exe
2860	RobloxPlayerBeta.exe
2860	RobloxPlayerBeta.exe
2860	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
2564	RobloxPlayerBeta.exe
2564	RobloxPlayerBeta.exe
2564	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\particles\explosion_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\mouseLock_off.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\MenuBar\icon_home.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VoiceChat\MicLight\Unmuted20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\fonts\BuilderSans-Regular.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Controls\xboxRS.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\Controls\DesignSystem\ButtonR2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\graphic\TopBottomBorder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\InGameMenu\CircleCutout.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VirtualCursor\cursorDefault.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\sounds\action_falling.ogg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\dialog_white.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VoiceChat\Unmuted100.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\PathEditor\Control_Point_Hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaChat\icons\ic-profile.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\StudioSharedUI\import.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\chatBubble_green_notify_bkg.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Camera\CameraToast9Slice.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Emotes\Editor\TenFoot\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Scroll\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick2Vertical.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VoiceChat\SpeakerDark\Connecting.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaChat\icons\ic-resend.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\Cursors\mouseIconCameraOrbit.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Modal.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\common\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Settings\Players\BlockIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\fonts\families\Fondamento.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\TixIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Controls\DesignSystem\DpadLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Emotes\Editor\Small\OrangeHighlight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\ExternalSite\facebook.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\graphic\Auth\qqlogo.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\fonts\Oswald-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\ExternalSite\twitch.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\textures\ui\TopBar\dropshadow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\content\fonts\SourceSansPro-Bold.ttf	RobloxPlayerInstaller.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_843440266\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_843440266\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_843440266\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-notification\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\bnpl\bnpl.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-notification\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_404866177\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-ec\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\wallet\wallet-checkout\checkoutdata.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1519510975\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-mobile-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\wallet-icon.svg	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-ec\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1159176169\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-mobile-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\Wallet-Checkout\load-ec-deps.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-ec\sv\strings.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3976	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244842643612915"	msedge.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-981c8a3157934eec"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-460909c4fe904aae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-460909c4fe904aae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-460909c4fe904aae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-460909c4fe904aae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-460909c4fe904aae"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-460909c4fe904aae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-460909c4fe904aae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-460909c4fe904aae"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-460909c4fe904aae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-460909c4fe904aae"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-460909c4fe904aae"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-460909c4fe904aae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{6D9E8C0F-52B2-47F8-A784-256D89FF4C7F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3064	RobloxPlayerInstaller.exe
3064	RobloxPlayerInstaller.exe
1524	RobloxPlayerBeta.exe
4216	RobloxPlayerInstaller.exe
4216	RobloxPlayerInstaller.exe
5748	RobloxPlayerBeta.exe
1052	msedge.exe
1052	msedge.exe
2596	RobloxPlayerBeta.exe
2860	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2564	RobloxPlayerBeta.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	taskmgr.exe
Token: SeSystemProfilePrivilege	2128	taskmgr.exe
Token: SeCreateGlobalPrivilege	2128	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe
2128	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4800	3312	msedge.exe	80
PID 3312 wrote to memory of 3976	3312	msedge.exe	81
PID 3312 wrote to memory of 3944	3312	msedge.exe	82
PID 3312 wrote to memory of 3944	3312	msedge.exe	82
PID 3312 wrote to memory of 3944	3312	msedge.exe	82
PID 3312 wrote to memory of 2696	3312	msedge.exe	83
PID 3312 wrote to memory of 2696	3312	msedge.exe	83
PID 3312 wrote to memory of 2072	3312	msedge.exe	85
PID 3312 wrote to memory of 2072	3312	msedge.exe	85
PID 3312 wrote to memory of 5948	3312	msedge.exe	86
PID 3312 wrote to memory of 2072	3312	msedge.exe	85
PID 3312 wrote to memory of 5948	3312	msedge.exe	86
PID 3312 wrote to memory of 5948	3312	msedge.exe	86
PID 3312 wrote to memory of 3812	3312	msedge.exe	88
PID 3312 wrote to memory of 3812	3312	msedge.exe	88
PID 3312 wrote to memory of 3908	3312	msedge.exe	89
PID 3312 wrote to memory of 3908	3312	msedge.exe	89
PID 3312 wrote to memory of 3908	3312	msedge.exe	89
PID 3312 wrote to memory of 2080	3312	msedge.exe	91
PID 3312 wrote to memory of 2080	3312	msedge.exe	91
PID 3312 wrote to memory of 2080	3312	msedge.exe	91
PID 3312 wrote to memory of 3404	3312	msedge.exe	92
PID 3312 wrote to memory of 4372	3312	msedge.exe	93
PID 3312 wrote to memory of 3404	3312	msedge.exe	92
PID 3312 wrote to memory of 4372	3312	msedge.exe	93
PID 3312 wrote to memory of 1488	3312	msedge.exe	94
PID 3312 wrote to memory of 2464	3312	msedge.exe	96
PID 1488 wrote to memory of 4544	1488	msedge.exe	97
PID 3312 wrote to memory of 3908	3312	msedge.exe	100
PID 3312 wrote to memory of 3908	3312	msedge.exe	100
PID 3312 wrote to memory of 5680	3312	msedge.exe	101
PID 3312 wrote to memory of 5680	3312	msedge.exe	101
PID 3312 wrote to memory of 5680	3312	msedge.exe	101
PID 3312 wrote to memory of 228	3312	msedge.exe	102
PID 3312 wrote to memory of 228	3312	msedge.exe	102
PID 3312 wrote to memory of 228	3312	msedge.exe	102
PID 3312 wrote to memory of 4892	3312	msedge.exe	103
PID 3312 wrote to memory of 3336	3312	msedge.exe	104
PID 3312 wrote to memory of 4892	3312	msedge.exe	103
PID 3312 wrote to memory of 3336	3312	msedge.exe	104
PID 3312 wrote to memory of 3336	3312	msedge.exe	104
PID 3312 wrote to memory of 4512	3312	msedge.exe	105
PID 3312 wrote to memory of 1268	3312	msedge.exe	106
PID 3312 wrote to memory of 5380	3312	msedge.exe	107
PID 3312 wrote to memory of 1944	3312	msedge.exe	108
PID 3312 wrote to memory of 3064	3312	msedge.exe	109
PID 3064 wrote to memory of 1524	3064	RobloxPlayerInstaller.exe	111
PID 3312 wrote to memory of 4852	3312	msedge.exe	116
PID 3312 wrote to memory of 4852	3312	msedge.exe	116
PID 3312 wrote to memory of 1892	3312	msedge.exe	119
PID 3312 wrote to memory of 1892	3312	msedge.exe	119
PID 3312 wrote to memory of 4216	3312	msedge.exe	120
PID 4216 wrote to memory of 5748	4216	RobloxPlayerInstaller.exe	121
PID 3312 wrote to memory of 5620	3312	msedge.exe	125
PID 3312 wrote to memory of 5620	3312	msedge.exe	125
PID 3312 wrote to memory of 1052	3312	msedge.exe	126
PID 3312 wrote to memory of 2604	3312	msedge.exe	127
PID 3312 wrote to memory of 2604	3312	msedge.exe	127
PID 3312 wrote to memory of 5904	3312	msedge.exe	128
PID 3312 wrote to memory of 5904	3312	msedge.exe	128
PID 3312 wrote to memory of 2228	3312	msedge.exe	132
PID 3312 wrote to memory of 2228	3312	msedge.exe	132
PID 3312 wrote to memory of 4864	3312	msedge.exe	133
PID 3312 wrote to memory of 4864	3312	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced (1).exe
"C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced (1).exe"
1⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffaab16c188,0x7ffaab16c194,0x7ffaab16c1a0
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1285182609599074835,806765338662654962,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,13605065346009160336,12927455568522599965,262144 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,412296684549982501,4550620738512601508,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,12697216927749473993,12324022474811759950,2097152 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,3841296461236080097,12664156178892644288,2097152 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,4429195557493092090,4692245875131170588,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5196,i,11856109957866605657,9856608585934233865,2097152 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5572,i,4915595742248900603,18278080167036286279,2097152 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,1234994720146800464,4311355534254111315,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,18406778993966339771,17296891004765407367,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,2803200386695946817,854076697114423837,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,12053295197145857494,13823758720583965899,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,12053295197145857494,13823758720583965899,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,17918308709097840115,16712436093617412321,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:12
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6664,i,11231651140469159099,11504506300799416429,2097152 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5392,i,5710350020749080999,1285053591657903831,2097152 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,4281406553197336218,3163301736435567095,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:14
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7444,i,10325015845144181223,4433087686009851599,2097152 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,18080474565304820683,2238794782490280901,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,17661022644140488274,6434902923236282978,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:14
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8480,i,3280191104123671061,6019260643336079324,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8764,i,13789890987387332585,6267095942659907855,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=8488 /prefetch:14
  2⤵
  PID:1944
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3064
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7616,i,1449719742011774288,16636143656543698897,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,535260963704512165,3008917031552647117,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:1892
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4216
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,16207051547265761354,6431122827294587052,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8660,i,316187653819779933,523135678113356046,262144 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,13493776917169811832,6634234901186638465,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,8771916164784169208,15629830467412590001,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,9308593569815005397,12093817388043432375,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,6230615864095620769,684665516152421496,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,18426624874924443382,4557557756281779964,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:14
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,1592122446294928792,7453571165286943930,524288 --field-trial-handle=2076,i,6766342714666127986,1854612792699195288,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:14
  2⤵
  PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5116

