d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Analysis

user interaction
yes
max time kernel
383s
max time network
384s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NzIrqD.html
Size 11KB
Sample260727-r5raqagm2x
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RC7.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
300	1084	RC7.exe
361	2412	msedge.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RC7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RC7.exe

Executes dropped EXE 5 IoCs

pid	Process
940	RobloxPlayerInstaller-GMWWKRWR76.exe
1152	RobloxPlayerInstaller-GMWWKRWR76.exe
5864	RobloxPlayerBeta.exe
5152	RobloxPlayerBeta.exe
4496	RobloxPlayerBeta.exe

Loads dropped DLL 3 IoCs

pid	Process
5864	RobloxPlayerBeta.exe
5152	RobloxPlayerBeta.exe
4496	RobloxPlayerBeta.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1084-1566-0x0000000000400000-0x000000000146A000-memory.dmp	themida
behavioral1/memory/1084-1567-0x0000000000400000-0x000000000146A000-memory.dmp	themida
behavioral1/memory/1084-4398-0x0000000000400000-0x000000000146A000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-GMWWKRWR76.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
264	api.gofile.io
265	api.gofile.io
268	api.gofile.io
299	raw.githubusercontent.com
300	raw.githubusercontent.com
302	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
1084	RC7.exe
5864	RobloxPlayerBeta.exe
5864	RobloxPlayerBeta.exe
5864	RobloxPlayerBeta.exe
5152	RobloxPlayerBeta.exe
5152	RobloxPlayerBeta.exe
5152	RobloxPlayerBeta.exe
4496	RobloxPlayerBeta.exe
4496	RobloxPlayerBeta.exe
4496	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\ButtonR2.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Moments\Reactions\crying-small.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\Misc\Mute.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\graphic\Auth\DatePickerDivider.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio-10x10.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\sparkle.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\particles\fire_color.dds	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\TopBar\inventoryOff.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_8.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\AvatarEditorImages\Sheet.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\PlatformContent\pc\textures\water\normal_14.dds	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Capture\CloseButton.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Vehicle\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VR\rectBackground.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\gr-numbers.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\avatar\compositing\R15CompositTorsoBase.mesh	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\graphic\gr-add.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\ic-unpin-20x20.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\families\BuilderMono.json	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Backpack\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\ButtonRT.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaDiscussions\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\configs\DateTimeLocaleConfigs\zh-hans.json	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\newBkg_square.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Backpack_Open.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Camera\CameraToast9Slice.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\ButtonR3.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Emotes\EmotesIcon.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Settings\Radial\TopLeftSelected.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\Gamepad\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\btn-control-sm.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\GrenzeGotisch-Bold.ttf	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Settings\Help\LeaveIcon.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_6.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\system-message.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_1x_1.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\FredokaOne-Regular.ttf	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\Misc\MuteAllSpeaker.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\graphic\Auth\classind_12.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\PlatformContent\pc\textures\brdfLUT.dds	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\StudioSharedUI\sort.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\MenuBar\arrow_right.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PlayerList\NewFollowing.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\MenuBar\dropdown-arrow.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Moments\Reactions\skull-medium.png	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller-GMWWKRWR76.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\graphic\Auth\gradient_bg.jpg	RobloxPlayerInstaller-GMWWKRWR76.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	940	WerFault.exe	164

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-GMWWKRWR76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-GMWWKRWR76.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RC7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	RC7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-GMWWKRWR76.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-GMWWKRWR76.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RC7.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-GMWWKRWR76.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296372318347931"	msedge.exe

Modifies registry class 41 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{83D094BB-212C-4AC4-AF6A-FA8CC7E03604}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-ed2b47b81f08484a"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{C9DEE3BF-FB72-4FCE-977D-7DCCF4139373}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-14d8b191232f4ddd"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-GMWWKRWR76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-ed2b47b81f08484a"	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-GMWWKRWR76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-GMWWKRWR76.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5284	msedge.exe
5284	msedge.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe
1084	RC7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	RC7.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
1084	RC7.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 432	3644	msedge.exe	85
PID 3644 wrote to memory of 2412	3644	msedge.exe	86
PID 3644 wrote to memory of 396	3644	msedge.exe	87
PID 3644 wrote to memory of 396	3644	msedge.exe	87
PID 3644 wrote to memory of 396	3644	msedge.exe	87
PID 3644 wrote to memory of 4180	3644	msedge.exe	88
PID 3644 wrote to memory of 4180	3644	msedge.exe	88
PID 3644 wrote to memory of 3116	3644	msedge.exe	90
PID 3644 wrote to memory of 3116	3644	msedge.exe	90
PID 3644 wrote to memory of 3116	3644	msedge.exe	90
PID 3644 wrote to memory of 2748	3644	msedge.exe	91
PID 3644 wrote to memory of 2748	3644	msedge.exe	91
PID 3644 wrote to memory of 2748	3644	msedge.exe	91
PID 3644 wrote to memory of 2632	3644	msedge.exe	92
PID 3644 wrote to memory of 4648	3644	msedge.exe	93
PID 3644 wrote to memory of 2632	3644	msedge.exe	92
PID 3644 wrote to memory of 2632	3644	msedge.exe	92
PID 3644 wrote to memory of 4648	3644	msedge.exe	93
PID 3644 wrote to memory of 4648	3644	msedge.exe	93
PID 3644 wrote to memory of 3084	3644	msedge.exe	100
PID 3644 wrote to memory of 4680	3644	msedge.exe	101
PID 3644 wrote to memory of 3084	3644	msedge.exe	100
PID 3644 wrote to memory of 4680	3644	msedge.exe	101
PID 3644 wrote to memory of 4228	3644	msedge.exe	103
PID 3644 wrote to memory of 3676	3644	msedge.exe	116
PID 3644 wrote to memory of 3676	3644	msedge.exe	116
PID 3644 wrote to memory of 3676	3644	msedge.exe	116
PID 3644 wrote to memory of 1696	3644	msedge.exe	117
PID 3644 wrote to memory of 1696	3644	msedge.exe	117
PID 3644 wrote to memory of 5724	3644	msedge.exe	119
PID 3644 wrote to memory of 5732	3644	msedge.exe	120
PID 3644 wrote to memory of 5756	3644	msedge.exe	121
PID 3644 wrote to memory of 5760	3644	msedge.exe	127
PID 3644 wrote to memory of 5760	3644	msedge.exe	127
PID 3644 wrote to memory of 5616	3644	msedge.exe	132
PID 3644 wrote to memory of 5616	3644	msedge.exe	132
PID 3644 wrote to memory of 5616	3644	msedge.exe	132
PID 3644 wrote to memory of 5548	3644	msedge.exe	133
PID 3644 wrote to memory of 5548	3644	msedge.exe	133
PID 3644 wrote to memory of 5548	3644	msedge.exe	133
PID 3644 wrote to memory of 4832	3644	msedge.exe	134
PID 3644 wrote to memory of 4832	3644	msedge.exe	134
PID 3644 wrote to memory of 4832	3644	msedge.exe	134
PID 3644 wrote to memory of 5832	3644	msedge.exe	135
PID 3644 wrote to memory of 5832	3644	msedge.exe	135
PID 3644 wrote to memory of 5832	3644	msedge.exe	135
PID 3644 wrote to memory of 4080	3644	msedge.exe	136
PID 3644 wrote to memory of 4080	3644	msedge.exe	136
PID 3644 wrote to memory of 4872	3644	msedge.exe	137
PID 3644 wrote to memory of 4872	3644	msedge.exe	137
PID 3644 wrote to memory of 4872	3644	msedge.exe	137
PID 3644 wrote to memory of 1720	3644	msedge.exe	138
PID 3644 wrote to memory of 5284	3644	msedge.exe	141
PID 3644 wrote to memory of 5136	3644	msedge.exe	149
PID 3644 wrote to memory of 5136	3644	msedge.exe	149
PID 3644 wrote to memory of 4216	3644	msedge.exe	150
PID 3644 wrote to memory of 4216	3644	msedge.exe	150
PID 3644 wrote to memory of 5128	3644	msedge.exe	151
PID 3644 wrote to memory of 5128	3644	msedge.exe	151
PID 3644 wrote to memory of 1920	3644	msedge.exe	152
PID 3644 wrote to memory of 1920	3644	msedge.exe	152
PID 3644 wrote to memory of 1920	3644	msedge.exe	152
PID 3644 wrote to memory of 5716	3644	msedge.exe	153
PID 3644 wrote to memory of 5716	3644	msedge.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\NzIrqD.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcf500c188,0x7ffcf500c194,0x7ffcf500c1a0
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,9261264298763197503,17270745999272440868,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,13568382996627612432,3664986137735562360,262144 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,9130347165081263763,4588992994239081318,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,18139329209169676782,15682750144233789043,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3552938438638099779,5142044112586088139,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5561912947930247401,15404129726432385084,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8023855990538506784,11234658080022173075,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,11865130481740598597,13784158494899347913,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,345628565524103917,2555441856130436311,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,9339343250198230300,13334041107212140902,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,9339343250198230300,13334041107212140902,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4500,i,3153002032418366618,6101969925383279861,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,4329912605590242937,1809955527594848440,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,10144389815499028259,16261372788494547448,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,17506607785364867936,542283231666872092,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,14903228196959501825,16894864290997274700,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,4444800624165582281,2571388921337114991,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5440,i,8395705873569619674,9971879282188528042,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5116,i,14655908093788340547,13273535624924696018,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6708,i,17131338938809526806,10612965404948975920,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5156,i,10404931021727673942,3206080973789762467,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,488827400983625223,11818888219937129551,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7024,i,10631720813546783774,14916020297229664443,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,7501049462069568996,16903715604901754460,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7552,i,11057827941160150657,13111506954351380024,262144 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,8396519173528475244,15643114932118408663,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,9882684368925736135,6484218050917764255,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,15466574793633137385,1020591531530858029,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7532,i,4195405483626812515,4728457287540534608,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6576,i,18329840046993003295,10388449953194680354,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6944,i,17382954769683511568,13420846713195831933,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7860,i,1578351727899863828,11731237405615351529,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8544,i,4857937990598380115,17924967051132441119,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,5053208965391995869,7490352820978074733,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7624,i,5430126259034958055,5523975010372813438,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7996,i,3805304818365712309,11566509735524309342,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8216,i,1426283814826999925,1152767204832023016,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8076,i,9196890238554384524,2415695867045967395,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8492,i,4741930996063998350,15509042990318127065,2097152 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,13631787751601042004,6000304371701616661,524288 --field-trial-handle=2268,i,3962516311003453002,17700453227526739111,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:8
  2⤵
  PID:5864
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-GMWWKRWR76.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-GMWWKRWR76.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:940
- - C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe" -personalizedToken GMWWKRWR76 --deeplink https://www.roblox.com/games/142823291/Murder-Mystery-2 --webBtid 1785163826629011 --downloadSource web_game_join -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 940
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 828
    3⤵
    - Program crash
    PID:1776
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-GMWWKRWR76.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-GMWWKRWR76.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1032

