hxxp://roblox[.]com

Analysis

user interaction
yes
max time kernel
94s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com
Sample260705-3rfslscs3k

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
89	2244	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
616	RobloxPlayerInstaller-MKRWXDHWXV.exe
2716	RobloxPlayerInstaller-MKRWXDHWXV.exe
5736	RobloxPlayerInstaller-MKRWXDHWXV.exe
4316	RobloxPlayerInstaller-MKRWXDHWXV.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-MKRWXDHWXV.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\period.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\particles\forcefield_vortex_main.dds	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\dialog_blue.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VR\recenterFrame.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VoiceChat\SpeakerDark\Muted.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\PlatformContent\pc\textures\water\normal_16.dds	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\9-slice\system-message.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_move_1.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\Sarpanch-Bold.ttf	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\families\RobotoMono.json	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\DefaultController\ButtonStart.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Settings\Players\Muted.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\9-slice\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-tip.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-online-14x14.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\avatar\unification\R15.rbxm	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\families\Creepster.json	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\models\Thumbnails\Mannequins\R15-plus.rbxm	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\MenuBar\divider.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\graphic\gr-profile-border-48x48-dotted.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\LoadingScreen\LoadingSpinner.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\PlayerList\Report.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\sounds\action_get_up.mp3	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\StudioSharedUI\statusWarning.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\StudioSharedUI\Undo.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\NotoSansDevanagariUI-Regular.ttf	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\DevConsole\Filter-filled.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Settings\Help\YButtonDark.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VR\buttonSelected.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_17.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\DeviceEmulator\sim_headset.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-90x90.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\SourceSansPro-Bold.ttf	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\particles\fire_main.dds	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Settings\Radial\EmptyBottomLeft.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\TopBar\Round.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\configs\DateTimeLocaleConfigs\es-mx.json	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\FillCursor.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\particles\fire_sparks_main.dds	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\SelfView\SelfView_icon_camera_disabled.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\chatBubble_green_notify_bkg.png	RobloxPlayerInstaller-MKRWXDHWXV.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\[email protected]	RobloxPlayerInstaller-MKRWXDHWXV.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-MKRWXDHWXV.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2244	msedge.exe
5392	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-MKRWXDHWXV.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-MKRWXDHWXV.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277686920519993"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5cf2272675e145f5"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-8b44d8f2067642d8"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5cf2272675e145f5"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{19BE59C8-20C3-45A8-8167-E94ED29F6CE6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{9BC7AF2B-68E7-43EE-BFBE-CB1E7014D4D7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{FD7A297B-6FE0-4890-8798-D61C0A48C10A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-MKRWXDHWXV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-MKRWXDHWXV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-MKRWXDHWXV.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	RobloxPlayerInstaller-MKRWXDHWXV.exe
2716	RobloxPlayerInstaller-MKRWXDHWXV.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4680	3864	msedge.exe	88
PID 3864 wrote to memory of 2140	3864	msedge.exe	89
PID 3864 wrote to memory of 2244	3864	msedge.exe	90
PID 3864 wrote to memory of 2140	3864	msedge.exe	89
PID 3864 wrote to memory of 2140	3864	msedge.exe	89
PID 3864 wrote to memory of 800	3864	msedge.exe	91
PID 3864 wrote to memory of 800	3864	msedge.exe	91
PID 3864 wrote to memory of 5976	3864	msedge.exe	93
PID 3864 wrote to memory of 5976	3864	msedge.exe	93
PID 3864 wrote to memory of 5976	3864	msedge.exe	93
PID 3864 wrote to memory of 2320	3864	msedge.exe	94
PID 3864 wrote to memory of 2320	3864	msedge.exe	94
PID 3864 wrote to memory of 2320	3864	msedge.exe	94
PID 3864 wrote to memory of 5956	3864	msedge.exe	95
PID 3864 wrote to memory of 5956	3864	msedge.exe	95
PID 3864 wrote to memory of 5956	3864	msedge.exe	95
PID 3864 wrote to memory of 4516	3864	msedge.exe	96
PID 3864 wrote to memory of 4516	3864	msedge.exe	96
PID 3864 wrote to memory of 4516	3864	msedge.exe	96
PID 3864 wrote to memory of 4684	3864	msedge.exe	98
PID 3864 wrote to memory of 4684	3864	msedge.exe	98
PID 3864 wrote to memory of 4684	3864	msedge.exe	98
PID 3864 wrote to memory of 624	3864	msedge.exe	99
PID 3864 wrote to memory of 8	3864	msedge.exe	100
PID 3864 wrote to memory of 624	3864	msedge.exe	99
PID 3864 wrote to memory of 8	3864	msedge.exe	100
PID 3864 wrote to memory of 2936	3864	msedge.exe	102
PID 3864 wrote to memory of 4460	3864	msedge.exe	106
PID 3864 wrote to memory of 4816	3864	msedge.exe	107
PID 3864 wrote to memory of 4528	3864	msedge.exe	108
PID 3864 wrote to memory of 3328	3864	msedge.exe	110
PID 3864 wrote to memory of 1408	3864	msedge.exe	109
PID 3864 wrote to memory of 3328	3864	msedge.exe	110
PID 3864 wrote to memory of 5104	3864	msedge.exe	111
PID 3864 wrote to memory of 5104	3864	msedge.exe	111
PID 3864 wrote to memory of 5104	3864	msedge.exe	111
PID 3864 wrote to memory of 5088	3864	msedge.exe	112
PID 3864 wrote to memory of 5088	3864	msedge.exe	112
PID 3864 wrote to memory of 5112	3864	msedge.exe	114
PID 3864 wrote to memory of 5112	3864	msedge.exe	114
PID 3864 wrote to memory of 4288	3864	msedge.exe	115
PID 3864 wrote to memory of 4288	3864	msedge.exe	115
PID 3864 wrote to memory of 4288	3864	msedge.exe	115
PID 3864 wrote to memory of 5296	3864	msedge.exe	116
PID 3864 wrote to memory of 616	3864	msedge.exe	117
PID 3864 wrote to memory of 2716	3864	msedge.exe	118
PID 3864 wrote to memory of 5736	3864	msedge.exe	119
PID 3864 wrote to memory of 4316	3864	msedge.exe	120
PID 3864 wrote to memory of 3444	3864	msedge.exe	122
PID 3444 wrote to memory of 5432	3444	msedge.exe	123
PID 3444 wrote to memory of 1484	3444	msedge.exe	124
PID 3444 wrote to memory of 5392	3444	msedge.exe	125
PID 3444 wrote to memory of 1484	3444	msedge.exe	124
PID 3444 wrote to memory of 1484	3444	msedge.exe	124
PID 3444 wrote to memory of 4264	3444	msedge.exe	126
PID 3444 wrote to memory of 4264	3444	msedge.exe	126
PID 3444 wrote to memory of 4144	3444	msedge.exe	127
PID 3444 wrote to memory of 4144	3444	msedge.exe	127
PID 3444 wrote to memory of 4176	3444	msedge.exe	128
PID 3444 wrote to memory of 4176	3444	msedge.exe	128
PID 3444 wrote to memory of 3692	3444	msedge.exe	131
PID 3444 wrote to memory of 2632	3444	msedge.exe	132
PID 3444 wrote to memory of 2632	3444	msedge.exe	132
PID 3444 wrote to memory of 5816	3444	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fff1937c188,0x7fff1937c194,0x7fff1937c1a0
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,4883383877287093170,17471652827085706772,262144 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,14112556181165030248,12956278542182928094,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,1556950071581776048,3523568348938170867,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,9787320386831062809,18100931933237636685,2097152 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,11466670329157823454,8005224229318192878,2097152 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,9048565775490755788,13692778925098305035,2097152 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,6080023460795402280,840123824149162231,2097152 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3752,i,10216700820400592523,5084051604721292379,2097152 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,1273542595978095782,837351025712352195,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,14674902342039339355,9976022038861932720,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,16864923914100801570,8038498587876850017,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,16864923914100801570,8038498587876850017,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,406346769644003914,14294791398789879782,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,4259387983566352617,14391406786366963512,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,15283277947744586645,5503088756634746780,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1896804435584046949,9964681838606293017,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,10454037187917158239,17587024714379385584,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:12
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5860,i,2422210451516260502,9496735739765275313,2097152 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,11182908873883549632,17043898435225254844,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,358839570575747365,5385438617595541704,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6908,i,13482822146197290693,13014324943313850800,2097152 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,10736385901387667422,15851102416373934215,524288 --field-trial-handle=2320,i,15005372801483302093,13831783185193256810,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:5296
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:616
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- - C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -personalizedToken MKRWXDHWXV --deeplink https://www.roblox.com/games/10449761463/The-Strongest-Battlegrounds -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2716
    3⤵
    PID:256
- - C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -personalizedToken MKRWXDHWXV --deeplink https://www.roblox.com/games/10449761463/The-Strongest-Battlegrounds -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2716
    3⤵
    PID:5832
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:5736
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fff1937c188,0x7fff1937c194,0x7fff1937c1a0
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,12942074884695448657,15714640849121412639,262144 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,2761070001180482280,8347352689426151531,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,3700772178797192884,17639898192785502418,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:13
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,15421064798776108662,15483794950152594335,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,14388386393884112845,16356131620125672146,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,3263158060287390776,17542691798176600504,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,3263158060287390776,17542691798176600504,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,9423013365596650117,10019913137699324455,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,6024468082540674086,3431512270682589355,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,2649056556266372110,8809505901710881189,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11044679704609753144,13229440652991523742,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,16482651001353885139,8146187991311383396,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,10581424698061247872,8593755623831444554,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,16300548384117668980,13849856205308102174,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,2149757598457987698,9081296616264584597,524288 --field-trial-handle=2496,i,16259440266316150035,7500550253302488341,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3568