C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2596

C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2860

C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5928

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2128

C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 27d8e950f31c4ba144196696c811ebe765e7f73c2251226268dc0b31eeef0a05
MD5 c8a825a872bd954fa886c0daa4a85488
SHA1 a449f512d5b764ed14ded5c1e0cd7c2936686155
SHA512 ff7812614737bcdb624d71cbf7ff08d08080a299cc1e1592606d695d767f8f815929b364eff2937e72e6b2d873f32a879fb4a437b03c96f77cd775e66fc8d361
SSDEEP 196608:VqujsdhtYCpm2cdRtkZtBQzBmXyBk4YwQLBlA:VqvwCpmxI0BmiBk4Yd
TLSH
T12BA6BE12F940C031E5D201B2A6BD6FB65D7D8A341B3854C3A7C45EBD8A705D33A3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.xml

Path C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-460909c4fe904aae\RobloxPlayerBeta.dll
Size 20.5MB
SHA256 70fef3820d2b28e6cd461c067442ecda3141d6476d20df75cfcd91c99db9696a
MD5 b32f96195cfd6001b9c0fabb5bcbd2ae
SHA1 6ff69b37841a2d08b4e5f7bd436b9351aaabec94
SHA512 1a0870e9f92786684396887ac18fcad2b0e28c863dc2406856474518e8100e36ed44c7c1143536cac341ea7fc20d099a6037175f9c8237e71cb0f1d2724f4748
SSDEEP 393216:AMvMLGcu37/rmx7iYZWwTEQezGw1dC0vVaSE:AMvMLGcu37/C1iYZWwTEQezGw1dC0dtE
TLSH
T1C427BF4EF5D20AA8C5B15070E01F6BE7DA27308C5AAC6EFB42D80250367355D5B4AFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
Size 1KB
SHA256 7562629e60289d97acae669c532681987590015f1feca75f94872efe67046b87
MD5 01addae5dc92404023bff46572981e2b
SHA1 6aa31c4bad74d7aa5cffc50584acb60234fc055e
SHA512 1d71fb2ce7a3a8603556337eb4285fe4fc60265ae9d269bc0c36b6f96c4a43e1bb133d5889a85a3ce03d05306b7cbbf87f8e7cf8693548ef9518f26cf28fa400
TLSH
T1F021FE144FD6073BF1A38A3565F40252F7B2B941FB191F6E004413491416945B56CF2F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