C:\Users\Admin\Downloads\RC7 Remake Legacy\RC7.exe
"C:\Users\Admin\Downloads\RC7 Remake Legacy\RC7.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1084

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x298 0x39c
1⤵
PID:5956

C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 940 -ip 940
1⤵
PID:4760

C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 0bf6d10b71b025e36af8802335cfcf5a693cb351731e6d3f56c9a9616ab2c4c9
MD5 6a2df518995fce2ec395becd750fbb69
SHA1 8f40283d158a0db74743755bc6e356f3de4f0e21
SHA512 ff1c2fe1cb904a2cb0846b3e314e4f2c02aa2945b389bd94f1ac7bb7d66058d222970c7334a577430c1f2498908f50d077560c0b032bfc12958179dc3c4b8e88
SSDEEP 196608:Lqrajgrui7KiWARoWQb5amsxUMRUFUnvTBDbBQ03O:Lm77KWiamsxbU2nvTBiQO
TLSH
T1D8A6BF22BA00C032E8D100B296BD5FFA997D5A341B3954D7A7D41DBD5A306D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.dll
Size 20.9MB
SHA256 a5e1cf709a64dd3922e3d81562524bccebb9762e1c693e97f09f65ba88be6f52
MD5 be3ef08989567375607175b90e935dd9
SHA1 a9672e47fb68dbeafd8fdb1eb2f684616e412b8c
SHA512 c3838706c2493c4ebc70d8b7ca89104f1cadb146f1369fa818877461f1fb4f3e15f2adf874371aa64ee1acd06e90334f1292e3c2cd71bb3e2860cd67f777ccbb
SSDEEP 196608:uCF8Xlf9MbJSbb8p+jq5OhtPz0aXmgwCDpsyN:R+XbKJSbb8sz0aXjDpsk
TLSH
T19D27C04EF4D21AE8C0A25078E65F57E3DA32304C4A687EF787D90250363268D6659FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

35f7c089-4047-459e-bc5a-65099f49b0a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35f7c089-4047-459e-bc5a-65099f49b0a6.tmp
Size 13KB
SHA256 fc6a3bb18f5434bf2c7a93fc413a01b48e3ac37d13e23a19f571180ff4848232
MD5 e26fb033b19754957054d92b3fe17a70
SHA1 2576c6017a2b4b7b95ee9e2c52b2a978d4a6f26b
SHA512 07accc6aa9acb3a99552cfc3287a10612a5ab78cd6148cb364fcd6e3700e645b472fcc3274ae1dee9d07a7635d121502530beff833fd8db4426b1bafca8e7465
SSDEEP 192:sxZWRlyM/jK1Ml8MWOQ/f6sm/PG9qdpmG8HW6+WNBjR/YzHhkLIg55J:sxZWfuOQ/f6smXd8Hbn/5J
TLSH
T1B952C916AB34597BCCDBD20AB941BB53D6F55462D2A40E44A9FCCB0C04E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 eab04f028445c43084ac7c709e8efbe992d00e1d48f5c91d9cb57d4e5ee6953f
MD5 42e7a6abc00e165d9468782d6dafbeb1
SHA1 cc149b210d1563186b6cf50a42ce30070a71ae35
SHA512 82021c81dcce4d92bc21e2b3f254d073f3e245bcbff9783fd25f72b255488f51cb14fb3446718c085b4b7b5b751031f55e75bcdb4401101c870b0cff2e3b1e95
TLSH
T120E026D706CAE2AFA304A44742BC630CD3F0370E97C8AF0E674CC5897283040B3E26A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9511aea6d36170d134d85244b11d9a2574639f40cbc51e32febb930dbdba3881
MD5 c7e87f0c0c41119997ee89800bc46897
SHA1 7bbbc591864cf29f776eda3358259277c9ffbb6e
SHA512 1d1c1dbbc8be88d620a1ca2c99626f15d094fed158d0401446f7ac0ac8fe6741e3c82ac1b7b15e93428a676cd9c3dd6a0502a30956690da4648a8cbb0474a5f5
TLSH
T19BE0268506C8E22FE2907497417C630D83A8B71A93C8AADA170888887383450B7FB6D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 203KB
SHA256 9232e04310e0b7ea22e9544e0be1281e22ecb5e07d98a151690c83c4cd1ce653
MD5 f6af8ab8ee383ed1f206ab33f237f11f
SHA1 c09a3bfb96f0c022135fcfd3b15f387629a02eba
SHA512 83264429d1bcd32f2df31d3cae3797618197fcbe7a2a407485f0bbd57528624d7f0ec18ce685be99e2d7c5c710b16ddb96662b91edca42c137a7e770cdc039d6
SSDEEP 3072:7O3lMHlBLE1JgMD2hfzaa0Q9dnx554YIMf7kZN/agAQvlEVMobkbAoDh:7XLE1JgMD2h7f0+n54LCmd7vlAJ2Dh
TLSH
T1E31423F13B562D19F70AF5358942089475FC58F3BC98E2F12B09897CE8C5E724490EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 256KB
SHA256 dc1c6406f697b169763b4d2c9d04f9a085d983ded648dee6a7b9b0fc8f384c76
MD5 cd110eac717cf170ac3577e0688abfaa
SHA1 fd0d805961eb495bcba9d4b13ce66f6849be486f
SHA512 9d976d933ead9dffca80cb4557120fd0d986025ec874b52fda18a99ecd090fb99c698947aab62b7b18c8cd7a0d743fe39407457a32c39bfddba4399b532d6711
SSDEEP 6144:jrSg9Zl4ouaEN26aQiAPZf1f4KOlP+lIwx:jGZouaX6JPj3kP+lIw
TLSH
T13444E1B4F683C781EF4376F4F0AC2DA30F6606CA61E3591B49613D11A905AB5E31FA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 256KB
SHA256 466f8eb385d57f932d7b46685004054301827b4d83a3a4cb513bc06650f616f7
MD5 5ef093ed6528b8e11e8cf435c727b29f
SHA1 6a7bdd45b5902bc697b38d70f9841606333468eb
SHA512 2968e1b1f4e0abae5c90d9bd47ef4b8ca75192476d77149bac5767cc80a89e9fb0c4528f304dbae1222d7d2448fb3c218012e39f37b37d03bbf7f2b2b46e45cb
SSDEEP 6144:LosjB1eeQGcU8TePeFVBMsxZtU3VuxnT5:sMzyGcee/BbjUYxnT5
TLSH
T1F244CE74F3C3DB81DB436ABDA43E3E770BA600D161C8091B85535E859429BB1E727A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 512KB
SHA256 02b0a8ad7f3e9727b28cebc2ee1663712b990da7cc10dd96025420be6315dc94
MD5 9c4994ee71ed65500105b3f15520946a
SHA1 d2b907a0d4e91781e6a84acc400658e2244d9c12
SHA512 6e23ab30afb45947f85feaeae82cdb3603b250f0175a346820ea9a125bffbd3d57d5140a92b8c0af36e6cb60aca2f51fedbaf0796a6834cff95b953658bf71fc
SSDEEP 6144:LOudzRoFS0/wxHqywh0aNqbi3oCKImWcbL5MSRSMzc1DN1cGexAlfE:3dzRiwC2at3OIYbzRSWc5N1cGexwfE
TLSH
T136B4E0B0FBC3DB80C74326BDA0BD3E371B1204C161D94A0789537D519461FA6AB2BA7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 17KB
SHA256 66f42dcb1309f31499b2372127e0b44e5bf84becd081c361dc140bd991cfe7a6
MD5 a02978a1a3cf9ab5bce84b66d8ba9021
SHA1 6ca5c71831a0bdf5856dc22cb3581cdef038f259
SHA512 22e6a6768f37ff0d61c1b4431ecd7a36b91e0d127237147debdd2ac34439f56fb36d2a62d447371cbfc88e435cbdaefe202bffb7b466b4af3c0fefee75bb1e41
SSDEEP 384:OEftAsIC7HB7/+8xczO9dMrSBHjwzhaDeqjNBE4AJSH74HMIq+:O66shHB7/X3WzJk7CM/+
TLSH
T1A282E0104D7C12F12FC989A4734895E9495C2A6EBF2E03138698A3C48EF9F4B366154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 19KB
SHA256 27b38334127d248f760ded14a3441b6ce3972eb110f73e50e1ae76dd16b73861
MD5 6a63dd3b4bdd8e27df920cbb7df0142b
SHA1 888febdc97e6e27e637e14b0017ce8c3c1b2ea09
SHA512 d691a06e50557c66496178460c13628b215b0616759788a8386c2bbec15d6be681104db6616a0840aa4941bfbb297d6cc345724957cba12752e1c2db675a8603
SSDEEP 384:dWANsy+GeX7PyAJGEXH5K5ldwQ88WAtM99LrUIra4dPTPxfNcUpxvRKY:dLNsdGeXbjJGEXH5K7di89tMXLrjaaLD
TLSH
T12192D128BC2F1F4A57A2B2A1EB2C51825CDB9853A9D5502CCD8E25C3706F1A46B47DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 17KB
SHA256 17bd64c4f43d604309e87d916f9233115180c0dc0cb5a94cdda36a2add279da6
MD5 64c1bca1e5194269bb0d451eab354a00
SHA1 42a610220f8d89348e0b21e928521bdb681e7431
SHA512 fe3615a09e7e83f01412f62e2b9d6c446d238efe59cc48edde5d50729f1ff700d9772fdaf0e64ef180c068dace00abcd2e284a2effd14db90b44a18fda9a870d
SSDEEP 384:T7ua+M7O7xk0Ib68GKHk6hZ/IwuXClM3lz0EXw8OHI2D7PwwjmTT:T7uxkZb3k3elM3p0Er2PIwmTT
TLSH
T16582C0C04F7AA46E28DB99B9C436CAFC716B8553721E19A1C07B0EDCCB050B29F975C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 31KB
SHA256 6fd4c09b46b120a806bc1152a994808484d31c647298ab1757c0ffa7cd002839
MD5 ff7234df21de0f35b6c517109af31c44
SHA1 3ead0e8fab08662148c41d3b808e2a18bf0f241d
SHA512 2f73e3da573ddbeb6ca898c9822acb0ca32a3ec131b6b22bf71ffc472e7758fffb31e8a865fb436c0e1bc0bd4c958765e1a0d0b53912dcc4e656b330dbd2282a
SSDEEP 768:HDGiScysQMsaaJEiCoJ0Nsy6+zxNu72oZiBVxZW:HDGiScHj7aJEiCoON56+zNogU
TLSH
T102E2F24F2A5568AB986642511522CFCB00FCD98D8583F2FC45DE67BB13CF746E00699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 18KB
SHA256 d7ef9aab773cf480f0ca085413f029018000875397dbd7a09c8ebad7cb20b484
MD5 b4f3b4952950c80c8662f2e4bf6288a2
SHA1 a6d2ada379a6e978e61901e7e5edc837286b0ae0
SHA512 536f628b4c69f0734654e4b819f470c50fa8c1c513ec682c4472288bb25ad1220c39ebe0cc85a14ba441b14902a3859a7f2440d8b6fd3344b5a5199fa5d24c4a
SSDEEP 384:IBfFDHChBod0OrjOj+aes0qSA5kX86g88b7PPaigc31Cf92JY6TeVs6qSq8QP:KbkBo6CjOaaehqSA5k0SigclCQCg60
TLSH
T1C182D0D318BBB9AE68549646FF4147058B3353E8B28DBC788E4931431F94618686FEE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000107