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:252

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:4240

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:5784

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:3976

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:3740

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:1720

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:832

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:2724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:624

C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe"
1⤵
PID:4428
- C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4428
  2⤵
  PID:500
- C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4428
  2⤵
  PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 4fb6633176abb8d1be846cc49d65bf4a4a358af81b750bd2bca87604fdc98dd7
MD5 9336ac4d9169c399e889c1278c9fe0b0
SHA1 adca43997bf4725b6bca68f6f1cc157b038e34cc
SHA512 e1d5c466a1a6a7fa60860f72e42866e8bde5744195ed234906a876256360c23368eb46c746e527262e96eb225f7fee4b74e76cb1b7be531a0d98f88674fed3c8
SSDEEP 196608:POAyr3imdRaPKzLCl1IP0CmsxakQdtNuqmpEfBMJ:POHrWKKCmsxbQdjuqmpEK
TLSH
T1F3A6AE22B901C032E8D200B296BD5FFA993D5E341B3954D3A7C45DB95A705E33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d027e41305c78ecbbd01b0f2e9b79eb90b2755585709b552886ad5ebc5a4a959
MD5 4c6174ada8bf20716e0c2ea5479ec174
SHA1 823fcb1c307e30eeb7b634609acce26b9cc145e8
SHA512 dbdab3cc543cf2e062255d9c90c7d433b8dd9553c537b0e0249bf9fe0a1fdcf2a0d114042c9382bcec306f5d5fa8bd2a4151ad863f5a8a1e938fdd83fe514a65
TLSH
T19BD0A7383A38BAD6D52820BAD4314300A7A69263766782827150850D5D790C15FC659A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 56ba52427ece10b53dc5ad26b268efb78e7400b13b5c3b3414bc32ba2f5f8c0f
MD5 eb5ffa0b38d50b4599005e895bcfd108
SHA1 e2aa8f84b7ed4db9bb0cdda35afcdc29818a9249
SHA512 aa4ec23d9c30ecb73ce5e9cc8e81baf12249ffc94b1d7248872d9d61b78fbf369c0579a4e1fca92dbf9adde498147da7a9fe2c0200bd6ecdb045326fe12a5f82
TLSH
T1C2D0A7783A387D46C7163075A411C351B7E3A361752AD0526160911E6D751C14F8E05A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1170e5747b6f443c291e38c75b242908fe9c5da2d51cb33cb4b5bac6ce1f4a0e
MD5 a73991d5647ef004ff06e576871d7b2f
SHA1 b0c487c15d303209eabed0e4c456eb567d53d53a
SHA512 7914dccc54827d15446adc22a6d7d18edf246ac1a3e0804c4b41cd1217e5b93b435f2b4f7102d35f39face7704b1d116914394fec57235818651eda3e6224087
TLSH
T185D0A7743A387C46C7163075A411C361B7D3A361752AD0526160811E6D751C14F8D086
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