080c1e9d-81b9-4c04-a8b2-f805e71970d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\080c1e9d-81b9-4c04-a8b2-f805e71970d3.tmp
Size 649B
SHA256 f17e004edb6777c7b5ed43f12d66d28fefd4298489d5997b15f05c87bed5d6fe
MD5 074e670296f7588685df0236e05a4764
SHA1 7b384a3bed25f66d8a98cdd61cfdfb17e842942d
SHA512 c19d2a1f609f76a0323ae1103eb8029364e2f628e8e39c226ea286d868ae66fc3d818e08a5ede5c0e65e245183de2df3902ffe0ceb9c44cc3d61d9b2e5827620
TLSH
T169F0A9AAC921AC2714FD1B1970A9574AE79113572780845F3B3D560D8FB563B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec05c37edbd234be05737f3cb11b40409ee47a4deacfc4be1016b0775318236e
MD5 9cce4fd265218d0e84469e64eea78443
SHA1 71700efa2369f591ed8cf5ffe8d9f8feab74b463
SHA512 3becfce6bb6e68ff6b9af19df037c4fe25e9a962e96dbc15e7a6bacbd16271951f62ae418ca97e46cbc38bbf9b15b21ad7dcc5be24cd0a85ceb8564a201d067d
TLSH
T14D714D0501512F97E3314D31E4F022357A70B38658E31E78634499F86A3ABB3FC639A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 f6614ec7466adfa9700b81dca8c61d7f811be066fc8877a2e0080ad6cca004af
MD5 74ff36a90e970304673a6172867d314d
SHA1 ea2d0c0abfb4046053b4d74453488ff2f8df56a6
SHA512 15323dc34afecd87ca975cae440265a23a330d6ca9736d16622ec78bf4c5228ddd5555df1f874b2607158d23ddd609ccfa1928929104000237d6e25698849d31
SSDEEP 192:oK0HY2KThiOgpWytcKXG6kMtalf8YImTUeE:WZWzwRXGZMQlfdI0Ul
TLSH
T1C3F18A331082DF53DB341A3D95E039313670EB454C939FE69F065AB42E27BA6E9C2C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d135faa1b9c685fba63fa89245006f701d470f75754229ab92d6a637e68bf007
MD5 9883cb0da699b3df9f76ade08a040c32
SHA1 2d11d0e35df8fece6acb8fbef593fa7cb63d7691
SHA512 8b0b11f5f69c9a758158000faf728e60fa106771df120e54d8b344e40deb491402ea4407e94c2da12fe9ff96dbee14a010885a97c3ec88182e900f71f2d3e255
SSDEEP 96:D/O1yFlec8qOaij6RzBGO5HHLitjBs5tvtfqEBZGhMvHxnwf+:DW1yFlec8qOaij6R175nLitjmtvtfqgz
TLSH
T18EC1BCF383F9822DDA1196F0AA186E1BCE1D0551436C3D5A85E4BF0BA3F2471E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 5064b9a97527a277114678db92ee30850e87388eb4b39263e752f5ab39ffc252
MD5 0df73d0e3075527c78dea811fa103ec9
SHA1 fde2af1339cc3abeb027f94e2ca2702f44757597
SHA512 1787b935c6c9f500befe60ec5532592ab67bb71eb62af9a2d5911699f41a56b1b96c2a8f4107184323c2f9b5a59870b4bb4f008c5fff7ac89743ef5d760f8d66
TLSH
T18AD022A39242B0B9E7EC3E92406ABC8FD32700600843DEE911D4D99C16358BC9A2B282
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 de6c9ebcd7ac645a0018b8edeeac7dda4bcf3535c37e4fabd77fe40650be3473
MD5 63fd108f7698a5a2344fe1bba7459c69
SHA1 cb1d77f87ab9403944b661cf4245daf231a392de
SHA512 be47513d467a198c6f16ada81bd6812ffb67a1f77bf0833bd1f76da9309c845cc6c1d3778bbc535e0b462f5cdef09819de754c2cee13e2a57d68766c6f3856bb
SSDEEP 384:sxZRnlCEm1Z/fls8Er60Ly8GDS/bUw/5TXj4N/nXT:s5lvm1Z/fMO0R/bX5gJnXT
TLSH
T1ED9218126524897BCDCBD619FD257F63D7F90062D9854E4C9AFCCA0C04EA6ED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 14bcb38d728318ccb34e0254afd57e1dc61702d6ad651a6e9f9bdaf3bcbc7785
MD5 8b5b63c39e3c79796e84df43a9e9a9bb
SHA1 f51c3b2e262835f34b84050a92a9d7f92caea683
SHA512 37401c08f470be689967bc1f61912564f1f71cb406c3e378dfd6a58a32a064f8021d2b4920043c815d93e08b3739345ea1cb15ad5365ac76d6660601110bc456
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3N3pQLlY:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKN3pn
TLSH
T12A031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 3KB
SHA256 5d2085e64a01313ca21d772401e706b90034d8c5032846fcfb0beb9ebbde400d
MD5 97cad121ab684e7f3d9947c96c122ea3
SHA1 237bde2b4f6a4791acaa4b7362c8ec6d8f5f54d0
SHA512 eaf186ebea4f890fcd9c35c935a6302ac44b91d936221bc1f90be95dd65f7b517ad68d6ce840daa5a85506bbd12a932b5b8a95defcc5a4c2e0e759872f8b99bc
TLSH
T1A351180D4E472596DEBC02B290B3080437B996CD3B01CE2744ED1239ED87B5A3C2C33A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594d6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index~RFe594d6a.TMP
Size 2KB
SHA256 ac11265f5935a8bcba016f417a88596921b197a58aab1945ba7ef500dd3745d2
MD5 86165a6ae99a5ad13003f0e1ca4242af
SHA1 f82fb74d17575976172e0da8ebe28b87fe57608a
SHA512 d5408cbe3c24ae35c825aac210668e5d0994993b806b8addf7cd945ceb9e2289ec23dde00ad43e74eeefdad031e39638fe326e7b4bf2defe99616b68a326af2a
TLSH
T12951865A4D824639E894417709E3A4A437391900C719BF5374FC9632ACD27AE3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 e0450c4abc647808599631fc69dbed985861dfbe5b09abd1eaaa87dadfe15bda
MD5 7970f3ddad3d68452f593790eeaffbee
SHA1 890ba6010c16bba375216b17d46063ae9bb91dc0
SHA512 a6af6bbe92717fc141a55b825178c8af4286efc977736b8b3602193619394cfea3da3ed55d5ae76a44d68e2d5779230fe5c802114c62723e4afe02dee9ebf5b0
TLSH
T170A0026202C0D60BC1031EB42592D557F6A2DC900701230D66E20086CC545C0854A10D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592234.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index~RFe592234.TMP
Size 72B
SHA256 20aac31b338fea12536ce42228181fbedc58dce3fd3f656277fce849af739b10
MD5 56a5d61895065646cd6aeea2157284fa
SHA1 73cd5b3004eb55bcfbdfc00e34c95a0de182e575
SHA512 dd3b2c630b019cbcc7591e64c173f64ddb664721ad2d8a0b08338e19fd8282651884cca69ebd61ba7af9c19ecda887c48b33dc631456de522406f0c54d4327c8
TLSH
