Overview

overview

8

Static

static

1

URLScan

urlscan

1

http://roblox.com

windows10-2004-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    901s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/07/2026, 01:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://roblox.com
  • Sample260722-cefc7shf55
Score
8/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffa248bc188,0x7ffa248bc194,0x7ffa248bc1a0
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2008
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,5677802206717303567,17954318019812920838,262144 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      2⤵
        PID:1960
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,11802175488203548813,8802015781882890631,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:1676
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,3514113326253986193,78217590339506631,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:8
        2⤵
          PID:3496
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15675114255752436505,2102918819976660659,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
          2⤵
            PID:3040
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,8371692174556158091,16399517121545669584,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
            2⤵
              PID:4736
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1848,i,14368467132388052932,1715533571082751267,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
              2⤵
                PID:2804
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,6868479561742103650,16243904209525885878,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
                2⤵
                  PID:636
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,9388597400634423259,325090168073971715,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
                  2⤵
                    PID:1224
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,1639987022735568985,6141085713777840736,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
                    2⤵
                      PID:3256
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,4620979732661548652,14023056989042954125,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
                      2⤵
                        PID:1648
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,6029464925440771963,17379022260820814011,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
                        2⤵
                          PID:540
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,6029464925440771963,17379022260820814011,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
                          2⤵
                            PID:3276
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,11442755730411460238,6465991480987900242,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
                            2⤵
                              PID:2336
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,5684157224078525050,16069628747557229381,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
                              2⤵
                                PID:4636
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,6513791422843365098,9216467546803316276,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
                                2⤵
                                  PID:4496
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,17636042255282630430,5570691462372637377,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
                                  2⤵
                                    PID:2628
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12942847724884610296,9365587650066242731,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
                                    2⤵
                                      PID:1892
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,13177307405601945141,905014138665755376,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
                                      2⤵
                                      • Modifies registry class
                                      PID:4612
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5932,i,15469655102526169375,8349132070933365178,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
                                      2⤵
                                        PID:5336
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4300,i,8425284605048096436,18053394797038159165,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
                                        2⤵
                                          PID:5220
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,2435037464346596536,15100522088498943343,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
                                          2⤵
                                            PID:4524
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5136,i,17680362344753282765,16289917626121012730,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
                                            2⤵
                                              PID:2460
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,16261498799794115095,15053648543060025911,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
                                              2⤵
                                                PID:2156
                                              • C:\Users\Admin\Downloads\RobloxPlayerInstaller-KYD7GGY72M.exe