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000107
Size 20KB
SHA256 2b7199b27046348c4a13826a0fef149fcf2c24c578e262db6dfe2b1a98435532
MD5 97f942306fb8bda13f1f8d1257a6cdac
SHA1 086a84858d4ec99800bfc9ce16f3eed2812fed9c
SHA512 6701ca35cd29fa3d1f84952aa66b7e2a0298538fd8b666a42aa489986a281c401a1a765e37496d1c952b85972410458d223275095b50458594356d0be62e053e
SSDEEP 384:7d30isjmAsfMMenA1KY808+0XtookeLVETGjKV+5UdjYKB3KTMd6rKLNVuHc:h30mAsf1Vy3X6+WGMZB3Ki6rKLNCc
TLSH
T11192D08766E8483D03085F754DC72E4B85F9EACEAAE924D93F1514B1AE24A97E9B0084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000108

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000108
Size 23KB
SHA256 d3c8b8e565b662f32bb7fe8d0af86e4943311ef2d31bd3397d6ea55060bfce06
MD5 0df0e528b841ca52827e905125f55c73
SHA1 77db132487e19a242403e18f849770866c19820c
SHA512 ccece986d274e9b1bc8cff53f2f5a84f4c763bf7b59948d9e5eadc9a19562c4e432c78a8a7ede30ce6fa702347fbe77bf5705fb95bf717014186c7828a79cb02
SSDEEP 384:CSjy8bAzZwvYwoi5hx+ad2ElEnO1cCKwIgCQRu5BlwPyh1N/4LdFowN/:6bNwv5oi50nODhIg82q5wpFo2
TLSH
T120B2F126AB0F7F7246667638E47E1233C79817E14C8017230EE8FC6616D2993DC227E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010c
Size 27KB
SHA256 cff10e9d9b2864cc1b1321d1db204728eded77f962b3f26a3a7a5f55496dcda8
MD5 b8a326c40449141da2ea4c561ac9ac6d
SHA1 e22b5a2b1f0e2a8685171f06ab1343fd0b239f78
SHA512 bdc689c9ec19a27f1897faa2949964fe6ae820303835a872ef76cdc28af11fd906842faa7ab25503d78b28673aa87345797e9cc783c84137286a9da3da18210e
SSDEEP 384:4Yi5Gy8VIZzWUgAgT2RhdusJmzdb8Atdi5iEToWrz90aw45QZ8ufjMlPh670CzFV:7V7UgAYqddwNTiLzqaDmyi7vEyZ5
TLSH
T147C2E16F49CB3F64639F5723642CF1C8264B54BB2B40EE11036697529EC4AFCA8426DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010e
Size 104KB
SHA256 c768ea297e8202065782f7bff6949b8930b93e161469253cf793235ca87b8c8e
MD5 cb9674427a1e08252f1592ad9a291f8b
SHA1 6d8c13dc21f568fb2f498c8de3ee428a67a4b9fa
SHA512 59ed90b389b9a0b1ce45a59b262df086c2ae958496e8f065165bf171f4eb850d7f5f518634860a7ae1e586054adee54fde331ab1fbed4cb22fdae151e2079390
SSDEEP 1536:Nozd7HYd9e8g7cMFG8riSvLGDAvi63aeLHu5yvsj2/cUxRbincRgfjYg:o7HYdi7vGe3GkVDTLUEgfJ
TLSH
T1ACA3120878E4C325E3EDD34365A05C311C27100FDDB794B16AD80DF5BE69AF56099B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000155

