hxxps://gofile[.]io/d/8aqWeK

Analysis

user interaction
yes
max time kernel
263s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/8aqWeK
Sample260807-ddekyseq8y

Score

9^/10

adware defense_evasion discovery spyware themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RobloxPlayerBeta.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RobloxPlayerBeta.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	RUNTHIS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	RUNTHIS.exe

Executes dropped EXE 9 IoCs

pid	Process
3960	RUNTHIS.exe
3436	Madium.authspoof.exe
6056	Loader.exe
5160	luau-lsp.exe
5156	RobloxPlayerBeta.exe
5236	RobloxCrashHandler.exe
4396	RUNTHIS.exe
5740	Madium.authspoof.exe
3956	luau-lsp.exe

Loads dropped DLL 3 IoCs

pid	Process
5156	RobloxPlayerBeta.exe
5156	RobloxPlayerBeta.exe
5156	RobloxPlayerBeta.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0007000000025125-3750.dat	themida
behavioral1/memory/5156-3890-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp	themida
behavioral1/memory/5156-3974-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp	themida
behavioral1/memory/5156-4004-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp	themida
behavioral1/memory/5156-4011-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp	themida
behavioral1/memory/5156-4013-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp	themida
behavioral1/memory/5156-4047-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.authspoof.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.authspoof.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
332	discord.com
334	discord.com
34	api.gofile.io
35	api.gofile.io
37	api.gofile.io
39	api.gofile.io
56	api.gofile.io
331	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3840_1567430347\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3840_1567430347\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3840_765167479\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3840_765167479\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3840_765167479\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3840_1567430347\crl-set	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4860	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerBeta.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	RobloxPlayerBeta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000"	RobloxPlayerBeta.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305448081154327"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{318F0C2A-CB03-446A-8FE6-92B2433B785B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F405361E-7CDB-4675-8FFA-3FF825130E29}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	Madium.authspoof.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	Madium.authspoof.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6056	Loader.exe
6056	Loader.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5156	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3840	msedgewebview2.exe
3840	msedgewebview2.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2980	7zG.exe
Token: 35	2980	7zG.exe
Token: SeSecurityPrivilege	2980	7zG.exe
Token: SeSecurityPrivilege	2980	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
2980	7zG.exe
3436	Madium.authspoof.exe
3436	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe
5740	Madium.authspoof.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5156	RobloxPlayerBeta.exe
5156	RobloxPlayerBeta.exe
5156	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 5100	3240	msedge.exe	87
PID 3240 wrote to memory of 4860	3240	msedge.exe	88
PID 3240 wrote to memory of 1540	3240	msedge.exe	89
PID 3240 wrote to memory of 1540	3240	msedge.exe	89
PID 3240 wrote to memory of 1540	3240	msedge.exe	89
PID 3240 wrote to memory of 1968	3240	msedge.exe	90
PID 3240 wrote to memory of 1968	3240	msedge.exe	90
PID 3240 wrote to memory of 1528	3240	msedge.exe	91
PID 3240 wrote to memory of 1528	3240	msedge.exe	91
PID 3240 wrote to memory of 1528	3240	msedge.exe	91
PID 3240 wrote to memory of 4440	3240	msedge.exe	92
PID 3240 wrote to memory of 4440	3240	msedge.exe	92
PID 3240 wrote to memory of 4440	3240	msedge.exe	92
PID 3240 wrote to memory of 3732	3240	msedge.exe	94
PID 3240 wrote to memory of 3732	3240	msedge.exe	94
PID 3240 wrote to memory of 3732	3240	msedge.exe	94
PID 3240 wrote to memory of 3808	3240	msedge.exe	95
PID 3240 wrote to memory of 3808	3240	msedge.exe	95
PID 3240 wrote to memory of 3808	3240	msedge.exe	95
PID 3240 wrote to memory of 3280	3240	msedge.exe	97
PID 3240 wrote to memory of 3280	3240	msedge.exe	97
PID 3240 wrote to memory of 3280	3240	msedge.exe	97
PID 3240 wrote to memory of 1736	3240	msedge.exe	99
PID 3240 wrote to memory of 3724	3240	msedge.exe	100
PID 3240 wrote to memory of 1736	3240	msedge.exe	99
PID 3240 wrote to memory of 3724	3240	msedge.exe	100
PID 3240 wrote to memory of 4676	3240	msedge.exe	102
PID 3240 wrote to memory of 3900	3240	msedge.exe	110
PID 3240 wrote to memory of 3900	3240	msedge.exe	110
PID 3240 wrote to memory of 3900	3240	msedge.exe	110
PID 3240 wrote to memory of 2456	3240	msedge.exe	112
PID 3240 wrote to memory of 4196	3240	msedge.exe	113
PID 3240 wrote to memory of 2100	3240	msedge.exe	114
PID 3240 wrote to memory of 3344	3240	msedge.exe	116
PID 3240 wrote to memory of 3344	3240	msedge.exe	116
PID 3240 wrote to memory of 3344	3240	msedge.exe	116
PID 3240 wrote to memory of 4704	3240	msedge.exe	117
PID 3240 wrote to memory of 2960	3240	msedge.exe	118
PID 3240 wrote to memory of 4704	3240	msedge.exe	117
PID 3240 wrote to memory of 2960	3240	msedge.exe	118
PID 3240 wrote to memory of 2960	3240	msedge.exe	118
PID 3240 wrote to memory of 1608	3240	msedge.exe	119
PID 3240 wrote to memory of 2612	3240	msedge.exe	123
PID 3240 wrote to memory of 2612	3240	msedge.exe	123
PID 3960 wrote to memory of 3436	3960	RUNTHIS.exe	127
PID 3436 wrote to memory of 3840	3436	Madium.authspoof.exe	128
PID 3840 wrote to memory of 2296	3840	msedgewebview2.exe	129
PID 3840 wrote to memory of 4196	3840	msedgewebview2.exe	130
PID 3840 wrote to memory of 4196	3840	msedgewebview2.exe	130
PID 3840 wrote to memory of 4196	3840	msedgewebview2.exe	130
PID 3840 wrote to memory of 4412	3840	msedgewebview2.exe	131
PID 3840 wrote to memory of 2800	3840	msedgewebview2.exe	132
PID 3840 wrote to memory of 2800	3840	msedgewebview2.exe	132
PID 3840 wrote to memory of 5540	3840	msedgewebview2.exe	133
PID 3840 wrote to memory of 5540	3840	msedgewebview2.exe	133
PID 3840 wrote to memory of 5540	3840	msedgewebview2.exe	133
PID 3436 wrote to memory of 5160	3436	Madium.authspoof.exe	135
PID 3240 wrote to memory of 4088	3240	msedge.exe	137
PID 3240 wrote to memory of 4088	3240	msedge.exe	137
PID 3240 wrote to memory of 5816	3240	msedge.exe	138
PID 3840 wrote to memory of 2356	3840	msedgewebview2.exe	140
PID 3840 wrote to memory of 2356	3840	msedgewebview2.exe	140
PID 3240 wrote to memory of 3132	3240	msedge.exe	141
PID 3240 wrote to memory of 1140	3240	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/8aqWeK
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,18176444447748215686,5640936255204380033,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,1422382980790584334,17415914311965214946,262144 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,10441004949144300970,2097508654387319959,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,7306528651986394998,3188748780859188153,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,3545587031136546431,3051836147211707591,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1852643518352951025,16112334400058013030,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,10289718429425548642,8273432050147307857,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3448,i,14271503074207492445,17476536781936698629,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,14915823792498804011,1586391683253966369,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,7404272382890479247,8365319138429274025,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16202481724203098416,1265061967413282556,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16202481724203098416,1265061967413282556,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4496,i,5930734810908039695,10540353386342601024,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,18298708674048018501,12666277061133843036,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,9390826182994669305,17758884126629991594,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,16367525974841472590,5129687042241695614,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5260,i,10097195244339444387,3690287774829398620,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,14043614078911280516,14096091278613935816,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4512,i,15168060220014745950,350649023533798287,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,18131490199139894121,3902243329085541521,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,14973272121007921484,12645059812838565065,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,7665593133253362216,12419992839360379891,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,4967472415811299746,12330453512594184782,262144 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,11630575719492580229,11350707603312734434,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,17814750678848570206,14904291563146051907,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,2991049709533670591,548046837574272658,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4352,i,8498254787359042526,9910852521107072173,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=1636 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6336,i,9330336993948044525,553242547384994359,2097152 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,16521361873062981074,10324786886105974162,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,11734571468646421881,4755766244554533567,524288 --field-trial-handle=2160,i,4137955587138870454,9704473830717317899,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2100