                                                "C:\Users\Admin\Downloads\RobloxPlayerInstaller-KYD7GGY72M.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Drops file in Program Files directory
                                                • System Location Discovery: System Language Discovery
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of WriteProcessMemory
                                                PID:5440
                                                • C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe
                                                  "C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe" -personalizedToken KYD7GGY72M --deeplink https://www.roblox.com/games/142823291/Murder-Mystery-2 --webBtid 1784685560335005 --downloadSource web_game_join --authenticationTicket dq-hU1mfD5l9ulfsbIGwgK2heubnCwFv6Bdsp6xUm_fAWfeg1gZbJu2f9sSawjp-93CTl6ma4nL1OfPMOAW6f-J8Mj-AhocwhTzTn7GPGri3Z5a2MOMCpR59V06bDzMIoEJM6ihKnMIDtlYAeuro05qd_W64qU8tmb86cpN6pLKva4RR-O03TS2AR2WWIZ9FLisqQ70U2PkUBEcuhPAFQlY0HY9n4xlsttFOINOsXyXG2NjoPKn9-uI_qXE1MAMeohTllw6LNA6DKfNBjmlCgaSIsWecBR47OILoUXeufjPaMKsAYXSgrUD80j4wk3oh2HwbtAmh0095Vc3LmtRzBO326peszg6sMITwvY3H2b-dnbZQQWZ-sA89OiVQ8Sct5CN1rHC1g_3HAx1UteUoY4W2XShhKGIxvyURgar1I0Qn5te85gZq0oiR2QqQGBCraWDIF26MZv2gLhPavuenRZ_Mo5RBAemY9aetdITv6-dDdh4zzphawFi7fLou0s7jc2NhnlxagzsjPJwPnkq22fTb2DlPFTgNVWOKkDS2TWmwaFwisV3JMw6GJv9cEYXK -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5440
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1312
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7456,i,17869784307551861706,3024899845358492827,262144 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5728
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4312,i,7532641115912352590,15448165109117074332,2097152 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
                                                2⤵
                                                  PID:5796
                                                • C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe
                                                  "C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:IvyH0M7oCzTmydPxGOXYjD1s9j0O8c2eYsUjc_6vIO2MLuLjaFZ2BVa8wmXleK09qZMjnOHKmbShT_VihuBR7klwnnsaH3WokPTNGUrb4ZHMC8VQFmDmk--vPOlmOIbTRbl_KiONBaJeCXuka6Ia2zBJS9_fhR3WtYQBVrgSlTj-zo7faFwlGd3sw-CxuU9F8I5Vm0yQacPGVD9LX0HPPX064UVRqeAKOXjOI9uDflnUpEzGzEyyVnppyB7y_QRmm7GaLd8AwQLWSSx4hFwqXMADAOd3oYXwUE-tuef4cmkjIjMO1zTKKlMiqXUHXngiPeyyYH9RFQPq7YHlscBfZHsQWmPvx5mHE84w-ztE972sJDrlSK802s700vWAgxKSF2Tf5aplSs9xLn_jpXfOYQaat7b6oOvJmaYPilPbPefHVAWQC_ldufTZGPVxlZXTQntMVlp3jJk__ykaOylyUcpAWaKImgXdv3gb825jQdA2omRoVFpaQb156QdSleSS7IflRx6RrluldGkB-Z3On3wJSzXDzdvL5ZtwKQ_czb3KD1lUryJL_iZb6SfyCxC2+launchtime:1784685733517+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1784685560335005%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D0d0b5b78-0a26-4b66-8689-45fd00ea8349%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1784685560335005+robloxLocale:en_us+gameLocale:en_us+channel:zharmonytexturestreamingintegration2-desk+LaunchExp:InApp
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1680
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,9894041168157836609,14734781054175933703,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
                                                  2⤵
                                                    PID:444
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,11549451776197225910,8824027372440612926,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
                                                    2⤵
                                                      PID:5920
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,8736086924298297598,1404263447866453581,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:8
                                                      2⤵
                                                        PID:3256
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,2878981843642804250,12095664798165132600,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
                                                        2⤵
                                                          PID:4824
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,14896654691756179365,17822649606706585056,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
                                                          2⤵
                                                            PID:696
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,10889976219296055859,16192988758426439918,524288 --field-trial-handle=2324,i,14501048935845054202,15107636231984969072,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:8
                                                            2⤵
                                                              PID:3212
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                            1⤵
                                                              PID:4624
                                                            • C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe
                                                              "C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5396
                                                            • C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe
                                                              "C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5688