T157A00454DFC00407C01311F5555303413340CCF415441F0751D10054DCF4545CD4144D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efa5fb9a-837b-409b-b4ae-b9ffdff33476\index-dir\the-real-index
Size 72B
SHA256 17bfe36d01c6af66623abba2bcf26365e825ba9d760a63c45579343569ac0900
MD5 43be90634ca5a746248ed2a7ab150b3e
SHA1 c8e5a9503eae12e4eb66d08b6a14b47293338d88
SHA512 f4b254c52d2e00e5c1dcc4e2d944580abcf044c525f9f5724018740cf436b1b54561538ef881d320256a68da43873c6c5d2e1dcbb208df6a9f5badf9792da576
TLSH
T1F1A00273417464C5C8018ABC539301597316AC150503531DC59437D68C651984989244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f93cce08-7564-4ff1-a53b-e2b57991a335\index-dir\the-real-index
Size 72B
SHA256 ce3f9fd55dde1ff52ed94e605d659de31cf38d3471d66668868f3d8a2ce40f7b
MD5 838705fd7243773a83a8243451ab4f8d
SHA1 dc3d9e026f3fa748841f55a0f66b090b2ad1174c
SHA512 a99a28d94c23161eeb508358dd2cbb0b89c481ae7f6d23cb64a891716fd30a16b56c49fecd91b8d3e10cf703747ecb067f96466723207672c2eac965e5c26ea7
TLSH
T122A0021585C19506E142537BE28309756250AB30B152124186F2E1F49CA13E06609162
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59210b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f93cce08-7564-4ff1-a53b-e2b57991a335\index-dir\the-real-index~RFe59210b.TMP
Size 48B
SHA256 439133bac51c0c26b134ff744444c69b544c9f422e2ca3d0ca707ee5d05d3b68
MD5 aa82315a9152eaa748a2dc9e807dadfe
SHA1 18d0cc7eb080de879c6e094bf1b4330f5ccb64ba
SHA512 a19e30849a38bf45f285504703fe3fd4f97a04083ac124661fc6baad786b5125f878ae913c94628909158dccfcdc172e7e35e45cfd0d405c045d40bf39cc4218
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 deb048fa7366151f4ab2d82c85cac961edb8a981859cadf3530df1d075ef4fc7
MD5 63a3162d78155b020dae6288da469552
SHA1 3057d70dda0a70ff93100369adb60ec4f1a0ea18
SHA512 44e3119d6a1a5fe77b823f02137854bb3daff4b57d6e0991a5cee6d91658382272cd33f3717795583500409d5c4e5c7c8f48a0d55f710b362fea929c62f6a050
TLSH
T1CDF027B33EE72858F86B87E9207250A40010F888E4A5EE4E252671E6D1B135A1419CB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 780b9e1db8b6fffe6e4ed0e51755f91b0a82534b7b4985e6d5a9e1ecd143261e
MD5 5291c52b21d6f1511884ea0afd6bbcff
SHA1 a921bba2cee1a0c62ce26436c90180e87bc2f604
SHA512 8923eb3f24d65c6254c7a3c5fe8d68512b2350e514df9ed136cc219b63a787690a5e961d6569ddc8f0ecc3896faac48f86b1de2b42ecda1176e3e01b7e60c814
TLSH
T170F027773EE72858F86B87EA507250A40020BC88E496AE0E542671E6E1B035A1419CB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 85c1b546ee0e3d3807f3c667f7b45580d761bcebfb91d1c0ea5b91873f7dc28a
MD5 f495e7975f7d9802638a8a095614efd3
SHA1 a6413f44228df4ae73cdce3e72abd0b39665f3cd
SHA512 5b610f0d80881341289c7d8d2230cc46ea5b83f7a8552626d159790652bf9140d3e5b81a6a3642fbf1d62d2e4b11a658cd1121ce75a7f8440d85c699d18f5bed
TLSH
T1EDA0021391543041D6000274B44E0688731198D00685223AC5E4D556E9D1354411700E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594905.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594905.TMP
Size 72B
SHA256 49f50be7aa76ff8692e660222e3d4b2a5702abc8f835ca7907894de3672344b2
MD5 af585901ee0d13b1decea1b923b04d48
SHA1 b8adaf0470a23c8343d89435b8ce53cb0070b528
SHA512 694cccf7ddeb488c24c8ae0f44ef709a8eeffe192ed6696f4b6e38a1a5e52ca24095af50ec7423531a28a2cb09c283ed9ba3877c29512b0112a43db7636631c5
TLSH
T12DA00226874D241DE41015755107D3712340885E0704132785D0E598ACD10425575189
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ae9df14b41deaa75a08f58c68559d30f02ce7b257ce99de80556a0d5383b4e1c
MD5 9b6df0dca8095cd2b7546eb9a17dcdd3
SHA1 54dbdb6a44dfb672d81fdaebd9708047d46b60d7
SHA512 33586020350c1bd4ca9db222423eebfd99d88a248be401635ddd91c1ebd4afc1147e04779e2d382eff4ef9741e32ef3bae11762d07b70692c6bb7ddfcfeb620d
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7aPq:AFBHhTofhno2mB21q3Llbfe3sLDdeEpF
TLSH
T17AB29F56717B12423C3D291CA6919B370E8272A3345CA57F77B800BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9e97b2c3f1ba58bd1c9edc4e77c0fbb8744c0f59a70e7409eccf793022bb8047
MD5 8dc62062937a84b1400bcbcf1a84484f
SHA1 21a581d999a262ad483051e6110ae7b8c6afafe1
SHA512 42c163c9a4282ee65da02b14a2fc7a304d2c084fd58c69bc2913bd0575cbb9b9d244787411951e7854beeee958d9d4a02128f633e95291de55263b1aedb6adc5
SSDEEP 384:n5OiF1tNnNnb9238Nl8TUNTUlIRFTcl52jjf+8ogBlnOXDqfNcLHy/7Igtk:jF1jZbE3KwgaQogBdOTiZk
TLSH
T130D25A32D8A4CAA7EDE75F99A34ABA07AFE40197C58C1ED4DACC5E0D00C719C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 73fe17ddd63a7a52f7bdd72ce38d71fb250a1d73e2be75143f44cb50550aa537
MD5 366e0ec17fdc24508439828f3c52d59c
SHA1 1266f337d9c7464eba5161be53af9c7ca4e9fd3c
SHA512 9827e519d47f2e09406b607798559a28c631535035bfa42210d1c3405999bedcb065a31af06372768d4f65e39f81d4e0f041fa0582e0a4f5120cd2909bfc57c2
SSDEEP 384:y5OiF1tNnNnb9Y38Nl8TUNTUlIRFTc3Y32jjf+8ogBlnOXDqfNcLHy/7Igtk:+F1jZbm3Kwg93QogBdOTiZk
TLSH
T189D24A32A8A4DAB7EDE75F99A34ABA07AFE40197C58C5ED4DACC5E0D00D719C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b2dcde480813f98d2ab4b119bd88fccdd5f9ba0a87edcdedd3b9aaf5ec407bcd
MD5 ea5138feb3b1a42e79861fb28e87559d
SHA1 f8b2c4c54954c772555d9d20b2cdae57c6d879da
SHA512 d66bf7fb242b1b53b5c2c89355aed4064acae46a35177acf986a97bad97e4b32edc510ecda8688520b51e8ed45364a4e6ea550795fda2741775c82a0316c006e