748153f0-bd02-4c98-b932-aa0378cff9fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\748153f0-bd02-4c98-b932-aa0378cff9fd.tmp
Size 414B
SHA256 3e8765d2bcd73509efcb602f44ec090a568774bb2d13e639e77e16e02b1cabe3
MD5 5dae83c4507e0f9ac816fc2af9d8ff5f
SHA1 d0e5ed7b5294d839773fd7a5685dc7187e8b8096
SHA512 7bd559822bdecd0a2601064d81ab44969479a9217a00bc8347117749a2703ea61e5669f09e72d5c07460189548fe0d9e3b0b62e5fcc9557d050d41986003a36f
TLSH
T109E02B96D861DC2B1CFD5759A052464BE751139A3B50891F7E3CD20D8FB163A41D681C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 19KB
SHA256 6d03a7a546fa6d3994170bf1885b8b8c2469039622f489f88146d5602fc632f2
MD5 1abbe484db67d4da8bdceff96af9652b
SHA1 64dbb70bb4dac1ccbaf39dffb8b97be667f4b445
SHA512 204cb57afe31de46e4301b87133ed3ee040592f066594a16150678fdf06656efa0d282aeebc0ae41acaaed3eca9eb459b37ef2231f05069932e6cd5da34eddce
SSDEEP 384:QNPOX3kylqPtsFAzyVMn63fcz79q2h1RLIrMFZk:QZ+kyIPNzaMnQfc397hPUQPk
TLSH
T1AD92D01039AF8107C0447933F88AC4FC77091AACAC6DCE4C9758695066FA0E693B6D5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 20KB
SHA256 34c72bfb4e56cc280c532cd801e017930ff65e82fa8b7223c979a19e1c54076a
MD5 20c4458eb60bd5de32b265087a83cab0
SHA1 a32f5a978661188a2cbd1addaebf6d2b87204e35
SHA512 0608349f417fdf56dce20125b415c9fb33de63f09d1864fb3ebf722bd242efc45a757e37fb3fd440c24eac5f3a20e1bf14948b81dc344ca9f12e11337961856e
SSDEEP 384:cDnogP50l0KE1Cnd5NrF4GzdVwFnzIhj+T1ewBG8tkhXquA:cjbPalVE1q/prvwBTPU8tkhXFA
TLSH
T111A2E2A2F5123D2BCED1153D327CF341558F20FDF06FA6E669283CDC4A0DD5254AA62A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 27KB
SHA256 cff10e9d9b2864cc1b1321d1db204728eded77f962b3f26a3a7a5f55496dcda8
MD5 b8a326c40449141da2ea4c561ac9ac6d
SHA1 e22b5a2b1f0e2a8685171f06ab1343fd0b239f78
SHA512 bdc689c9ec19a27f1897faa2949964fe6ae820303835a872ef76cdc28af11fd906842faa7ab25503d78b28673aa87345797e9cc783c84137286a9da3da18210e
SSDEEP 384:4Yi5Gy8VIZzWUgAgT2RhdusJmzdb8Atdi5iEToWrz90aw45QZ8ufjMlPh670CzFV:7V7UgAYqddwNTiLzqaDmyi7vEyZ5
TLSH
T147C2E16F49CB3F64639F5723642CF1C8264B54BB2B40EE11036697529EC4AFCA8426DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 104KB
SHA256 c768ea297e8202065782f7bff6949b8930b93e161469253cf793235ca87b8c8e
MD5 cb9674427a1e08252f1592ad9a291f8b
SHA1 6d8c13dc21f568fb2f498c8de3ee428a67a4b9fa
SHA512 59ed90b389b9a0b1ce45a59b262df086c2ae958496e8f065165bf171f4eb850d7f5f518634860a7ae1e586054adee54fde331ab1fbed4cb22fdae151e2079390
SSDEEP 1536:Nozd7HYd9e8g7cMFG8riSvLGDAvi63aeLHu5yvsj2/cUxRbincRgfjYg:o7HYdi7vGe3GkVDTLUEgfJ
TLSH
T1ACA3120878E4C325E3EDD34365A05C311C27100FDDB794B16AD80DF5BE69AF56099B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000183