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  RobloxStudioInstaller.exe
                                                                  • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                  • Size 9.7MB
                                                                  • SHA256 f3c6e3cae5c790bd87050cfe95f4e6df5c1d75cd9cda745d94ef88f953a11884
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  RobloxPlayerBeta.dll
                                                                  • Path C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.dll
                                                                  • Size 21.7MB
                                                                  • SHA256 66e76ca5ee388d398a8554124c13da9bc5319bab4cc146b1048f79a5d0f00f94
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  metadata
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                  • Size 114B
                                                                  • SHA256 5b9eca4e6c0ff6ea2da74de0a506797108a8dcf90bd61649cb4589384c8f95f5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  5ba3e091-b33d-4989-ad25-5f41f934cea0.dmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\5ba3e091-b33d-4989-ad25-5f41f934cea0.dmp
                                                                  • Size 8.9MB
                                                                  • SHA256 53f56b6c361d7ad70fc8724f7a39d445583a60939ae27f23d45b4dddf7bfed54
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 2deec6a95ec52614194a78a23d73e7d01a237bb1c36f177b2d079e01904bbb02
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LOG.old
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                  • Size 334B
                                                                  • SHA256 03bc7334e12d8d8ef34d626e1e2687f3cf5a7135bff82f4c5fd4fcfa1fcce74c
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LOG.old
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                  • Size 334B
                                                                  • SHA256 e6b10d32da2562af7940bd3e81eb477fb341621500a63d012a55cdf74bbbb790
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  BookmarkMergedSurfaceOrdering
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                  • Size 6B
                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  f_00006c
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
                                                                  • Size 95KB
                                                                  • SHA256 5ad344da239b092046ca909b56230e3bef80ca36d596165b7b6803e0d7ab8898
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  f_00006e
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
                                                                  • Size 19KB
                                                                  • SHA256 9befb4747c661df6fa27dc7e7405b03738cd28e9837d4911d52346199c0ef23d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  f_000070
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
                                                                  • Size 22KB
                                                                  • SHA256 4f822d3b5f7a7cee3fdf96b11cdcc536be716e6c8855d8ec83af8b90e0b1cdd6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  f_000183
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000183
                                                                  • Size 51KB
                                                                  • SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  f_000189
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000189
                                                                  • Size 86KB
                                                                  • SHA256 49dcb9df6bc926417ff60aaec277d426345f3c49c0c3b6ead027acadcf08b208
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 8KB
                                                                  • SHA256 025ce4b3d60bf1f65b43c9311e6ff18b88d60313f2f8c7bab31088cc56212f71
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 5KB
                                                                  • SHA256 665e8ffe5b20fccdef70dceb809c2ff9f3a71f07da3f712f5793fdf292e9751a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 8KB
                                                                  • SHA256 03eb56b91b5d8804fddd1cf852f3c9d6dc1401d6d7d9b48e539aa201d4fc8014
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  SiteList-Enterprise.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Edge Profile.ico
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  000003.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000003.log
                                                                  • Size 87KB
                                                                  • SHA256 d36c93fe66e4f5818cddd49ae15e73c1984f7b4419af1396eaecb013422acd71
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  CURRENT
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
                                                                  • Size 16B
                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
                                                                  • Size 389B
                                                                  • SHA256 bf5d7f9671e4f7ee733c1264b961dd76ab93fd1e16a31466d943723b7e2e3c47
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
                                                                  • Size 349B
                                                                  • SHA256 2f1c29b7cd68df6f0d49c38b9dadf96ff5e8d77884f6b630694b085b7c34f268
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  MANIFEST-000001
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                  • Size 23B
                                                                  • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 6KB
                                                                  • SHA256 62c0de9a8b89584d47b95bb9332bd3a5fb9d4ddb1f1af2eaf00939a9179c6d32
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 6KB
                                                                  • SHA256 1d87c1fbac3a5988774fddfba5ce915fcca6d5b72a204da09f9cbd5d2eb7d228
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 3KB
                                                                  • SHA256 a0d8fa655b00fe96e85dcd3cddc9eb5a8df1c476bf9d1cbdeecc335b2efa53b9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 111B
                                                                  • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  SCT Auditing Pending Reports
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 10KB