SSDEEP 384:yeiFPtNnNnb9w38Nl8TUNTUlIRpTcn832jjf+8ogBlQOXDqfNcLHy/7Igtk:8FPjZbS3Kwg53QogBeOTiZk
TLSH
T11BE2B3F198D78976D9DE4B87A37D6E06AABCC193B4881990F7C85D0DCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 dbb808f0316b12bec1fe1fb77cd202444e75f7b705863db24fcb9ba3bfbdaa8d
MD5 1f9cbf324ce80950bfa67a85bf8c6481
SHA1 7b590a1176dfb36979f34dfe399f35b66be900eb
SHA512 6dac4a4a68183563d5677136b9d299ad8aa3597d1b2e15aa62666ab5823422d98c3ccac39d066e4caba4c30734c16d57185ba03aae3e93284cd9269c4f5b134d
SSDEEP 384:yEiFKtNnNnb9Y38Nl8TUNTUlIRpTcnY32jjf+8ogBloOXDqfNcLHy/7Igtk:+FKjZbm3Kwgt3QogB2OTiZk
TLSH
T1BAD24A329C94DAA7EDE75F89A35ABA07AFE40197C58C5ED4DACC5E0D00C719C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ef13c50de1bd77ecfbef28dddd1a67e3649c71c81bf61c7ace0d4c85d5822c1b
MD5 52986e45b7f815a32b5145961d219d24
SHA1 4b069696f10ce8f3ba8b6b1d8cd62ec22bbe3abe
SHA512 6faee98b959477b667526f31645d8115183751818946604ea94c2f5989eff23632b8271e39291a726eac046e2a4f32081f811ae9d809c5c1670faaf0dbe36ff1
SSDEEP 384:n5OiF9CcmyWC938Nl8TUNTUlIRHTcR52jjf+8ogBlnOmHy/7Igm:jFccp93KwggQogBdOm
TLSH
T19AB22932E8A4CAB7DDE75F89F75AB6079EE401A3C58C99D4DAC85E4D00C719D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0951372cb1ebf68e95e90ed2d98c289bd2b32df80599a652eabae68a6c2962f6
MD5 19e7f42936e934643ec9a30707b07f05
SHA1 4e08a76867de71d537fc1a73d95007161600fd82
SHA512 821b729929fee7f67721c380d9bf04cb231962dad29f9cfa7699b93ff5d5c6b1ad6d422096591e80734f6eefc6fad1aa9efd2681dc561cf22b92ae105c1389f2
SSDEEP 384:yeiFKtNnNnb9j38Nl8TUNTUlIRpTcp832jjf+gogBl2OXDqfNcLHy/7Igtk:8FKjZbJ3Kwg33EogBcOTiZk
TLSH
T17CE2A2F198D78976D9EE4B87A37D6E06AABCC153B4881990F7C85D0DCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2616e927dae8ff12b7ec5834d6a6dccf92663d42a3161e7913ad22d1a9b35d69
MD5 ce575c229fd19b9c83dda48322d5b23b
SHA1 e9f1e14e27d4eca7fb1fe9b6c421c2e37b5968ce
SHA512 38e887854bfddb6c9ee8bd170df47414117d8beb8c086cee9847066d463844de2f780e7e41f8d98b655e2bc2e53de60aa426307e838b3ef77dd31b03e9df51c8
SSDEEP 384:n5GiF9CcmyWCs38Nb8TUNTUlIxBydv1oCajjf+8ogBCahkP+lFYS/t2Hy/7Igg:7Fccps38wgcPMogBCahkoFYS/u
TLSH
T124B24A36EC98DAB7ECE74F99E74ABA07EEE001A3C19899D4DAC81D5D00C719D134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c4703280a7a8c96b34007a2ab9e6643fb84b9992242366cb6e90bc7020192fca
MD5 39c227de9811a18d01bf74b26d829a27
SHA1 deef2683fb90d6f4d0bd57ad9605ec37d0c794fe
SHA512 0a3459bd705b9a0f9267748b48d0445d144e069608dd25c0de4bce4dc2efaad7bbe95b47c191a73d48a8996a48f0ce0d4f73e2a86167d0ec11090b57ba0d38ed
SSDEEP 384:yeiFatNnNnb9X38NLW8TUNTUlIRpTcP832jjfKgogBl2OXDqfNcLHy/7Igtk:8FajZbR3QWwg93IogBcOTiZk
TLSH
T1CBE2B3F198D78976D9DE4B87A37D6E06AABCC153B4881990F7C85D0DCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e1b7124ea5b99168a7c0f38255c1d9b159f6dcd7ad58dfe2b36c7aa7151cc161
MD5 5cdd109a8040e21bbe10ad59dd44c01d
SHA1 4e86f63587bb4df574e3437cacd33d832190f6cc
SHA512 0fa11b508cbef9eea983adfd9eea4912917fa47be8d30cd5c27d91259af6bf5d442d54849081f1178000d89d6a8855095ca78db53956fbbc9c0313763fc44589
TLSH
T1E24130E15C3D29C1E0BE0EAF645B38FC91ECC32AF4A4307D2848EAD8467960D654047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 312915e852c0d8a278b9072554e7626d400f794273323aac80a222307cb583a4
MD5 03e1b16d7907124d1cfb59f1a4e62dab
SHA1 4d4dccee3b1ff842add9d12909fc800793fce13f
SHA512 82eaf2cc57c270575640c2509d4cf8a876a1fe724a963f79ad36c6e674e9fc2c5c97ed76c3f9089050e1056c40ca51e316d06174df15b36103c6b7d837c367a2
TLSH
T1994121E15C3826C1D0BE0E6E748B38FC81ECC71AF494307D6858EA98457961D658187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a5f7ffbb77789f5764765a8d26033c38c45df287480a7a952c37ba8c1e1bb594
MD5 1f360025a2a9a97adc278c5389e7721b
SHA1 40e4f7e4cf26587bb884794caa22b77fde4c7dec
SHA512 0f896419de50a0fffb886cd45b6487c4c1cc903608e517987c56f817637d5147a45fbd2cc1c0912c4c5d8ed592d0951e19f56541ad002ed91b03ba8ce31a4eee
TLSH
T1B94120E15C7C1AC1D4BE1A6E608B38FC81ECC726F4A435796854DAD94A7961D248087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 96b5930462ea41ffff9664bc8afbfc3826c4cd6c5bc447156d03d7a31a15eb08
MD5 e176b77b21caf784ec5805de00033ed8
SHA1 144ff20eba5143fabbcc2ca998e0a5b699e02d0f
SHA512 b710807d31adf651a8cbd1a33c764e5ee2be65e82e703a31528d2307c55ec4ed7181bf23ef7ad5f89310af467bcfc2be3abe24aa6e429a408c5a09aea8a9a209
TLSH
T1194141E05C782AC1D1BE0E6E608B38FC81ECC72AF4A4347D6808DED94A7961D658487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6ddbd8b275ea5150e503a5e2597f67c02ce91e2886dedf8086c370a50f69c3b4
MD5 8e184da2f323e2623102f5a3b43223a0
SHA1 0382b74e42d1da4a41b0c66d63e1f74bdb55f08b
SHA512 30004ca37773b0a8cf98a1dad475405f2a8f640ee6291cc5cc74cb6452c0590f8b8dd6fedcfd7e69d24c553a96b3d0ee8e6e38f56c97e50adf0e742463e3ffbf
TLSH
T1784131E15C3D2AC1E0BE0E6E759B38FC91DCC31AF4A4307D6858DAD8063925D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6bac4ab157affd984a3978157d63e26222eeb9aff4004b024e2795b824b908c2
MD5 36325de289f758c70d8e77f56473113f
SHA1 2bba3af91a76c159b262a4a3fdc9fa50a70b1727
SHA512 b05659ef78dc736f015d544f243770d96518406c01bf6d2e1548268da8c0e4ad6007042327a9889d43fe1efb410f4b30f0530c0fc35542b036c3ac24df63bf52
TLSH
T1214144E16C3D29D1D0BE0E6F645738FC81D8D32AF4A4707D5448ED98057D20D644187F
MD5 SHA1 SHA512 TLSH