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000183
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 c2b5e7dec7cc80b620ee186050af15ce15be58e1ab20dd404003979852beadcb
MD5 73e1cc18381ae06c8eb850361eea495c
SHA1 fb7248c51a027279d41cc539cbb2875e10c2ee17
SHA512 aa3ff75ae6670c957cfc2dec1167dc364ef1b7f43816e6dbc1d29bce19d18b7b610e9857a979088cb1dc9a06cf311f910322228d68a34698f8c86ebfac25da4b
SSDEEP 192:EiWutIEHKt8IoxE4+H/Wg18yFDgPG01SMsXETR+eyVdw3AeAhZpy67u+sXPZk+g6:EiWutIEHKt8IoxE4+Heg18yFDgPG01Z/
TLSH
T16B02A6667CC39609CF1995F30BE759C5ABE4C7E6410EBB83C608A7B8396328164B3134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9e30ef21b67be57ec7f1a596261cab54c4884e9946496a23ed5e3f3a363e8f8b
MD5 deeba9e98e4a7ab03319bc9e374db88e
SHA1 d5043cdbfb2b108a5f3c402ec64ea2cf1c7328fc
SHA512 b5fbf2fdbd86ff3947234bff5a75b50078cbf7f97e1151d9fee0dea1af76c9cda043c92d96803a9e8f879fd45d58438f16784bb08c8265a0bae6559ceec7bcbc
SSDEEP 96:FgQpJetnrEXEtFIVhRE4DPXJ5oWUDIPYeaMsxhSRqqyEnSuMoOefIQCfp6vNkuor:6iwtrEXEtFIhRE4DPXnoWUDIPYeaMsxn
TLSH
T171C1502BB4939408CF2D59F70BA95845ABE0D7F2850EEFC79B08A7B874572843476630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe599437.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599437.TMP
Size 3KB
SHA256 bfa056a39bcd81f10407aa676b8d903bc803b00ff8a29a9a267737981d10486d
MD5 ad44a300c8c40e6d115f105dba74f3df
SHA1 2aad402d4a04c32ff88f00c34cddb0ffd15f3878
SHA512 59dd58b719f1210b3e299e3aeae54f1df7fe9f501697ce8ffc3fe5a31128afa55ef8a1a627e52af7e182598c745fa6bd0221c0962b3726943beb7e284c5eee8c
TLSH
T18A61A57A3550CA5DCB216EB75EFA648AFFF4D8E2800F2F13D849B7F848893485856230
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c47190b825b874221311a3b10c7f02566e605ac3f380159b739a3ecdb43bae06
MD5 f728de457fa7724f44af369a16b9bae4
SHA1 5ac3b4ca7e58cf577652b997f0fb245309fb3ce5
SHA512 1c64942c4fa2996ef5de853a489d5b96ddf9dc66779b1fe9b33a400af8d2f88b7ffba96d32a9363fcd972dae8dcdca6a91a8cb0a130f4cc610ddb81b3bd2d491
SSDEEP 3:MsEllllkEthXllkl2zE/lErsX:/M/xT02zw
TLSH
T1774404047FC10407C50151304351D3F41370F4101713F74374514C735FD5F400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 992f72fb30c7091875ab0ec8dce5acd2881b057b5b0e30821468693df7605adb
MD5 c7889bf23444189cb1986262f66f4235
SHA1 50afa10496f4b63404739207915a0c9c4ed1d949
SHA512 d1ee1cbd668d2f688168d39e06b11612d51e34b0548daf716e4ce0115ef9109c5e25cc82000eebfbcc2184e90243926843012ce63fbc451fa73bf4f061f044f5
TLSH
T129E086541AE9D139B0246CD3C77D730882E27496A7897D06570D8C986186786AFA6ED0
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 5c9bf9385b998b990c1936a059e95ace3a5fbe0935516a01926b2e4061c0a7ca
MD5 7770ea76a0c62b077040bc499faa8365
SHA1 09d7155edf8fa6d62b25f1e6359a4cc1861a0d2c
SHA512 4e87a7b65406e15e7a4e912306d27c2edd9dd312d5665dfa5e04b84776ec2561b7f5b7e03dff2d9d8c4087b4839bcc0f6cf26b25eb696e6e38c0c11de96c24b8
SSDEEP 96:UBCxbxQ+Cg3nxQ+CaFjM1lCOKpRkCmyoBinzGqtITel0K+hb0TRu0H:GabEg3nE2w1lKztmyoaNWKmF4TRBH
TLSH
T19CB2E7E75B78B005FB40AB7D325E6469DE37823C9ED2D8C8710495302EFC413A97A6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 3bdc45c3bad21e9ef2a6a138c9bcfa58d668b6eb85eddca9ff2f235a8345e0eb
MD5 ebca3f5f0fdf7728c180fbf61f913d73
SHA1 817eeb54671c5c1a90484abe6c74fa887ae0096b
SHA512 343f7ca8686a2f639f1123987c9a1a020f86251026008968afbd5c207dce0554332c78bc12b3898b25aaf02793d0910c092bbb7229a0850ad5596228c583aee1
SSDEEP 192:bgsE5oYUH+bF+UI3iWGVoWN3qL/8V6TZEYEuEi2VVV63:5QUIkUI3ijVoWN3qL/z1nD2A
TLSH
T11D24B5AF5F306211DE7C913575EE54A35D6EF03FCB9392D9A8112470CEE2602A42C9FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 31KB
SHA256 d4df3c8cea713f5ac88b4b93d4230d1f4efe830dc6ae57569a6d1a408543e013
MD5 422582d70cb5d2bd57a65cf40bc0fc16
SHA1 c3eec06c778105ac315fe62aba375975d0ad3b2b
SHA512 40af0f4abde4f246854e3cf7be2b059caf782617076eed3ab0a9b70e9f33c9a04c29e17087f6013b80aa5ffb816a65065430ed143f35094f6760a14280e722ab
SSDEEP 768:MZPwbPj9rb6blgLui9i8y8XyJUVy+W7aZNn29J8:MZPwhb6bF8y83ysZN2U
TLSH
T1B0E2B4CED7F8814CFAFB8B8B7FB7518545B5BC162C09E86E41141E1E4E2364489A273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 6f09b6475ebd30abfb9563f9a2df1d3797ce58e598bc15afeb44bebbdfb46197
MD5 f942e15ab46be01ae487832e443ceccf
SHA1 bbf2a1d3be366df2bc8183069b690aaf15a6af81
SHA512 dfe302295d5a1fc0b58827af455dc36eed9a472c642e598d19fd18f22be39f63fbc224b76701f0a472a5adb950babd6713ce8786b7c9b20c72913ddba60d2422
TLSH
T16FE026B447FDC2AE7314604BC2AC770CD3F03656E6887E861B049C44B4CB184AB92ED3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Size 50KB
SHA256 54d7de7d1d4686ebfb3e02a936def374eb1307a423005759549ff3eb9083f8f9
MD5 11ba3c71de2dd4aee865408645f093fa
SHA1 41660b96a68338ce3da8e22dde2700ccb299a152