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000155
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f7d814c3b98d83435d2fe2011fb926108895a22c9b268bc5c43dfe9363a6a392
MD5 bcb9c7c861cb21c5a794384b4e3199c3
SHA1 c1c2c0dc42411f74e273b2b0941fe36476474644
SHA512 b7afbb8a66eb577d246f3639a13dcce9da61b589fa840e2ca25edfb1339358080138069bba107e243f9435cbd0d186718426e133627b1119231b0d124a2e3412
SSDEEP 96:WcMH76kyWOJxw4gCi9VFvVXl3hkZTUsEKWo+U5vQjh:u6kOJIn/F9Xl3kTJEQoF
TLSH
T108C10EF80EAF1175F7721BB173D41E44B5BA85EBF647BEB78244D6B4790B391A188002
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 5ad490d7611dd85b158bfb5a045582f5881b68245018a13d8685860cb60a1be9
MD5 bd1ab2a55761fee4f65e604e52286313
SHA1 bb7e4180b406f47776ceafef7d81bca570e1856c
SHA512 58bd964a429154e8dcad56c85dc463e0f549496505469be9a6e5bce4a1d370f33ad31d8a3e697d75d35e2b084dcc11e4141ce9d5534f0adabedc7c3c7e1c30fa
SSDEEP 192:BzOyFCnhc/kdvXeowXOJ7bKKuExXlwcT3Um+1IegiTv:hFNM9v8OVryH1Ie/
TLSH
T16E523DFC2DBA90A3FFA126B527D46D4A7BBB84D2F9036EF75004C575B98B3D02884016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1e0407199deb4ec87a1686f595b442be846e35d40d6c86c7ffdebe094d0a1f76
MD5 aae5116a28a4bea6d7dd5c4cd39d9911
SHA1 88bff6025d2d370b2d2a51ea0f288687d0f5a187
SHA512 7af2726624960de9b56bc78271c33c5ee4ed43bac1231448cead3574ab27594e2ed59c0866a6fd51ae0d7963a893a94c56641f4d5fe64a58f114bd0582e95759
SSDEEP 96:UcMHe6kyW17xwGJSyCi9O/vVXl3FkZTI8tfKW8++5vQjvQa:l6k17ayng/9Xl34TFfeov
TLSH
T15ED1FDF40EAF1175F7721BB1A3D45A44B5BAC1E7F647BEF38244D6B1B90B3916188102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 e5c4cc28bb94e26513a46a313c122c9ed7f4378f7bc380ec66c5586e108c87dd
MD5 261c995185b612ed33864a13a86cfbdc
SHA1 b86a650dccee4c36fdba3bac33aed48fd54393e5
SHA512 69e475853f8b9bb0faff8854cb26fc55ef55c9981db20f64ff857615442007b3214f3c817b99972f65f6bb2d0d41535df8817064f473dcf530b08e742b586edc
SSDEEP 96:FACWrAVnDXSV+liYSbCwXipiQJVfH0YfgN6oFd7XlWjkZT/VcEJxR4F4ivQTgPPE:2CWan+EkYoXaib0o/7XlWCTiihi4IPE
TLSH
T12932D9F86E9A90A2FFA126B12BD42D42BB7B94D6F9076FF75104D6B1F50B3C07884441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5943b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5943b6.TMP
Size 3KB
SHA256 c1be50d5198f0b3657d3250e9fa727af91db615291b2d63c0db8b08a9abbfc49
MD5 11be67d424b1dc9cf402faf5aa2aefeb
SHA1 68042ba245c6601b7c2e6950bcec14f439609751
SHA512 168c676e51ffaf00ed97bed64e3b2fff7031897f7c76bee89722a857465e0a2b2cc70d219406ca7edf7fa974d190ca439799f330bf1aded93ecf24adb52c0ce5
TLSH
T1C181A7380E6F00B5F3B11FF2B7D14B44347E82EBF993BD9A62816A74790A761B2C9404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 17KB
SHA256 164db6e52017ba220e169238ab964ee1cd558c748c9fa894175994fb14d844fb
MD5 274813737e0c05e3ff9f4cedc5f6ace4
SHA1 b24c68e539a25b979d5a369f8c11f0e2399baee5
SHA512 aef6ed7c6353acd5b3b7f545f38bdd1cb91e25e195955faedd536fa742bc1615ff3be683c3b329852afeded791797e14aed0bde3a1aa651f3eaa64e39874c463
SSDEEP 384:fBuCZTAPFyaCao4SDIKfWIOIrIHIzIHI+IEIzIRVx77LkMyMA0i30:JuCZTAPFyaCao4S5fKVx77LkMyMA0i30
TLSH
T156828856B5F9060AF27B9E7BA8B21BA14D7ABD452D04D81E68A0725D4C31F40CD33F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 343B
SHA256 7c559297d00a709c18fc3836c8107895f4f695dd0d6c3a071e2b0352ceea509a
MD5 aae171c4d9875349fadfb68a5b2d98bd
SHA1 a26e17c32484a66444b28a6ce9b9117418f86830
SHA512 3b423f96475a25942959cd1dd49eb1ada9c2042d41f02ff5a9c2aefbd1a2bfa05ecbc696260840d9d3f5adfa49c61c655f77cc89b079103bf0dc8b5027b87e0c
TLSH
T10EE0DF7988C9D23FA12460E60528FF0ED6B3670F96D86EC65F9CCC54B143088BBBE191
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000004.log
Size 168KB
SHA256 a063b8e3cfb2a8700cf4806856c66d9c223b484677d7fd61ce13ab7205af1551
MD5 5f58dcb23523094e93fa52cf302c1458
SHA1 30462348db7a51b07c93e3741ae028b9deff60db
SHA512 3010017adcc55388624164b78657e10dce6a6c35ac3460898a0f3a566ad78c96ee718d25b8eddf2cdaa75c69ea4cf849fc637554b8730b8e612851be2b0ab06f
SSDEEP 3072:DRRZb9RpXIdvrrect/pHYJcz+HGca4/Nf7VRFyaqnArp0+wcZNoq5/OOiap2R6Ei:mAT
TLSH
T199F37806F7C3D909C0FF847BD4204B9B537F7B487F519A1F12C0B6AEA93A4464D2929A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 dc3530bfe54343283c68a0c7e3eba93c7213652d8bed5e55615f4398dd818cae
MD5 7a7b308c810b37c1b60d972963e44a13
SHA1 2581f214ef4c85bbdae7c9e682f0778906152aaf
SHA512 5179a1665ba46caef334caa9c70fce1a37a7480764faf2bb628ef60979d590bf73176d8bf093548b796fdc9ca130293b34e744c5705d5ca8e38f267ecb6833fe
TLSH
T1D331A7176BACC03AD5041B3381E302FD87F573887D2156413D78A71E54276476CE7325
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 671B
SHA256 ec6a988094f706bfac1229fd856608d2c85f89bcbd3531db3310216bd084e5c0
MD5 1b65f4ef0c0fd15645b6793823769d7d
SHA1 450b57215ba619f9f5b4af4b1cbd01998fb325b8
SHA512 f1be58983552580945c2dbac446e4c798a05f551daf9d5d901e0d5208522c8a89827818557201bf5b01edc71cb7ecdbf7f52f2aedb6c566f8fa84af538b92232
TLSH
T11301C0A74399B13B2741E1A2833C3705D5B6221E964C5F499BDDF8655A81409E2790E2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 100B
SHA256 1b5782b03a058fb8e1b7b67d6d37b40aa3c5288c07b26e436372b6dd81c4fffe
MD5 6a4aa49a4b85838170986b20c4dd7290
SHA1 95a3bb2e832c5f5c3c96f621d4fc1079247828d0
SHA512 b4511a64bd2adff01f0293d70193bfa1798021404c832b9a9b5c455d93681ba06b8d13e378ecd543c751f04d1232de9ad6adfaabb646a3f45ef5569f1c1f8ca0
TLSH
T108B012346BD10C59D162153894BF41C485255050710BDA152558402C0402D004D48207
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 876a908ddf92b0da5d9cb176558456c4a07d2c0d86c25d2cde13e43cf4aa5939
MD5 0a3b8af94c63998033e5cc2458f1bc5b
SHA1 f27b291fe9d9ae2890ba3bf1af4663c162528236
SHA512 113c194e10ddd050e592d2e8fe0b258ad23c472dd9fbdcb29f30e763c90084659f45a876b955763bb24cb6198a7a82ab0c739b64abd5f718a5f1b58334644277
SSDEEP 96:D5O9GSVvl/zL4GO5RBcwBH5tii/jSP+yqXBM8ObZsx:D89vVvl/n475HckZtii/jSPhqxM8OFsx
TLSH
T12FA179F7C3E9816DCD2152F0AE14AE1BCE1D0456836C3D6A89D4AF47A3F2871E101B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 3d0594b7341d2b592b421565d327932a2d5d4c394723163f3516ba0a0110070e
MD5 903685f317849f8d463f562daf7dfcb1
SHA1 bdc2df6be8dd729924dfec1ad4000b276e6dd5d1
SHA512 6634cb42fbd91cd695299eb90ca4d48582c1c6d66db8c594709f9bd43c3d42dac34242a967f0419555066c45d55bb008b818e32f9dddbe7845b65c0a17a19572
SSDEEP 192:D89vVvlpEQ1Gn4kSPhqxM8OFyxig+zGyHxuAX9f5pvTVycimGcUQAGHn7:D89vVvlpEQ0n4kSPhqxM8OFyxig+zGyz
TLSH
T1EF02CDF7C3E9866DD91152F0AE14AE1BCE1C0512436C396A85D4AF5BA3F34B1E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 74e2dc443d015714cc8204de84f2dd7cf658bcebc973f7606fd062a217fb0275
MD5 586e052a3f4c4de90745a98107030c66
SHA1 31e39aed810bdd69f8e1a7e8b1c8f4c115d29e4f
SHA512 0db7c5255b8bbd38f33ecfea1bdc1575a71930f4dbf705d783d10e5f02a553223c99f59d0e3d586ae1289d063da9ba40510bbd307762a77718b3c9f89b2040e8
SSDEEP 384:DW9vVvlpEQiAnen4kSPhqxxiLzX95pvTVycimGctaZ7mxTUfnMmez8CuBLLvBHjB:DxF
TLSH
T1A2429BF783F5856DDA1252F09A18AE1BCE580521432C797A89E0BE1793F35B1E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 62555a45f36fa5acc8827fca5c94816359c4cfeb432f8becd80801b6fecb1ad3
MD5 bec1af82ddff61cec25edfa81519ec12
SHA1 f49a0f70963cbcc80754030bc2a4f94dc864f37f
SHA512 882ceb8c00d1fa58de63cbf5b4a9ebb43658d41cf49eae4e553287f7c991563467caff1c5302d30b730816fab2d55ddc7919aa7aff9dbe8d0ee6b2ccda497170
SSDEEP 192:DWB64MEpEQ1IAnPW1kSPhqxxiLzX95pvTHycZ/GctaZ7QTxTUfnMmez8CuBLLvBr:DWB64MEpEQiAne1kSPhqxxiLzX95pvTq
TLSH
T110329CF783B5856DDA1252F0AA08AE1BCF580521436C79BA89E0BE1793F3571F101B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d1296c8cb2cb38ddea42c11580492c19cac0909d27f44c7c6b7610f41ed1d3bc
MD5 2574cf42c9d5d422ebf5b26f3a2a661b
SHA1 f8db163d44536ee4deea738a5d2195aacd81d2c7