Submit Download

00918969d3233eb730d8cab805c9fa40

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\00918969d3233eb730d8cab805c9fa40
Size 596KB
SHA256 1918764300ad66f3f2fd182710eeca97b2a2bf0e46e585c2ecaafe4d5e2bd60b
MD5 00918969d3233eb730d8cab805c9fa40
SHA1 74721f843b7524e930ed6b66a260980324d8443f
SHA512 470f6f9d98fa6323481fa5070b0fdea6bd2ff05596281b0485e2febd25df563911caafa737b7e11b4da2591b301da03d2e5b080267c33b362e04e415e07849dd
SSDEEP 12288:Ahb8APlk45ycKfBxc+3NQRpl+76skJPLocptwiya+lPINsbtrOqefz7:AWAi45yBcW4MLkJ1P+jY77
TLSH
T1C7D433B1B9302452EA32EAC2465A3EC12274D0DD3712F712E6DE7648F18FE659047EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03531855168a8f9562865422eeef9f99

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\03531855168a8f9562865422eeef9f99
Size 320KB
SHA256 b058970bbb09c3c27dd0b9102986ea2d3fffccbde7719fc8b780c462e23c34e2
MD5 03531855168a8f9562865422eeef9f99
SHA1 34530033f9947f1c50447310a67a288f9a2d5f0e
SHA512 c12214459c7a25bbf63b58d8eb6b2c01c0bdefdf9408838db63e216272a8cf8e8bd49510326e0a964ff8756f0572267c9887e47f791672a2d4b7f15863c8ecf3
SSDEEP 6144:j7bhY6n1UVvdL3rfcYOjnGgBeEOddgaI/wbgkJ/H+F/s7Caa8sjGOFisP:vxyrLAGgBLOTPIo8kJ/2STa3hFP
TLSH
T11A642339D90248EEF29DB27EF89B6533AED4134708A2D52F63969074063F3CB617AD04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10461fdfb35f35cca13dbe35dcf21343

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\10461fdfb35f35cca13dbe35dcf21343
Size 3.5MB
SHA256 73c9d9a9333623a070ccc1e5f6cf325d83f1ef9ce35c4d255b66a1733f6e6a91
MD5 10461fdfb35f35cca13dbe35dcf21343
SHA1 42806bf7d078a0dfeb1e462bc9e5ad6e90159b7e
SHA512 15b6bc4c957ef618f56188227bcffdbda3ab990ba80362d3fe89f97e74a01763cd46bbbace7548d5a29244dbaa842da0c7f9e449b2df715f33b708a5a629d3ab
SSDEEP 98304:LnvauOC4zP8kaSRljlFUkXqUU3aSpTMKK7d7RSktipIWcLEq:brOCuP87wlFUgU352KK79toIN
TLSH
T107063389920D485BD1FD213F4523DDB085B8315CA803CEAA28DB867C7F6A89DF13E95D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

134043195b2e0f35ceaba25286995831

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\134043195b2e0f35ceaba25286995831
Size 344KB
SHA256 cf2c6920cb3d42caadc2e41fd5a8a3f4be19c67ec0a016d8423e5cee69bdc1f1
MD5 134043195b2e0f35ceaba25286995831
SHA1 a9cb223ab1ba3cb60ba1adabf91d849f638147e4
SHA512 427cb3992fa7b21a5de816661e02352629cdcc676dbbda590df293e153169a5e907f50cfa5a96d4dacd6e7d53d5fbaf1b5b29054ff739129d75ed247f11b48d3
SSDEEP 6144:zqOxP2geNFKHP/WEMK+8mmI2nZRNpybr9baryQF0+fPT9j1K+l5Xo1tjrDgwA:+zPNFKHXknFJ2nZROKyQWoxU+UvDpA
TLSH
T1CD742315B2E6F16EE93C3755012A6BDF10673F02621A11DAEC84B3D38B08E7D56CE366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0390337d1a4a58e5514be1a9481ad6

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6
Size 2.3MB
SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
MD5 1d0390337d1a4a58e5514be1a9481ad6
SHA1 0c09b611223f335af2a42dbc371dc95ba4f18979
SHA512 382e5d7a61398d54bf15bcd928ec7755817fe92a860840efac6f6417229678cb1fd1756c5a7c82e02754a23732f63882c4a640bc6d73d28f30110d0028ae6fb8
SSDEEP 49152:DejtLQNcZOH6b3nbU/s3lgwvTS2sqQFIPg8Fb5iLcWvFXO2+xPh83+H:iJCcbz4/YlgwvLtQG4mULcz2s583Y
TLSH
T132B53399FB0A54B7BE60CE1753CF779A7F1882A510A033E7CED7ABFC1A79A404521406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23f17a63fa3341ea980f6fb9ad8cde5d

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\23f17a63fa3341ea980f6fb9ad8cde5d
Size 297KB
SHA256 01f7ac02b99b278bf5d4d3898869287b60c87ac811d888043c671699877f57fc
MD5 23f17a63fa3341ea980f6fb9ad8cde5d
SHA1 7070e86401bf3567d1b6091ec331b5ed3c38ab0c
SHA512 2d8fb44da7004cfd1c5355693b9f59e191e6670de91ec1a0fa7bb2a0ee94ee81e9ba95291b9aab3126520d10c02055f4ea7152970242403076530087421ff90a
SSDEEP 6144:6vzbGEkFlF8j41TS+uvUrx2lDiDWVVNys6OlgMyRWf2/1BA:6v/Qz88ivSyVLQMyRWN
TLSH
T1B35412EBC44644BFC173E7BB32FD2821814868B75102C85F6F6622B82F5B5D75B1B1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30c39588dab30ced91d7415d4fa4f905

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\30c39588dab30ced91d7415d4fa4f905
Size 2.4MB
SHA256 f34645ccb79e62bf4c3dc38532da5e9dde9ca6e026f9d5f531a10a0e03c144c0
MD5 30c39588dab30ced91d7415d4fa4f905
SHA1 d74ccfd40f5122f0e865cb285e87b2d4feb302e7
SHA512 308b4558607a0b57ce471b346270b91f58ca0949543f85032a57f0fd63bf1ea8052eab6de3e43080d1bb2a4b8e8cb99813287a165cf04de60b1cea54245c2d72
SSDEEP 49152:znlChfrRt5Ur6cQ+IP3f5sI4FVrbOjBenUofSqjNUTa0+lN3ms/cMCvIt6C:bleR6zIkrSLof9jNUD+Xb/cMCvItd
TLSH
T11FC533D8E9813E16D03F3AB6A272BE01847A0633E8E4DB47DB7C15B498C1BC71799758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b61e26fb82873a3ef66aeacadbaf934