SHA512 10632dd473d0e536d8c65f6f85d74e55bee060a3478bd2eaf20ccd3db1b3f3ab81aea00c528552f1e6f3dd9f6d445ae7c9b0a6aa558e50c30b139d287077a073
SSDEEP 96:ckYUCn8MouB6w9fUP3mwilmqUvJKLReHEG32ff445:eUG7Iw9f2io9cf4g
TLSH
T15233331F2B682801C8598632BCB155F2AE7DA03F8B53AED22CB554254D75862F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f13e648c8b5d26d77dba7a209612313161479388dd96ff7b24766fb902021f25
MD5 b54119b88b210cd9b04013f0854242dd
SHA1 b6ef21a92f41b21345cd26804b4eeec7dfb11910
SHA512 79de1c0628b1da1b139a9c07c8f9b38a9e8d3dc67ebe4ee38839baa4b8ea2e2a4410c37ba2388cf3227682709552302a8b2e34165cf61662d428a2c4f224faa3
SSDEEP 192:DbDBNW48nip1qkj6/GjKPVJLRfpQHjuMpHxX1unuB9LTaQdZzHfH/w:DbDBk48nip1qkG/GjKPVJLRfpQHjuMpo
TLSH
T152F16AF753B1C56DAA1296F4EA19AD1BCF580530031C78B6C9E0BE1793B35B1E201B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 10223f76a3b0e6de5ce65b53d84335455c8c81ccd2eb1236902e9d9b9fb12d94
MD5 e34fd0bb8e38f1b8741463deb483fcfe
SHA1 e573779fb3344d13b7440bce89575be40161bc4d
SHA512 52d52fb21c8366c629f5726d41a6e9b320f17f4af209a1bcaca225e4b74cd17b53eeb1783515e2a5b57e7b72aace02003e7008445b41b87cffba1dd2abd50080
SSDEEP 192:DbDBNW48nip1qkj6VjKPVJLRfpQHjuMGX1unuB9LTaQdZzHfHbGQHA:DbDBk48nip1qkGVjKPVJLRfpQHjuMGXw
TLSH
T1CBF16AF753B1C56DAA1296F4EA19AD1BCF580530031C78B6C9E0BE1793B35B1E201B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 10dae056dfb2395742c865e86ae96db366560f240949c6e0a5a0f0b68bae6e10
MD5 927a4713e57a8605f564737b790a4420
SHA1 b59d85b7c0ae5213a9385ed7deaf43a0f0902029
SHA512 956ace091736d493d3c99f88fffd69ed4e293719635d4e8734902cd43e9e0e417affe9892fdce7ff041449ed399e9ffeb69ab7da464e3feabba5300d38c4f478
SSDEEP 192:sxRsR4yMojK1Ml8NoL/f4eBsyWpVGW00E1jxwzoA8pD5/g6+WNnw0gdYCsuFVYgD:sxRsh9L/f4eBsyWvGsij/N/50dbFVjt
TLSH
T16472EA15A634597BCCDBD20DFA967F53D6F91533A2901E44AAFCCA0C05E76ED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6b298d023b6d4a02ea9434a7b1ac388b4ae5720eb90820f7f4f7306c23360e72
MD5 dd83c7a4d608f16b5862dcc8872978d9
SHA1 af7da6a33ba3e8c6d2b9487987d6e961eabe3ad8
SHA512 aed9d2a0822a0e2de19a3a9d77b383f8dc5512247c8ab2f28717717e544789386813e72962209453d310b27587b6acb41655ea2e5b7e21ab62e3f491ea88cebf
SSDEEP 192:sxRvR4yMojK1Ml8wFL/f4eBseW0bE1jmwzoA8px+/g6+WN0dLXY+UuF4GNIgDRJ:sxRv3bL/f4eBseDijWY/5yXbFd/
TLSH
T19562FB05A638597BCCDBD209FA567F53D6F91472A2901E44AAFCCA0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66497fbd7d28a4a83cb0503f9362c63ecbc78a1303d526d9451abec81758c97d
MD5 14a3a226b66c5a14c41cf66bf99dec43
SHA1 d6d2f3ddca835691f4bd32e85f957ccf97b0a95c
SHA512 50b89323605225d88bd1893b15eff8ec663cb9887fc5a7ba09337b2b6a5cbd0820254e3a4e951153aea7036c23d519ea57751ba1c932d8584be20542b1589b7f
SSDEEP 192:sxRsR4yMojK1Ml8wFL/f4eBseW00E1jdwzoA8px5/g6+WN0AmZY+4uF4GNIgDnJ:sxRshbL/f4eBsesijLr/5qZjFdt
TLSH
T13962FA15A638597B8CDBD209FA567F53D2F91573A2901E44AAFCCA0C05E77DD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d0ded69dbfcb9b150d7836ad42351c2aa8d63c50ccfc99059546fb8085cdcd5a
MD5 e0c62484d19bc9e9fb7cfb3e533f2c87
SHA1 1e7d368436caa7a5001a7a222733007e66a5ace7
SHA512 432056dc51e5eaaae8d7330bca747c934814877fad6dbf8ee2443c21def70fd4c088f64b3c6015cfcc2812f9c1808fd14e60d32d2298554abb6e1feede67d4cf
SSDEEP 192:sxRsR4yMojK1Ml8woL/f4eBseW00E1jdwzoA8pD5/g6+WN00gdY+YuF4GNIgDnJ:sxRshOL/f4eBsesijLN/54d/Fdt
TLSH
T1C162FA15A638597B8CDBD209FA967F53D2F91573A2901E44AAFCCB0C05E76DD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7d3f6be4bccb7875a5af51b912a6302801985cdd72b5dc2ab00c45f78d56b38b
MD5 03af81d802997df6751dc76d36846323
SHA1 c097b15d56ca732055b974a9bb9f8de71a607c47
SHA512 0139f17606a5709bc1721685b833448533a99dc811af90ed600bdbe40b76b88857cfc80cef6f2287432ed346e4a60d197e098be84f2f21e724d30852f348c70e
SSDEEP 192:sxRsR4yMojK1Ml8wFL/f4eBseW00E1jjwzoA8pxIu/g6+WN0AmZY+4uF4GNIgDnJ:sxRs3bL/f4eBsesijVh/5qZjFdt
TLSH
T1A462FA16A638597B8CDBD209FA567F53D6F91573A2801E44AAFCCA0C05E77DD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 31af332b7da6158a1dbdf9c6cfd1496c51ed92c642bb61bc1c8fac6f32d4ced4
MD5 26f488e15b9452ecdf76ad694e71debe
SHA1 8495c218e9144a9582c9f9c02ab8f2e1a7d63a38
SHA512 574e439c1711854203ca632e4aad459b2985555b3a33ce5269959bf1937b805a9a6511f0b5595b9b481813b7e0270b427d228ac0dd1f7cf6e0ec532ade6fd7f0
SSDEEP 192:sxRkR4yM/jK1Ml8wFL/f4eBsGW0bE1jmwzoA8px+/g6+WN0Vq/Y+MuF4GNIgIJ:sxRkabL/f4eBsGDijWY/5x/TFds
TLSH
T13462FA056638597BCCDBD209FA567F53D6F91532A2901E44AAFCCA0C05E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9f74c8a199ecb63d53d3c39aa6821d3fcbbf6da26078c8ca540c5a9d0f8cd2e5
MD5 d8cb03d195677e1dcce970724841113f
SHA1 ba6fc670d49ce794e7495b87367c64682ed9f3a4
SHA512 ccc9353f4af4e64ca3f7c8a9fae6d9962522d90e3f9d1655511b1273d472df62c584efc78976bfeaa4f59b0ceede857f5f1f24063c42c58b0f09069beada9ef9