SHA512 7b142e11a4337ee59a9cea850edd3f7711caaca929534e78bca06794212d03a02c55a99098eef48ba53aa667aedf2b0cb2d1a98bf94ef3aedc8c6841fe195cea
TLSH
T1CA719BF7C3E6826ECA1152F0AA146F1BDE1D0946436C3D1A85D4AF5BD3F24B1E112B8E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 45da2c097f4341d307803cfd315fdf689b3c64b8a1fe984aa1a928db40d594af
MD5 fed8737d939761d003ea47870ab830ba
SHA1 eb1f94896c0e84000c8a63e91b66ec9e779b2ff5
SHA512 726c00bca7f8c7cbf4af0b52fe8bacd7290fd3452594277433c881ceedc7d0cdc33aad86f715d356074725f403686caadfc2be68781adb825b1eb4af4ac9f68c
TLSH
T1C9D022A3620430B6A5AC3EC144AABC8FCB7700288892EDF824E098B916328AD4617281
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5b8a7a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5b8a7a.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f2d6058298d871823a61ceeb3626d292e07391c20109b6ff762294d6ec3c0d3c
MD5 e12012ff01fbf7e61aa3339db70e4b3f
SHA1 ca34ae4e7fdf1907f32216704aa156b372cdf4e0
SHA512 505f8fd560e55115704e62efacf240052de37df6467ffdc6b31d3166166914d327c0baa8897d86170553bb156f4a6dfd84b7264dc2d3305c68d114c3b970eec3
SSDEEP 192:sxZWRlyM/jK1Ml8MkQ/f6sL/PG9Idpd8HW6+WNGYzQhkLIgrJ:sxZWfMQ/f6sLXT+HbGw9
TLSH
T1EC42D816AB34997BCCDBD20ABA45BF53D6F51472D2940E44A9FCCA0C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ef1ffe2ce9f5668ce3d34e03466041da1d71c9fd32459be89ea1152525a4267e
MD5 95dd7025874457145ac7330f421ac032
SHA1 2292336c22085e590b477963118f8222d224c32b
SHA512 309be3659465257a146b2aca0d8fa6846b3e301608b8f73588a8bd21d21a4ab900e0fa30193154b00daa7efff053a787ab7cd656060755b66e9ea5513ad4047c
SSDEEP 192:sxZHQUnD+RlyM/jK1Ml8MWOQ/f6sm/+GLbKhdpmG8HW6+WNBjR/YzebkLIg5jJ:sxZLnifuOQ/f6smmBV8Hbn/Mf
TLSH
T1F962D806A634497BDCDBD219F9027B53EAF81466D6A44E44A9FCCA0C04E6BDD2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 5b6c2c7da6d4561319551e2e660d1dc63368bc9f0b414989646586603e42327f
MD5 e319767aa67923b750ba9fab0bc110d8
SHA1 d48fecb410271751bf1e5a68664d516ed18b02c2
SHA512 278d7ad38e8aa55797e7116551937b78c998accb62c7501b1d3309a200079a69569d317e779f77b4ff772843e3e01feca7580c77d81e4a21e434b84a4361dd6d
SSDEEP 384:sxZLngfqLm4Q/f6smmTlRiHbOEM//WUqmor:sTgiLm4Q/f0mTSHbKWDr
TLSH
T15492C856A6308977CCD7D119F931BF56EAF41462CE614E58AAFCCA0C04EA6FD231381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6f96422e4a2de62a2d1290169ab201ec764169f171f59958d304178f89d98870
MD5 0cf4c8b901b1c8eb888bee0fb9e89788
SHA1 726538bc9a6eb6739ebbb968d6ee879b6d9cc227
SHA512 a2a955e86dc49283bce6f60e0fc535ac29d3c5ba97a7cb42c9c6ed7f9ca0d70ee9c6f97140ae510f430a4c20d1c1d13ec9e7739133e28f15819d32945d1b1986
SSDEEP 192:sxZHQUnD5RlyM/jK1Ml8M9Q/f6sm/+/2rbKVddp4ypmlJHW6+WNwg9KqjR/YzK1v:sxZLn9f1Q/f6smmeyXb4HbEE/hf
TLSH
T11872F906A634597BDCE7D219F901BB63E9F81462D6A44E44A5FCCB0C04E6BED2313C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 01fab3ae714cd9f31b4baf41112d0f293c0e13a1f7ac702d6cb428674a3197a0
MD5 a1ab33a90569815c1a6cbba42bd7c2a4
SHA1 9e7b7e90c87d59995acc22987ab92a1addb9e5e8
SHA512 447593a2f9df23e999c9567dc44d699fb93fe760aaaa27ff355f0f8dcc0b52bfc44be3e3b95ae42697a7eb3b05bdeb48d9286b08ac93e7151ac839c9d7f6d077
SSDEEP 192:sxZHQUnD5RlyM/jK1Ml8UQs9Q/f6sm/+/2rbKVddp4ypmlJHW6+WNwg9KqjR/Yzv:sxZLn9fqqQ/f6smmeyXb4HbEE/cf
TLSH
T1DB72E906A634597BDCE7D219F901BB63E9F85466D6A40E44A5FCCB0C04E6BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 e94dbdef90c89236267e82c825aa586b3af7d1849a9b752bbdd9243f8b61fa2a
MD5 3e47e9ff7cd0dbaa807f3a5bedc1ab5a
SHA1 7d227118c5167349380a6c6bbced97b6703f81dc
SHA512 2236f54ea84d8ce3666cfd9d6a1b00f2c724d687a9f6d3154e272e28773d4d94b2f898f5ddea58dfd9f93aca6edc865b7992567e822439b8d7ea747bc1601207
SSDEEP 384:sxZLnvfqLm4Q/f6smmPlR5HbOEM/kUqmor:sTviLm4Q/f0mPpHbqkDr
TLSH
T15492C85666308977CCD7D119F931BF56EAF41462CE614E589AFCCA0C04EA6FD231381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6b1739f68be1883ce38a4ea8e67b1bdf1af02b7346a0600fa5b6c5926b72410c
MD5 4179b85e69406a3f4775dd769ba20254
SHA1 b8a79f0c88f01a3b64aff559cd2a0ecf919f7193
SHA512 dbb3a24ebb4873765116564d9205b4b9dea0f9464db0e68df549b289715f10b34beace8f0799f59161dd3792bbad0dfd364de7a31ba918eab9a8b745c963b526
SSDEEP 768:WRW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjRroIGiRY6:WRW7kf0Wvqidau1jaa5LA3jqH6
TLSH
T17DD2FB3B684CCB7E4F840E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0845575e-fd78-4387-9916-6280f1410048\index-dir\the-real-index
Size 72B
SHA256 861af956fdaea3db2f8f8ab72baae5f1b8b20b4fc04c1a02f015abe2e5173460
MD5 58e478b2f24b4d407a3a0c91fb31b011
SHA1 4e2f843461171356f21675e9ee2c8a01c5bb57fe
SHA512 8430ef61bac750022ea162a41aa55c6749680ce34abbd41944ec615016e06099dcc7d42bcb6b08696253521a155eec43ee8e1245a1205a07d843c6c7c9805339
TLSH
T193A0022159504C19C12503706AD7228963206874110302179BF6E0B5A9F21C5D593481
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0845575e-fd78-4387-9916-6280f1410048\index-dir\the-real-index
Size 72B
SHA256 2fc604a24bc47df33c9a8a743beb1374982e8bab22f85bad9a44556b50ce25bb
MD5 a64299e6f388402679e9fb0e2bad929b
SHA1 13c0843970588332f354479bf4bfc08a3fb1f20c
SHA512 497474bdafcb7cd741b3542ec23caec7d8a9a0b773d71771d3bb795925014fd1e7b497710a79dc08ed9a5ffa71f75222a31bd47b19d30d5570f09bb68522a095
TLSH
T1E3A0021825505715D56513741AD102C42F107A172246521381B8D046C895989518B499
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593668.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0845575e-fd78-4387-9916-6280f1410048\index-dir\the-real-index~RFe593668.TMP
Size 48B
SHA256 48f5e71b92a7a287103fcf4c0c9441c1469bd47c9998c2ea0691bcc0587641e2
MD5 b12a0ee89067107a37c6462d39c92a9c
SHA1 34edd6175befd091ec7b08b7b34d6a634133fcb3
SHA512 b5f3970f2926f099c20749c6f9a166e80806895cd308ba0b41b99e08da351ddb792f823fc14c3a782f0a9dbf25edfe33a123bf7a54ebebda3803d91b7b5eee9c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 864B
SHA256 3f6624872f5de06ac87f3764c265cee3b819ed1a1970214da49ab50a0679ef9e
MD5 9547fef9aeae78da5993d4f0d43077b4
SHA1 0c68c68b8ffddcd816435bbcce3e1d3ed14198ce
SHA512 024ad79641a56a45bef5dfb47e5398015fce3d6531fa532e6def404890b604214e69793497c661502cec590fecbb382a1d63a57d3206c145d99473c9d2a59ec5
TLSH
T1A611D3564EA18D3FD95901B718FAA0E4F33159DC5321E5A79C1C1A762C6734968071CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 2KB
SHA256 62cf5a4797a99b00800ba1e88d365db699f254a4496716efc172df7347db8571
MD5 7cf4a17e887de025c3ef1ba4887abfae
SHA1 a39dddbeab4c0529a9e341b8e2c6440ee1f8631b
SHA512 1decee8dc19b43351c4c4d86894f29bb277e20d347db9849a7b09abb4395893c521a02c99c5597ae0248fd8c7f06aad56baba9573948afb8b92b8e21c21d4df5
TLSH
T1DF51D88E8C865E97DEAC11F3A4FB04C5333228DD4AC88F0B6D9CA530ACD322D2D5B514
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589fc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe589fc5.TMP
Size 864B
SHA256 6ffdfa9bcd460ebaf2e0d980c4958674e1a785334ca42df71f19feb95a7a4bd8
MD5 ee09a9529b483f939cdad073a763535e
SHA1 9d4e29cc2885418f6bce77116d1d08127a979e9d
SHA512 9c7efc73f34d615c8e30c8f964c9b0289a1b053d45f34182fe88f448c8db0fe6530f8328105ac7e2054de1bf925f67c3ab8f819535d90d22e3a1e7d20d7b577b
TLSH
T15911A25A4A924E5FE884517B1D95E0B8F3314D009312F7A3A42D197A9D7A7CD59070CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d841de8d-c56b-44d4-bb04-c5df20c573ba\index-dir\the-real-index
Size 72B
SHA256 6feb49ef1842925c03ca04ed293be1709b85546462e919608c159bfffcc04926
MD5 63639b47e371c6e1e94c2126077c15b3
SHA1 1750aa6bb427f7a94b46fa5ac6586d8809931721
SHA512 dba36d881bdc87f32ab72d987caf21c68ee21bdbfca209d725712e8b4521586d6ab6073e16dcea60390c4207d1e5f3b38352746cfdfaa96283daabab73a97b39
TLSH
T120A00225565471C1C02516B352D2167033145C9501468776C491445DD8E63A8A941194