                                                                  • SHA256 6fe8dd5372703bc8793e76bdaa581efde809247d659ad82ac3729c84bca5133e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 10KB
                                                                  • SHA256 b3c88800b17296928030fd41fdcecb4705db5561b309e1933a0f8444aa67245a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 11KB
                                                                  • SHA256 2e37d98c6a472489d24346ebc2bb62e762fc3a092e162b9fddfc423de0537116
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 11KB
                                                                  • SHA256 d03dbbfee8a52c6e8586229419945ca38fecb2631ad0c3ae3f7e3dd2ee5f59ff
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 10KB
                                                                  • SHA256 620e0b513b3532e48cdaf6a0c8883e27d7b726cfdb5b0aee8ed5e6796783b8c5
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 10KB
                                                                  • SHA256 1da16a5a1992260847be1eaa4b4c2b38fe4f552ceb492fcb7e90a0095c93595a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 11KB
                                                                  • SHA256 f3d7d3eb04604abe7573799a2727f6a59d5358cea4c2bcd58fa762deeb1736fd
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 11KB
                                                                  • SHA256 3652f2e18a7d673a6555614e862d31e3434f9774c9617ddea9c344596c8aaaf9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 25KB
                                                                  • SHA256 1475030c58e6cc8a1e617786a0dd6dad55269d6ef06721c8aaaf444b9817b7d0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Secure Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                  • Size 27KB
                                                                  • SHA256 a3aecb3b4567d5bbfe4c1dc2aca0f3a63803cd36255f1636332a37a228f7a0d6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
                                                                  • Size 504B
                                                                  • SHA256 b2da019fe2007af2c31529a1f26fde6f83045e3e23935b41fdf49ad59b759c77
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index~RFe5d36d2.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5d36d2.TMP
                                                                  • Size 504B
                                                                  • SHA256 588d140dbae63e4b72076d9265f7a82f00dd3f5c529ffc20427d69b65d7b874e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  index.txt
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                  • Size 371B
                                                                  • SHA256 f6d2f3175f54c24426e66c2e5817a64eac9b90f48ddf78de0b42295f2a730207
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  sync_diagnostic.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                  • Size 4KB
                                                                  • SHA256 b2e4a2c2e161a1811bdf83eac4324a4dade3306a0e8623eb3bcbda945693ae11
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  OperationConfig
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                  • Size 22KB
                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  OperationConfig~RFe597fc5.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597fc5.TMP
                                                                  • Size 3KB
                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 27KB
                                                                  • SHA256 e8f258d51adb71694470f01bb004ee7d3b82cbc9656d8d66e628eff2267191ab
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 27KB
                                                                  • SHA256 671c8242caa16b11341fba708192f197f6723f3fce105c83476cbf0ccfe59f9e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 11KB
                                                                  • SHA256 68356181a8d126412723d9443b681e056bda6fa9800729e34b465aaf3f3c5873
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 19KB
                                                                  • SHA256 50de79e559743da94af988f1b1a03becb9b5365bdac602bce263e9abe00ef918
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 27KB
                                                                  • SHA256 f706f7c166092df935987e1d097ef7f70220e12b1f697536d76aaa090ba7a9d3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 8KB
                                                                  • SHA256 809555b58ba0d0a400ab4b23c154b43820102f7824cad4e45edcf1185c78c9c7
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 8KB
                                                                  • SHA256 ef096a034a3c41671cd8f1e0ce34b87a1ab1cfd261f616eea59fc1f38dcf05b6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  RevisitationBloomfilter
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                  • Size 392B
                                                                  • SHA256 bcf70d205c506a3a01d39cb26c7c6da6b3b15a598b7de0934652efded6c0cf4c
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  RevisitationBloomfilter
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                  • Size 392B
                                                                  • SHA256 b23da86bdff4995a552c59bc4ed41df558803153b673925a2c748f150aa9b962
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  RevisitationBloomfilter~RFe59a260.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59a260.TMP
                                                                  • Size 392B
                                                                  • SHA256 7588e06dde2c82d5769d66c60d9345e8626776d292e24939bd4afa097af5f9b9
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                  • Size 2KB
                                                                  • SHA256 b5efdea30319b90d0df5410108537252ccbe758a18cba8f1b19dd3a62ad0ed43
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  default.dic
                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                  • Size 2B
                                                                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  RobloxPlayerInstaller-KYD7GGY72M.exe
                                                                  • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-KYD7GGY72M.exe
                                                                  • Size 9.7MB
                                                                  • SHA256 d30e627a8c6fec27534bf847b26cc6d1633b39f2a5dab4bd3cc8e8e8af363920
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download