SSDEEP 768:7dUhjgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIe0Gorod4MT:7dUhjgWgEyf3wu1ja9RGTd1T
TLSH
T14DC20B3B640CC77F4F844A9DEC29AE976DD801CB9B588D5447EA890C03C77EF921A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b06e348cb14fa5bb5c83657760396e4c848e285a47c6e4ba1eba24ce64a96916
MD5 97b79b150df46312fb27dde38236b64a
SHA1 bd33f71289911a2559a8c42791812c02e111ba5c
SHA512 69ae4728b3eb400b77610b1c2699b124ae4c2c1521267f4fabbd064b7772f96a0c8ff4b3653858332a3e4ee73c65fb93d4127d834e72bf246977438b50bd5207
SSDEEP 768:7dUhjgWgEyfdw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIe0GorodJo:7dUhjgWgEyfdwu1ja9RGTdJo
TLSH
T1FEC20B2F640CC77F4F844A9DEC29AE976DE801CB97588D5447FA890C03C77EB921A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ebc1a16f98fdfbb94373918e232ec530643e9191803019fbbf1b2a58ded635b9
MD5 a5342081e4589a341be6098076873264
SHA1 3f60ab8427411897128d048f801bd1fac65c5e73
SHA512 e8e16968c91585ab9df01ab516422db11e3a88ede9b38527ac707a0885c00de34b285715c61aa07fafa85ecf60145d36ac44e292cd29455df8a9def24cf634a3
TLSH
T1F5E0269007E8C17D7026209786A4B708E2E4B427D2CE3D062F08CC4461C2984F3939D0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 5f0d2d00d9f4b8bf520971112f59b3dd8a66ff9960f902aa71c4fd61497e25f6
MD5 934b9b6dcc4b1f5b837719a4fc483d4a
SHA1 6feafd1cb348e8a6b06fe355c830705e4eac5310
SHA512 dfe9adebcea4fed70009d5ad6b1bb744b9bd56c60c4edb624f7bc5a146428495e5e0934744e6f7adb212d6ca737bd8df4747feb4ba5a52de720babc02793b317
TLSH
T148B0120C7B50571EC4E416F417898FD0B300F10220A0C41BCD5C7F118E0A55C6F00CD2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 dd847a9d41f3cee82c30681968cfc9215fca5c65fae78fbc54146f439b7fd70d
MD5 3b5663fb416646bda946949d91d02a78
SHA1 b87f1590e4e89fdf21bf79d99076511b2b0352d8
SHA512 a157364e6467ed2364429b236eb6e2f61e89248631bc589e2df50a0ebcf4c194594ec462f5e2d5cdbdf2559b185fb9c17edc81f2446e3508a3a8d425578cf8e9
TLSH
T1FAE0D8A027D9C23A725564879295F308D2E2B523E6C969556B1CAC956346180B3875D0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 57a78dea7669c448cbff0689895a2fdf05a239e0b3c588a92edc18814df0a56e
MD5 98df4195ecdb6b079b54ea3d1fa0b3e5
SHA1 3420d09259bfc0480f9bc8ceea920b9741f696b4
SHA512 fed92198b8dab0ff677c512b36dc09c3c0bad45c8986a97dc7a80dd157d988f494009df84875a2dfd3b95dc2c6b45208df20277fe44780266ae7688c233120f8
TLSH
T13DE086B047E9C239641468D7C6F4B70D93F1B81697D93A4B57088854B182194B7A69D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3393a0ace5ab13b3d3ee255c6e4cb0c71b589af592dd84c07a26ce2a2f897034
MD5 d9258bba5e624dde219f479827fbf030
SHA1 82646dd188d26c3b45da96a3df82ddfc8d34586c
SHA512 f5261a2857d1efca15dd41b432013150dd308a29880eb7800f164fc73e5ab7dc7a004d6f09c898a4d741543561f51bd2c7edfe136bf8dc583b118813b9a7fe7e
SSDEEP 96:Kkg6K0EOOJqK6dc9oMmqesWa33gUsK45gesc8M32cxHpm3zBj3TWH0ig7TKJ:hZ9dc9oMmqeza3wUQ5geT8M32cxHpm38
TLSH
T118919A4475BF1310397D240982A8D82A528134B33199FABF37B891A61F27E985FFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0c55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0c55.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 a90d1a43f8752bf794dbe3a29479e359138c88544de09c08627e9aeb43c6fa35
MD5 accb1bb390fdfca3635925951a87e23e
SHA1 05417ec73cf61f78419b2f14a9f8bf0a5f9b6d3a
SHA512 46e794e4c8be3bb9af8837bdd854285ee799c938931120605cbd769821c3fb6c60fb7ed724213ded1aab61f6f65dcc1af1a96cb46e01ac6d73df913bd70863c0
SSDEEP 3:MsEllllkEthXllkl2zEb:/M/xT02z
TLSH
T17F4404057FC11505DD5014315071C7710370D5310711574734F10C537CC57704C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 19ad9b508a49e33f1bb3aec70506710fc7933211605c48497c61f12e81c8ea8a
MD5 982ea85731c871d3229c9dac92041531
SHA1 2f83b862e2062cf10c53b9c553fd2cf616a6d019
SHA512 e8913ef8274bd952e16907def49e31de63fc38ebe085eaf1a1e4be1352dcaae23dd5f22c73c71ab2a69ee92349f6a0e5bf3ed0cc4063eb7629ceda15cfa3d93b
SSDEEP 3:MsEllllkEthXllkl2zE9fV:/M/xT02zO
TLSH
T1AB4404457FC00707C50010304071C3D00375D5171731574734750C137CCD7700C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 e295f3a365adaf75a4007f9c37de9d3871e813d25e27d7c850ac3d1f95760405
MD5 573a38aa86b152ee10bbe68e1e49f91b
SHA1 ce40a2b42a7b711f45d5b318c8473dc2895893c5
SHA512 27ee7c7fc282c3e94b054e4911e1a77294bbfd0ac61bbd7504b7b22236e0ce0a9bfcb1d0f10eec4259342d1984c39f5220dd8cb6ab9659048d71df07bbf07410
SSDEEP 768:/Fcj+9g3Jwg9GG5mgMcvnWgWWR+2SrXH78tRPxO9aWM9MC:p9g3NJPWg1bSroFXWM+C
TLSH
T1CE235BF558D7497AC8AEAB43633E2E026EBCC1A7B4945948F3D44A0DCD635BFE302815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8e8b0097510e20eab8b77c174818e1bba5ce8012a5767005f240919f6adcf4b0
MD5 8f4d44a3d663583928c14f969cd43b23