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\4b61e26fb82873a3ef66aeacadbaf934
Size 14.4MB
SHA256 b617bc3e2a475579ad4ebd80d0df9c7bfc66ebd8a484bd0b6237342810dce5aa
MD5 4b61e26fb82873a3ef66aeacadbaf934
SHA1 f9c251c22cbdcc122a2fc51f87adbbb93e24274c
SHA512 bf94994aff0ec3f02c72101fe97ac678544b8bf01677e10422a61f682c270d49e135d033ae35248fc9453c9fd45147bee1f95d4d9394a6f3b1f85ce37fd40e14
SSDEEP 393216:H3UMyWqXzXFdsViwayE1LGRF4OxVrrwkOiA+xA:XofXJdm+G/ZXrNlzxA
TLSH
T1E5E633DFEBE9C9CAFE820EBA45534ABAB9058D4B81D0CCAB47DFC5E7A43244D054D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

696c5333bc5c2d4eb55ab2a9e417eb5f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\696c5333bc5c2d4eb55ab2a9e417eb5f
Size 127KB
SHA256 3af392da79ffa2d0032e4f5cd8171980d39bc3efcda16bfbfa2a0c53d26e04ec
MD5 696c5333bc5c2d4eb55ab2a9e417eb5f
SHA1 f65eac9963fb81d78e079d6a3ecce5b2da2d0ad4
SHA512 24e549884ce4a7f86b692ecedafeafacd267d3656b7a5a4d4e224868fac5523d309cdb58ba4e7c388a2de75d1c39395e6c519438836915f0832c09d74a18b43b
SSDEEP 3072:3V2Bk7YWRsKohFyopBzW1AT3rJsYcEpv+KBXmBkSuGo:3YBqPRsnRq7Ybl+wX0kn
TLSH
T1DBD312783C789057E617E00621AF9233F53BC9D4A2B023D99A93D79721183F25773AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7071af81f7fad1d26ec29b7699f2d96f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\7071af81f7fad1d26ec29b7699f2d96f
Size 5.7MB
SHA256 21f2759a5148c427118911ae402be2a2def56f29bedbd33ace3ed2ed714422fb
MD5 7071af81f7fad1d26ec29b7699f2d96f
SHA1 0b0d2efd7915cba61b677389858e4a1b3d896699
SHA512 966824925a1446316197f19616854318a76047c1a20af4bdc34f41dcec60f7a93d68f2c69578be830c886610d094df90cbb757450549daa5e7a3ac43665e0fe0
SSDEEP 98304:MPozI9K4jo9oagQ0ParlUCuJ9P3Vt3yA/owp7PcA1VyzKSpPd7ibGGg5caGctpTc:Mg94jwoalYarlrG9P3VEkx7PcHf5xiai
TLSH
T16F5633D0AA7B040AD1BFF6704C2B1F144E998299093CED4E5D25D0B989D74F763EA8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f379ec2b22ff106b837d79f7fdbf0d8

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8
Size 13.1MB
SHA256 6620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
MD5 8f379ec2b22ff106b837d79f7fdbf0d8
SHA1 977223c04f192d8a157603c1f18d6d6a301e88b1
SHA512 1aa837f64e2d9652221ed5bdbf78c353e04a0536d09a3502a230b7f2f034dd404bef0e1a4ce57a42cd03f860f64965d94c2b638aa0994a3dd41fdbc6d751458d
SSDEEP 393216:DL5briJop9j7Yl/feBa5tMaNqGOGwdCUQUJ9Y2Ondq:npWJehYl/DFNDMJ+2Ondq
TLSH
T140D6339AE0F53A5B79933C7526053C970ECBF06BB59B152C24EB0452C2EDFF67401A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97327884177381d0f42d428110b4c516

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\97327884177381d0f42d428110b4c516
Size 3KB
SHA256 b8d4802f5c25d188268bf6a3a1c72a00d56a7b3f7fe64bb7f5fc4d6e8f6b8a28
MD5 97327884177381d0f42d428110b4c516
SHA1 f1486a304c7b458dcbaa53836632d723f0e87505
SHA512 9fae3ae92fe1073f7e720eb6da6ad99c19bbcdf6caad9408feff07140d5df9f845f0e5f652ae90a87185bcfb0a90287b4e0da174f1b0ea1e7055cab16baef369
TLSH
T1CB616CDD8D95121BD31F963354055E668C7FAF2AC006224F30201C2ECC0AEDF9148B7E
MD5 SHA1 SHA512 TLSH

Submit Download

a7051d6f6dcc7ef12b326f1322210d7d

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\a7051d6f6dcc7ef12b326f1322210d7d
Size 4.9MB
SHA256 441986d96131c4ce921ece93763761e226d5c49f4f126421061372344a84cccb
MD5 a7051d6f6dcc7ef12b326f1322210d7d
SHA1 d76a6a3a7c6c70cbf77f7bc623b7667bd60d1536
SHA512 30de337a600f998d9572d3cb33f5d70c8be96bfacbedaf0ec16b6359acf85b17a1c218d4b1a78f0b971c2d28ce32e2d616ac8cbc396fdae286e160a32d5fa5c3
SSDEEP 98304:CITdul3TFdExsVBJc5fqP6PP58ynUTufWGAtUcHoY4zxqY:Dgl3RYSitU6PB8iUT1vUj
TLSH
T1D43612FAFF7D493DC177973D92029811AD68641A9A2CA50F0829AC71D9C36C3DB423F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aac2b417eabea6376883ac2f50ff9c61

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\aac2b417eabea6376883ac2f50ff9c61
Size 775KB
SHA256 5aa57113db54296bee8f723c1a2a1d5cab5481c8064fb31e957743ecc8c20247
MD5 aac2b417eabea6376883ac2f50ff9c61
SHA1 1429d922b55906251940939d0c7f0c65cb6e2389
SHA512 9ec415d2900feea6ebb46e52565d66633fa3953ce740f7f94affb8eee565697708a4aa2118cad09b759827de8d8f3d3ae240eba9e6ef75a6be1571d7d439d498
SSDEEP 24576:oGaCZAMJttFAmgH0ro5yOs2zfhPWqozMw7:J/tq+oDsuZPyn
TLSH
T1DBF4338323BA178DD4613F9A4284989351C1CFF9CB5DE5C7DE27A1C2222C1B4F59E86E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db6ca3c9a51bd2bd3745a317889e1bed

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\db6ca3c9a51bd2bd3745a317889e1bed
Size 19.2MB
SHA256 238e17e761a761c584c1bdf77ef8467dc261d34ceefd4259a4f5fde2acd77e65
MD5 db6ca3c9a51bd2bd3745a317889e1bed
SHA1 222dab933a24d4c3329032eafeebb5eab86a5875
SHA512 d2261e0b22fa98fc5f2afe4ae4b2b0a89c1cef1d7bf53089a0564f91e1481b23d9b0da6f88fb6cc48a9661d9effbdf79b65532f37233f967327fab6536590862
SSDEEP 393216:iZOIKcVCkpZhMRtHaR8tN6oJoRvqG/9cRSWcEL17hkuL:0OIK5kLa7O8HLJoRviRSUHkc
TLSH
T194173356E7F68E75D137A436CBA74A105AD221C1E07DBC8BA14F77210C2A09E1BB4BD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb61feeae2160215cd0323223fac1ed5