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d841de8d-c56b-44d4-bb04-c5df20c573ba\index-dir\the-real-index
Size 72B
SHA256 1090560aa7fd002b7e917e837744936bcedd389a231abeac40aa8019e78878d6
MD5 955792cd7e6675a8a4f4ad1da6963088
SHA1 52356355882a525efc82c5572e6205c417a92bc7
SHA512 b7e2f023740651450b5dde444e9acadca88ec64e8f4c51db3425d6b8132b392ab362a4e8a78751ccfeaafa1619c0f9c9b67c5877377a6383972b813557f4a542
TLSH
T135A0023216A87141D0010ABB62C7017133149DD60103433D40A4455ED8D17694521484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 bb949aeac2278f0c4d1cf87b52d7f681f47573101a3d8f4966a819f36a282c48
MD5 4c796927e2d2b7a39a61729af3bce15b
SHA1 716e40bcad45ad48ada0d74f2039b4a432596ff0
SHA512 80c421ae07ff8a2be76a236500a51756ca4a212e49b5821c9393cd09d7f44ac59730b9f1f00016d31c0e58de5e9b74b4b5725c7b6276d25c7db520f25c8fae4f
TLSH
T141A002118BC0821AD01B51F2165317511304C8902100574740D15084CC544918E4510C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 a39b83baf4cec6cb375476616a604af9fb9393e095f54095883d94cba7169426
MD5 4223362bf7a1ac21a9b1521d388b21ea
SHA1 cabf053889ef3a25d733698f76e3d1c3929be0ac
SHA512 ef55e5b45a23eb72c340675ec7267bdc4d11ec4a76c4a15f04a8ffaf58dff7f5b2986ce44af1d1f102fe4874d4b9292fc4dd09a1c92f6cfd417a7286fb18dbc9
TLSH
T1C8A0021502D48241D402A2B129D7C1C17AA149605241171D66D67044D8D05D5855340C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 32206a6ecfe4a37902890016a3d62655cb248616dca112e3b2401e39f2bf35ab
MD5 414932c1cc7f9437b3a875ae9f188f18
SHA1 073aa6cfe860c8e214b63fa9d7b45b9e0b922dce
SHA512 6fb794ea68286591cbdc32568c7b7c5546a7893cbc976c545575bcd3cd229d42778a1eb98a8ab7c5e27ffc4ef029dda930f11d8427ee2809675aab97b24a9000
TLSH
T19DA0026543C03585C54332B267D321A1A21448946341573545B5755DD8E0B40418111D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 12201d3783c649dec2c3f309a1cbf360f20cadf98ad3ef6cb38425c49fcee8d4
MD5 9ca07282efe139a70a0c99d4a628589e
SHA1 af4c93219eba453b55da1e056ef4ceac350c9d0b
SHA512 b6a35754da12d4729f3b7f3ea5ea621c09e52f658a2844cc046e8818f149ef19c3e88b0ddb4569c58ba6b8a34527c5cc5f8956cc3d46c77153e66ddf5e3863ff
TLSH
T1C6F027B76EFB1864BCAF93D2787164A085953D589411EC4E3127B697B0F2315280EC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 eb6be85d5c1345d1363d0edaacaf2d32d136bce6ddd840b51b012b7fe8a02566
MD5 cff29e9639e31c9d836cc670224c7e28
SHA1 4c80cca041ce29510d1edcee09ebebd96a689977
SHA512 0fd86a964b2e580f604506a6429f2f2a0037f38753134e17b1226b38157b06ec61049eac38da8244b6038d85d820b5fa589c508e32996602494b41123b4dc262
TLSH
T173F027B77FFB1864BCAFD3D53871A4B086457D589410EC4E3126B697B0F2315280EC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 b3a09ee8ef7556e3f7632156c1352b8854371780fa0642f75fdba3eeca92ed5c
MD5 aa004d30099156d0a35f388a49824266
SHA1 e4017f80749049cb2cd3d8dec85d410083c78c3c
SHA512 2aaf6b3ca8ee2d9d815fefabac353b9ceb4fe5ac029add749df3e166193665b7ab3eaf315176ea325e879ee3b5add8204df5cae0f2996d707dd61d801db939d6
TLSH
T1B9F027F76EFB1864BCAFD3D13871A4B086853D589420EC4E3126B69770F2315280EC32
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 127KB
SHA256 cbe661214ecab4311a7324aa776531095ba729d6b49f37ccfc3feee499b5bd85
MD5 d9535f1edde1af234e256c63bf9de94f
SHA1 293f7fc7fa890867764fb1efc3915baff0a8715d
SHA512 66ad94f66c12cfa90c48126a3be654b1abd776005c2fb8d882f209f97169778a9b90dc176d226fd0071bba842dab723c6a5c28205a6229f958b5434e1c7d4f37
SSDEEP 3072:8Hw59B4xPCx1C4Ue3ThL/Al51Ax0gL/JL/TL/sL/JL/eefCXtJ:8HwtthL/47Ax0gL/JL/TL/sL/JL/e9v
TLSH
T15CD3AA32769D50AB0E8EBA645056B50392BD7467B8449038F244A7FC25DBFB013FBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 90233fed7c78e621af2ef8ec62436f61380527873b4ac2031c346a816e234105
MD5 ee26d0d81aa4448e39df477ff637c2ed
SHA1 15fd3afa32b5361bf0386579e50edd7317232ef4
SHA512 8bc55ac87450c2f557d26f92b5060aaf423c63760dca85286376e4685ea962854f8dbfea7e2c0b8287bbd32b7ff6db42ed8880ab181578147cd4598228d111df
TLSH
T1DCA00211897D94C6C10607F091E64184EA13A9DC4B05666290AD50D8A8645A341E3C04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f8e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f8e2.TMP
Size 48B
SHA256 bf44a344b46c4ebf03f08a24fcb8fa7b3b104603e9dd00e41bb506eabc0a224c
MD5 8ed424dbb4e7764c0ab28e20a90b0625
SHA1 8d83dcefb163a70f31174f8ea926fadc24cfe1df
SHA512 77a1c8b6cec0e8e9d8e5f523de327aeacda6b9c65444950e2b3a1e9c6847f125aacf80272f695180534a7e8dbe1357df8a6c137cf85331940c23454d9fb76f64
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fe4152c8d65ccf29cea3bb7ef2efdb716f6f53dbf7de26b16441036d19fa948d
MD5 3af45479a0a58c93dc1d9ef25f817709
SHA1 b0666448cd8783beb421cd56da45277386245907
SHA512 f973014d58b0681005294b3187dab8595fdab0da12fc0f573244b022cc7e160025615998f5a0c36f810c27ea14af1a16b16d35879be1c23d683250ef34c7717b
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEcHq8KL1:sCFp/1
TLSH
T1C1917601743F064138BD2C0896A6D9369E8271673668A4FF7BB910A30E67E114EFEDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f661304-117d-43bd-9002-e4765b1e0b03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2f661304-117d-43bd-9002-e4765b1e0b03.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 6f78612a6fa5283915646068e36b58b8b4e2c370c607db002b80a8eb3c781d1c
MD5 c5aceca14a71be4dfe69679be6ce4e0a
SHA1 0312dff441cb399388b2e12e0cd8e63c824ae58a
SHA512 2b559777399d59f93bfde9b988f22c8e97001701cfb55d658dcb045feea91b1384e3e9658c6b00ddbcdc50f9aa421b5ed18aa1b693b0335edd6f4116f3453377
SSDEEP 3:MsEllllkEthXllkl2zEelOy:/M/xT02zNB
TLSH
T1B444044C7FC43405C5141130C051C3511374DC1005315F5374D1D413DCC75C00C10100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6e259c7a7ec75659bf29ce1390f4e8cda88c0d2e74073d31d4f023d1a5703454
MD5 a29d3b0c0a6d483a7fd5cdce60ebb048
SHA1 4cd288eabf2b049908d7a204db19230a8910e37b
SHA512 b5ae92518d044818820c680cdb886db48bf48c40659ccdb898d276fd94ff0fe150fd164b486085fb565ed887c13f5fe69bc49305d607042dad4c4dbb9083b0d8
SSDEEP 192:ueLsNKLQkd9/RiBbWBQmiU1L2Z4aGBPKXo+FdGJaV6FC1SJrWdNXq9U8:7sNKLN50bEEGIdEaACEJr0SU8
TLSH
T1443219355C38AC2B4EA2B241F4873613AEF4417BEAC42F54E6EC9B1C01DB69C531781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1df4c707f017b3c9ab5320d100273268c9420143fbee21922b14371617f1afd6
MD5 7442b6506bae2ff4c21c5a06754edc25
SHA1 4cf49fe86b898e62a4118d62d9c0839f6c2ffe20
SHA512 64295a4f8c1a257ee5c4d67fcfb44328be753f81d82f9f56ec040c9790332d21cbca92a6aea25be7929f21961e3d9ef2a2f27475bf42d8c08bee488abd08de48
SSDEEP 384:viFiZcIdzsNS8TUNTUlIl0TO50breH2IdEaACEJrHSOObjI9G6w7myT:6FQljwgj50uHLyhHS29MRT
TLSH
T103B27D339C78893BAEB6AB51F88A36179EF4517BD7D8AA44F2DCDB0C01A759C0307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0056fe4e981b79c978deb745f276c7ae05096cce2c5d18d8090ef1ae3f7fa31a
MD5 9c377d22f620e88fb677be0859eec516
SHA1 5ed5f6c6229928587bede7c67a9438e506b3e32c
SHA512 66b13dabf4131ecc0b99d6e57785fc424c290bbc312f5e2c3bd73e03d7fbcc105b72ddb5b68ea7ac67491bef29648af18c9a1fb3ec926aae57edeab930f3797d
SSDEEP 192:MON664BAQmiUyo13W5GBPKXo+FdGJaraDAhLU6:MON66eALNWTdEaQeLU6
TLSH
T17302EA396C786C7B9EA2AE45F48737175FE8117FE6C51B44DAE85B1C009764C230382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f3de9b94c7c3e353b89a60bdd881c91e4579e42ce3f7a40085f639340516336b
MD5 94a2b9dbc2cb2f5bd879ec749646dc76
SHA1 f6aa5e6cb7545a07366e91c962ccc8a2b1024ce9
SHA512 52c79208209f9a50c75f633a5abc5eb2a812a79a4d6b7c23d70b61984ec8859d74fedc59e06a363cb42f1c13e62b373fe5ae4ae3cdf91a9cbab35f9a723ec19b
SSDEEP 384:0ZcIhsNKPTO50br6H2IdEaACEJr0SOObjI9G6w7myT:yhk50KHLyh0S29MRT
TLSH
T1AE929E359C385D379AB2B112F4873A175EF4917BE7D81E48A1EDEB0C06AB5AC031781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 152f58fef5dbb2d5ae4a865d289a90229b2f3576abcfe4fd8cdf92a029ae577f
MD5 2d3eb8acb53a53a9e96fe7b2d0972d53