SHA1 94c983a30278a12d81be20048dc11574b71e0235
SHA512 5a29310f9f52e7e2ac59f04013e02adf95d156bde37a5d153cf878af734de4b39c181d2d9e9d3400f2f681fa4f56cff51ae9f84eb95e7f64fadd3dcc685fb59a
SSDEEP 768:8j+9/3e5G5mz4McvnWgWWR+2SrXH78tRMbb9Mp:b9/344JPWg1bSroOb+p
TLSH
T1BFF2AE31B8549EB38CE2D694B2077743BEF04297C6CD1E88C4D99B0E469B9ED4707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 450f57560f6c83e2c110fdba560c4ca02553441b1f48b5206a406cbf38c1203a
MD5 7a77ac660e4b47876223d65cccdc1d31
SHA1 ccc4536fa994afd3be7e4dbd99c4590addc4cc57
SHA512 2bcdea2b38962ab14e9f8746f478e24ea3a98146db46d126700e1f4aed244ed1e52da9f0543abd8e8210af6d4a7dd502bd287eb1d9a2d30a56781a4a762e55e7
SSDEEP 768:0Fcj+9g3Jwg9GG5mzDMcvnWgWWR+2SrXH78tRPhb9MC:89g3ADJPWg1bSrolb+C
TLSH
T12D136BF268C78972C8AE8747B33E2E42AEBCC197B4885A44B3D4490DCD475BFD607815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 8fc17bd9b441ef07747a0e0e2c5a463f3ead05a0d18f3de89b46c0867b83d113
MD5 b550aa0b5b165f3ab5fe2f00b56f30ed
SHA1 e6be95882041f34b1912ce00bd4082fafa4423b4
SHA512 5ccec1fb7e22c8913b463996ee57382b5e99f6f9818596e72dd6ea3c652f2a4a3525f3be29dcca40104e052b0aebdfad7a2d1caf5a7280cf59f4bd6914a18fbd
SSDEEP 768:IFcj+9g3Dwg9MG5mzgMcvnWgWWR+2SrXH78tRM2z6Zub9Mp:A9g3AgJPWg1bSroBOZub+p
TLSH
T1F433E3B99CD3897AC89EAB07633E2D1259BCC177F5A85558F3840B0DCD264BFE702815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 6d5bf5151a4d25f0d2fb1cd11bbe7709dc152ecb075d10b5c75e1e724914cf7f
MD5 cd0ec1a5a2d066de8fe530574df47490
SHA1 6b4a7b1aaeddcb6ce1a7e7d7f377017448bbbb29
SHA512 04504965ee5c3d2b0df1a3ad0dee4ff1bba9cea05c3c15426e3e93698867388dd9544f50f7b7527ba3a6b283e2582688a635f353156eb4be9da3e0ddb8d845b9
SSDEEP 768:IF1j+9U3Dwg9bG5mz1McvnWgWWR+2SrXH78tRMbb9Mp:l9U3b1JPWg1bSroOb+p
TLSH
T12E136CF258C78972CCAE8B47B33E2E42AEBCC197B5895A44B3C9590DCD574BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f705346e28c77439324dc15ce38e95e7f1cf504d4e4a5d27a84ddc9dfa344b69
MD5 1ee2fbf3b86282bb1fddbac4d28e618d
SHA1 3ab2673e9807761280b8cee89b4c4c6cbe6984e6
SHA512 14fb80ac4efb03623b26425f82215110cd82637a18f2014ac6bd7faf08f17cf082ba6361544bea8b4286522f4657284f27cc59534a9f3047a27b469b9ba38bc7
SSDEEP 768:Fj+9L3J5G5mzHMcvnWgWWR+2SrXH78tRMbb9Mp:w9L3bHJPWg1bSroOb+p
TLSH
T1A7F2AE31B8548EB38CE2D694B2077743BEF45297C6CD1E88C4D99B0E069B9ED5707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b5161c87a9105d536f86e415c200c318beac7ef66494f5685bcb252ab111e611
MD5 fb3aba7bfb8697ce264bcdac7747285e
SHA1 e9e134406fc5dfee828160d999b6877abef0a496
SHA512 f3bb95faa39771d8559f6b2a112468f7f8013728ed7369e1617e52655b5d6cacc12412bab5624e492552e378804ff8205fd5d453df1a7fb5507a0f8baac50e2f
SSDEEP 768:Orv+4UNbdp3Ub5mCMcvnWgWWR+2SrXH78tRkm+8rr6F:Obsb/3wJPWg1bSrovDr6
TLSH
T11D03BF32A8688DB3DCE2D684B20B76037FF44193D6C91B88C4D91B4D829B9DD2707DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 0c6758ee7f658a48d01855b489e71fa489cd7f22479815ce743231d2f938476c
MD5 89bb631026091c2492481dcda3aa5aad
SHA1 68c21970275c80b01eaa5aa52af4121b5dbe8b4f
SHA512 3f7741180ab551737e7cf6cede6db879c8605cb657e42c02c1bdb29e957f121da8ff6668204aaaa5273c9a0864069796a0a7c0cc4f7dacc5ae629353ddd02b83
SSDEEP 12:TL0yEJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3is+zABrdSmQQtAdL:TL0Dj0afDdWec9sJVUOVB5hq7+jy
TLSH
T13492F1166D312033E8DF4B76BC4389A00EBD035EC5A77951DED449210E71BC1E2592FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fa72ad737f570bc1bc1e3215866324a76dccaebf925b0679c10bc04af4311efb
MD5 91ccc32199d3ea25e1618b51f0c7cfde
SHA1 06677c7d9c8ce2de41da020ec719b6b165087479
SHA512 8deaa157c2ace18426c47029488d1c1923759b3c6cd7942bd4b16ff63848f2a15d40a23320a61e0e5293457b7ea533a8a5f247cf462956df881d8883ea7ca53c
TLSH
T157E00403D70040DDC07417300043173017D1C03011710317CD5101743CD3F401F107C4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59ee2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59ee2f.TMP
Size 392B
SHA256 de92350aae584f1da083648641287f5fb75fb0fadc9329a63d136fa167e6ed42
MD5 f6b8f5f8cd80bcf00d0f7676edac0677
SHA1 b51f9bde7f4569902c6459e94851653a29aad08a
SHA512 f5cf0464a03b9de65f8df7c332736ba008a23698c5224e6d25e19978315742075f8e404add7a7b09ea16090814226f2f6b94dd303b18be6b7da82c80271c6499
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8aa43dbb8f8e7a5b9ba634485ff38b101af2d098b18dfd2da512057344aaa569
MD5 049357677c0d341d8202e3daebd422d1
SHA1 861f8552b3e534fde7bcae8bc42c3b8ba76a7e1c
SHA512 4f1918866ca85679456a0c0abebf0106f575835eb5ce4a1e6d85ff2aca22ed09fad6fcd5f434c9b1229a7f549a7efd3ab0af1609a4bce387fb830310c2001dda
SSDEEP 3:MsEllllkEthXllkl2zEIL/:/M/xT02zJL/
TLSH
T1994404057FC41D05D50410304071D7500770D5110731574735F10C137CC5F700D04001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