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb61feeae2160215cd0323223fac1ed5
Size 6.3MB
SHA256 85ed66e674510aa960b35d46d7b81a06b63cb14303b495dd3641807bb23db3d3
MD5 eb61feeae2160215cd0323223fac1ed5
SHA1 9fbc78eea3ede60b867c6fc602f69f70dbd36498
SHA512 98e888319ce6c974f06b57652bea8d0cc2d81cab1476895ec68ec4e4f2140f4f3755ee64650ea473a7ac9885e2c7a824c08ed67566b6bb75a891206da0be8a9e
SSDEEP 196608:XRZ7Rvm4Y1p/NK3KqufSicEsnWJ9Int84ZC9hOU:BZ7Ru71prqJE9CpKD
TLSH
T1776633FAFE74093ED233AF3A6001A4526C268F5AD614511F652A64B4EEC33979F032D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb9dd4d0637fd6ae21747e6b6a281d21

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb9dd4d0637fd6ae21747e6b6a281d21
Size 459KB
SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
MD5 eb9dd4d0637fd6ae21747e6b6a281d21
SHA1 387c79caeee5a5a850e328f8b9ce812b5048cefd
SHA512 f9b87df46149f2fe52690e3c906ee1cfc92e3196b8db50210269312999a56b9aff354b1b5c74da192b37646dcee5305d8afde6d2c80334a484b1a8a375950b5b
SSDEEP 12288:CtpZwzl7szmrFyHHU8ibAQXgwntX3dh7ZVNx:ClGl78WKHebAKtX3D7ZVNx
TLSH
T141A4235BC725D298D9A2D17EE22215BD68FF29AD8010F52A08015E417FAE70D6FF02DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8265c3529379c7be67d265f6eac5426

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\f8265c3529379c7be67d265f6eac5426
Size 81KB
SHA256 2f3df5ce618935604358cf39b014228293524e0cec472e472f5aa7ac9aa94991
MD5 f8265c3529379c7be67d265f6eac5426
SHA1 b67724607adae15015defe3bf52684d842bca5b7
SHA512 3adf11c1f860281cdbd7ccf21aa6623514c7178e92be4dc742f82c125ab85e1580263569caadd12c61e456050694a7e71e3ae69c77f232d218c548f9942f070b
SSDEEP 1536:BvP9ZIqELBtsTZs1u++7JT32d4xA8ppYXFpfJ12+42tUES0psc506DrjHW:ZP9Z3Qb6+oj2oCv2UQ0e6DPW
TLSH
T16F83125DF691E4BCE54759FA88208130C8DBDF9838DF51C0BBDA7685D9C4208F2A9E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbb0ce7a795cad22ef0c116ae89f13d4

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\fbb0ce7a795cad22ef0c116ae89f13d4
Size 433KB
SHA256 7041752f10d5275ef1021afa12523aa9f5e534c0a2ff87d6921c1f70cc68b534
MD5 fbb0ce7a795cad22ef0c116ae89f13d4
SHA1 de628b71de98250fff03f7ad881f476bd9304200
SHA512 d9a6243de237597a6e017cb22c6250cb9245a566f8479e1446c909f86d8e5d2725599b73c535dfd4415b797ec051792572909f32c0cfcbfacd0aba1ddb9345de
SSDEEP 12288:kWoEp4kmwpJpZMqvykVpQog/BCglTCKmWTXU48aUB0o5Lw:kWajwpnZfyoJMCgl2Kmev8aUBz8
TLSH
T11C94234C5DB1ACABF415D3F98E709F8885007A4A8F5DBE4F147AB1EFA7012B05B9C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 58002a69268b35dcf8015bd7ea8b08da80d0923ec390be411e1d986715a0b4bf
MD5 08e128d89e81c27794d41e8e380f10c9
SHA1 605b524f79ccc54a93aa335b6b989df696752d3c
SHA512 61615834efa3fab556d943116f92dd71766b476a16222ffd23848469ea1c1faf30137b543e4812dfabf6ff33a7b262b8f82a4a25efecc1dfe53b9a9eafe229bc
TLSH
T11CA002F6234A4838FD06B5E15C9446161747025E112A5961D04AE104574F44D954496E
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 83031be36c5d53939dd60c96267c1935df2545a2f7a2aea62e9ef8c7dd12a4a7
MD5 1191ec457b85ed97f25894e17295e085
SHA1 7d750d3e659d47a32267fafc1aea34f7e8d703f3
SHA512 1a6c4a0973411b12fdb515fc531189eb15a6aed876fd52d30defa4593393b03b0227cfe6306a19cd31b6ab62ce5ffa163ee748415bd90f5432473c1be5e24717
TLSH
T17621EE549FD6073BF1E38F3569F40292F7B2B941AB191F6E004813091962945F56CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe.crdownload

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe.crdownload
Size 9.6MB
SHA256 7f34610ae65bedc72b181cc5987f3967cd59b7e6ead786dfc66928f5da77c2c1
MD5 7c953b760c6b18a3ede743e855e1858f
SHA1 f99c7434c18abd218f0ff6fdfb9f43c5b4b30a58
SHA512 1e4b82ecd3cdf0f8e5e9c8756c3e2dd6d9b9afe7f7fa920fa86d537f94bc6587c30527175f15d0e4b02c242e32e801f90ec9101fc19a62d3eec4dead2244145b
SSDEEP 196608:yjYEvWlf0J9YPKqyNaTywvNWd0liQBW4CCxzM:y1wf0JwS8d1Wd0lQRCxzM
TLSH
T178A6BF22F901C031E9C201F2A6BD6FB65D7D9A340B3854D3A7C45DB94A705D33A3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier
Size 63B
SHA256 c3ba8aea15be1f1bc576de72d2222828c4e44eb85ea5052606c9ff6a5ecc2e00
MD5 b3db788251ccf906ccf49f2401877097
SHA1 ce8fbf7c3acf84908ee5bb04a64718a700722906
SHA512 139ad9d493505c3e4495d9271a67a90c14e9e51472c8e9200608da07a486e9bce80315b9fe0db7160c818077c6de19819429167693bfc7f943c87d8daa228ffd
TLSH
T14EA002E74A0485142510629466BDD65CB14B69248D6581C4ED40A0E7A88046996A5957
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1159176169\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1159176169\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1519510975\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1897683676\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_357471908\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_404866177\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_404866177\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_843440266\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_88370884\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2128-1592-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1596-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1597-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1598-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1599-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1600-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1601-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1602-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1591-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2128-1590-0x0000016DDBF10000-0x0000016DDBF11000-memory.dmp

Download

memory/2464-847-0x000001D2380E0000-0x000001D2390E0000-memory.dmp

Download