SHA1 e1b68fb30c0e404cf688703fcb4581dbc28dcd9f
SHA512 44510b2d1009c261140c828debc9937d6a0999a6c4d17f12318f683a8edcacb18458e8802916e2c9e8294a2d16e5cef63db5aea5ae3c60a1dead5ec856fa1453
SSDEEP 384:viFPZcIdzsNe8TUNTUlIRgTj50bHVqIdEaACEJrzSOObjI9G6w7myT:6FHJvwgI505/yhzS29MRT
TLSH
T1DBB27E379C78893BEEB6AA51F48A36079EF4517BD6D89A84F2DC9B0C01A759C0307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 06fed98c2f1c4481458581fc170a978558f048906df10041dccc8670b72b1b48
MD5 f2d50835f0340063a68d898faea0d7b4
SHA1 52ac94974abb2c9addf81ebc481b1842792432f0
SHA512 8e25dbc05253eb77c58a7b69ff97751a21777808024b2a954c69d43a99b53ccccd57d26601e76432702755c9c98b785928dce5a7c7858489730c074a072fffcd
SSDEEP 384:viFfZcIdXsNe8TUNTUlIRgTj50boVqIdEaACEJrzSOObjI9G6w7myT:6F39vwgI50G/yhzS29MRT
TLSH
T19DB27D379C78893BEEB6AA41F48A36079EF4517BD6D89A94F2DC9B0C01A759C0307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e09a1a6e23c152603863f47915517e0d9de30827ce34afe08a03adbcc91afd8e
MD5 bf70eb62524b1a5ac29699d5021046f1
SHA1 96ffb014c562663b2d4529e9a22942450698c77a
SHA512 1ce85c0143a279743a105b0c59617b39e6ed5caedd94d324a4c7b719e9e210de756a86ae9aecc1e0787105ed426f12d7d89ab93399b0935852380e98e4e760ae
SSDEEP 384:viFgZcIdasNq8TUNTUlIRgTj50boBqIdEaACEJrhN9vzJrEAspjYHFf9THkpOObp:6Fe4/wgI50I/yhh7drvFf9Dy29MRT
TLSH
T100E26CB1D8A44DEB99A1EAC6F586E5062EF4023BC598891CF3F5BA39315F4FC0322815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c67898b41e986aef88473c6190900d5357b562fe104eb278ee92df683a471ef0
MD5 ae00ad22b451b67948b47c0600d5dfe8
SHA1 9669de7f0f51e28b852ec5850b2681ed32c8250c
SHA512 3940e3ea28aac1190d15f2f6ad723d4af1f3caa9a8da81c0eea8ea6af01ae2186ac8e5399df85ce380cbe0e2c0f61b1d26c16d57d0887899197e34c72c33bd79
SSDEEP 192:fONL64BwQmiUyA3S5GBPKXo+FdGJaV6FC1SJrMWwXq9U6:fONL6ewfSTdEaACEJriSU6
TLSH
T1B2120939A874AC2B5EE2B541F48737135EE4412BEBC56F44E6EC6B1C01EF69C231781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e5200bcac8c4fa2f7c93a821b679387bd448a32abe1d9b651c7ca27b1cc2ebf5
MD5 5d681e2994183217260d0cc320c3f384
SHA1 16f83951852a8642e1f978f6b12228cb7d7f2684
SHA512 081f581a7eef188410b44706bb9c3594326c2657cc7a72e6b63620d4e6f90fcfeab25e38e2a7b81661cef899736b5646c1d13a193b0d4ddc62c1d75e38a0b4f1
SSDEEP 384:viFOZcIdzsNV8TUNTUlIlgTO50brpH2IdEaACEJr0SOObjI9G6w7myT:6FsJqwgz505HLyh0S29MRT
TLSH
T1ADB28D339C78893BAEB6AA41F48A36179EF4517BD7D8AE84F2DC9B0C01A759C0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f1f3784278e3537895c8721d80f5afc9ed03b252e0bbf86694a2235370f72ef7
MD5 3712d2215be4943246747b6141545e1d
SHA1 c1bf7d901bb0283d801fac4404682c817ade7d86
SHA512 3a48906b4a411a82e81ceeaa742aa9f8ad34309a3deb9c42537c4b7f76892bf2ff5a4f2a72438aad9924804a96b2bb62317777514c60ef5ce6672d0fdfceb039
SSDEEP 384:KZcIhsNK0TO50brnH2IdEaACEJr0SOObjI9G6w7myT:oh3503HLyh0S29MRT
TLSH
T195929E359C385D379AB2B112F4C63A176EF4917BE7D81E48A1ECEB0C05EB96C131781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8803b7b9e17e6e51491992ad4a1295830aa2f3bd6ed5e5355cf8b331d885a3bb
MD5 425ed5cbb11349b7e45745b6f3f3361f
SHA1 c8e8a8cd61c50190045cb70176ff513b48d34a14
SHA512 bbcf3dd0d439f53aba0abe444be72af2a647d7d95914541399ba2afb425859fe5a59325b22ca2cf90cc55fb4a600f6b6ab5ae5ba10fc851384a05b69a6c83e01
TLSH
T141E00401171410F4C41D0730114317114FD1D05000F0130F455005C45D137445D70F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2a849abc467dcc76ce949cf250f365585e4ce20c48da19afce1e911cdbc0e471
MD5 ad8e14015d995882897367baf03a4b31
SHA1 e514459ff2acab87dc0c5ac2fb7eb77eec11989b
SHA512 7031f763b2d9619de81dd5e5bc85a6349fdce0631146dccb896e4e9c59d4a5e76ecdc1d1e279fbb706b1d04c57b6f4a5b0fc08c8458a210b58ba1f8897a40ec9
TLSH
T11BE00116671410FAC82D073411931B255BE2D16141F1130B5A6005986D63784AE74F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e9a3bc1e52eb1088701ff0bcec5072a9d5c8ceb49a254d68b4c1e851d3a4c9d4
MD5 b8999c4194ad021d75950fdcbd7b1fa4
SHA1 8814e34353a81441f0c06fd7c7519591867ad986
SHA512 0492c4a0ee792d2411a36dbc300d08ecbac12004ad863a1bf68447f73a2efe5b491a6149cdc700e4de62bc62107ece1f1472fd025584a7d155945a41b65f6db4
TLSH
T1E8E001266B2410FEC83D073421932F356FF2D06112F2130F5B6116996D637846F74F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bb7fb5fae046e143922a0bf5f0058dd02a4c0c9fb138d5d738f0d9a430e80524
MD5 a766085efd6782e5cf1364a399642f1c
SHA1 0061a904a439457be3d711b5906a25473415c666
SHA512 20ff5792ac4c6e4c26707a73cfb1ec6ba14080729e9e7cd0307138e6d6d211f849f5e7c06427ac92a1864cd3c4a809f0f4d7938f24fe53aa5ebe7625370361cf
TLSH
T177E008165B1410FAC86D073411931B355FA2D0A152F1130B5B6515696D627886E78F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 86c60f42ff3700ce063b8ee9535d72736b7b34691613f351e7b2966628f6b3b0
MD5 60ffeeef97405e59eff765193fd0f45e
SHA1 157a8d6fbf817c939536cccd6e45430740d69387
SHA512 aa9204e1117677d21895ac338deb0463c957eeb7a3de1337fdfd0ac0da4ecb404086ee0adf9f3b6b99552297cb61ac27912f646611f3ef724f10221cb29c74ee
TLSH
T10FE009266B2410FEC83D0B3421932B35ABE2D0A112F2130B9A611AAA6D637846E74F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe590e10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590e10.TMP
Size 392B
SHA256 18c8e69d025acea52544481244615a7bb0cfc5c740aada8792f9e3e9342d601a
MD5 b0e79470c72fbffe34e6aa71b198cb4e
SHA1 72f039ec89fa61ad11420b77e9bf66a345696891
SHA512 1267f55ae763a0142b4c89f0797c7996d1f5df6f4e7b56624666b5a933007a1f32e7aedc1a3eea2d05e1de5b522716510b29760334cd3a378d7a1723d06ad356
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2d3badb4511abfb377c8495a8195171285a3a7e383b32ee0fe87cf60bff1496
MD5 5c2fde89583aac0d6a3859177364081b
SHA1 b0a84fd22e0a4ed712e0755795df27792a63d27e
SHA512 e4db45b24f20d0da12253bb966d0bbc836b311e3f5b552beb9a06460c33df411f1dbbcf743e7a436852d8dbec2951f1f786f06b7ddd5c5092808a9a8457568da
TLSH
T182414B5CA6E50148B7B77E1AABFAA8AD487FB9772F46D45D00010D4F0A27B40C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 144B
SHA256 9610f18fd4964925955348725335ab3c8243d1d833b1b6de91ee7bf5c379e81c
MD5 0f438749ac0e3b08b461d37298b66231
SHA1 1fc9edd67b2a036262b277e810768d810db369a4
SHA512 b25553add27d3d234717485de589e0a6019b49b459f9311cf137d6213edcb1de6cdc13ab18985e6a32268814cbf3a0e5f17893e902d73990d728322ce43b29b9
TLSH
T18DC00C5547F9507A6B0F099FC1514E3295071049546D01308D975A7F6A6459B40839C1
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 88B
SHA256 0c91c376c168e94f0322ef88e5c68483c386169dfb8281d45e0fd196a9d3cc4d
MD5 3fbba9a027ff31dc805544eb99a3240b
SHA1 d8e704de91bdb5ee47f3f6b3d98e7bbc2ce3dfa9
SHA512 dba092fdca2310f51520af886b48ff22b8853ef174290f534f5a3a628f06bf5f3a41fffeaa373271bece05f38fba0aa40f18ce03f7ff07f6d2455d171af40386
TLSH
T140B0045C5355101F37030157C3734F755505104D547D013045C75C5F375010740C7CC1
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 256B
SHA256 221df2f4ec7aa283788f9949903418ce96b461288d8de1304f759450927cd95c
MD5 1636f0bea00ba7cec96597da8c40e0ee
SHA1 17ecdb5f85ae0093683ca9605e2e3d3b64e76487
SHA512 69e7042be6d720583c3e1d76d56050d335c77ca265b93256f4fb2b9e46a64748aaf867030dcc964d1bec4a33e2770f1dd5b647249c7a01e7c8820250801cdcb1
TLSH
T128D0A5ECD795006B3B83038FD1D74B347D16604B6059053144DBDC5F6955137D5874C3
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 302B
SHA256 46aeab9bb2b562e496d97bed28c5968cd6311fa2300db18fed02a982f0284d42
MD5 33ed97f32e1257b06a9fd52f664d3608
SHA1 e13676e158eb767d33e1a537446468397aa1f9e8
SHA512 00e6308dd0564f5123ddcbd1115529124dff807b406aa52f9c1d49e5859bdb83050b300a8c1405ff695251fb7d3326173baee49fcf0ccebfe8f7d2cb47cb51b3
TLSH
T1D6E027ECD789401B3743028FD1D74B307D16504B6026053144D79C6E6594137D187CC3
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RC7 Remake Legacy.zip.crdownload