97916e7a-59e0-4902-bced-27c21cca0bd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\97916e7a-59e0-4902-bced-27c21cca0bd2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 146B
SHA256 69be72e125dfc20c64c7ea7f45bc170674bb485752e7a1517eac6b5229fd30fe
MD5 5b62f99a2bbad2099a0b82c7ff46e61a
SHA1 fd3079bc1add3d77b9b52506370b949c8c2a6dd3
SHA512 4cab1facdb83bbae69bea008f4c47c9a2008a65cbcb9d355d5d0d19bf901b4ac3d0532430110606057054a3cd3b9a4e6edf1ec5290f02bfffe370107f5e30de3
TLSH
T19AC0488223F400A96B4318AFE168CE33E20B6098220E22238CD7ADAE192474B11EA1C5
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 195B
SHA256 1648ede9692cc127fb6105f8b2dc997cd8ea44ab56fd517cea6dd7691ee2535d
MD5 8b5d45ca37db5a68a27f96f4549d8f4a
SHA1 5e63887c26f4c89ace821ccf57f87eff5ab94f25
SHA512 bb1f39c798914cfd29f09fd5d560defdc337d5f9713a9ce51844799fad63673ee5bddce146c5bfb73fd520032075039665d6f1476f3c1e1b360224c1067d842b
TLSH
T1A0D0EA8623F400A96B431CEFE158CE33E60B6099210E12238CD6ADBE1924B8B11EA1C5
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 90B
SHA256 97603b598e9327ab32ff3556420645ee5cac27d36f16b136ebd5ada8bd3d7ef5
MD5 36a73e4c349e427df8a13ad1e3ffdc5c
SHA1 09ac5b42388f2af71c665ed795503ad3d2a2ace1
SHA512 71fc8942382d69e73551abbb734adc9f19f2602901b8c2cb4a2bd25e56b1fe9a54ccb5d960539b1c96cb1507d1390c655db8452f82244f52aec5790091a9375c
TLSH
T180B002C423D4005D1603416FF16DCDB1D105504C7517331744C75C5E053070711D64CF
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 185B
SHA256 1a78960e6fa5b25b92bef02f52c13e2f434cf9f8e57d2c6a3b3a1d859c2da2b3
MD5 5ffc0baa7b554d96743ee1b8ccc80b58
SHA1 f4ec54fcf62ebbc6bff62af03f14ae4329445db1
SHA512 6c473328c3fdbfd1887d860735b387b86c6a5488edcb86f85f444379ad9dbc73194a97e27146492dceb11ee4181498c58ca7f236462a06072f4a12ed4d07c7a3
TLSH
T101C002C523E440AE560345FFE159CD72D5076048260B231749D65C9E0930B4B11D71CB
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f25c438f-4b66-47ee-8389-550a422b6ea8.tmp

Path C:\Users\Admin\AppData\Local\Temp\f25c438f-4b66-47ee-8389-550a422b6ea8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3444_1514544610\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxPlayerInstaller-MKRWXDHWXV.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-MKRWXDHWXV.exe
Size 9.6MB
SHA256 c377f327acf6f974085678aeb267ef49caf229abcc290fcbcaa88d3c5b28d571
MD5 c2578522848004b668a214063b29b1d7
SHA1 f717839175b602b73fdc343397d7e1cbc25e385a
SHA512 ad4e7f003548b0c6b89ca7b23ed099dffbac5bc0a878c07a9e5d9a428701286f84a9a06bacbf0d5bf9c65319ee50b8129030f42a922850d9f6ea6a10315f9722
SSDEEP 196608:eb1PrdUXKZWafizCk6jsNZtzmsxL50W7ANVSXrlJBKJhDp:e7UXKwzmsx100ANVSblyDDp
TLSH
T144A6AE22B900C032F8D200B296BD5FFA993D9A345B7954D3A7D42DB959305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download