Path C:\Users\Admin\Downloads\RC7 Remake Legacy.zip.crdownload
Size 15.6MB
SHA256 3c49b95c77b028b2078b73d28470945c8f5c9c920900832689e26c44369e6290
MD5 eece56b42867bd8267236d6362e77ead
SHA1 4344f9541e06bdb579e230eeba7fb614e4a8ff6e
SHA512 f05e8962ebcde8b58ccd544351aa9c52081b75f2f02cdb3851bf2342b73782138ef3e43cd28a9d6cf0b8ea4a24e96a7eb3fc84e3161306c20b34e5a76be24e65
SSDEEP 196608:XHW3nBOZFra/V/OWqv/R0hrUTA/sw/PnUP7mQbByKzcBO9JiGIsAq4TQll8cx6hA:Trikihr5/Pj2rcBt9Ilfg2qI077hg
TLSH
T13BF633A777C60C994FAA38F2CC20AF9074876761D840AD63504B7DEB7AABDC651C3538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller-GMWWKRWR76.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-GMWWKRWR76.exe
Size 9.7MB
SHA256 d3e95d7ad01a4f2180e5efffb8f873e891a498fea9b85950f886e2d25fc486ab
MD5 fe9e560aabed765dac1566ec69ebfeac
SHA1 7dfe4f6313725c1846510c14c43c640166f946d9
SHA512 b0ff5017c71b924c131b0831bd441132dd42d98532eb9fdd44e863afc487d4bb0e8d40159d3bf7c3b956bd118c6098da0158b425d2e285ecdd2d228db7b182c7
SSDEEP 196608:Qq8/3w6fRQSKSLetCd2DmsxADnsf06FVmK+3pAZBrqSX:Q9FfRQSKxDmsxA6FIK+3pAD9X
TLSH
T1D3A6AE22B900C032E8D101B2D6BD5FBA9D7D99340B3954D3A7D46DB95A305E33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-1567-0x0000000000400000-0x000000000146A000-memory.dmp

Download

memory/1084-1572-0x0000000001950000-0x000000000195A000-memory.dmp

Download

memory/1084-1562-0x0000000000400000-0x000000000146A000-memory.dmp

Download

memory/1084-1573-0x000000001DBF0000-0x000000001DE0C000-memory.dmp

Download

memory/1084-1566-0x0000000000400000-0x000000000146A000-memory.dmp

Download

memory/1084-1571-0x0000000001970000-0x000000000198A000-memory.dmp

Download

memory/1084-1568-0x000000001D790000-0x000000001DA34000-memory.dmp

Download

memory/1084-1569-0x0000000001940000-0x0000000001948000-memory.dmp

Download

memory/1084-4398-0x0000000000400000-0x000000000146A000-memory.dmp

Download

memory/1084-1586-0x0000000000400000-0x000000000146A000-memory.dmp

Download

memory/1084-1570-0x0000000003750000-0x00000000037F2000-memory.dmp

Download