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\cracked\" -spe -an -ai#7zMap10808:76:7zEvent13629
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2980

C:\Users\Admin\Downloads\cracked\RUNTHIS.exe
"C:\Users\Admin\Downloads\cracked\RUNTHIS.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\Downloads\cracked\Madium.authspoof.exe
  "C:\Users\Admin\Downloads\cracked\Madium.authspoof.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3436.1996.14778377344244247888
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff91adab078,0x7ff91adab084,0x7ff91adab090
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,13441975744202665136,293027213432851185,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2084,i,13441975744202665136,293027213432851185,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2132,i,13441975744202665136,293027213432851185,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3736,i,13441975744202665136,293027213432851185,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4168,i,13441975744202665136,293027213432851185,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4644,i,13441975744202665136,293027213432851185,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4544,i,13441975744202665136,293027213432851185,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4460,i,13441975744202665136,293027213432851185,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:3056
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:5160
- - C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
    "C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5156
  - - C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\RobloxCrashHandler.exe
      C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\RobloxCrashHandler.exe --no-rate-limit --crashCounter Win-ROBLOXPlayer-Crash --baseUrl http://www.roblox.com/ --buildVariant Win64 --attachment=attachment_0.733.0.7330989_20260807T025702Z_Player_DA113_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.733.0.7330989_20260807T025702Z_Player_DA113_last.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.733.0.7330989 --annotation=BaseUrl=http://www.roblox.com/ --annotation=BuildVariant=Win64 "--annotation=CPUMake=Intel Core Processor (Broadwell)" --annotation=EnableSessionEndCallback=true --annotation=EnableSessionStartCallback=true --annotation=EngineVersion=0.733.0.7330989 --annotation=Format=minidump "--annotation=GPUMake=NVIDIA GeForce RTX 3060 TI" --annotation=OSPlatform=Win32 "--annotation=OSVersion=Windows 10 - PlatformId 2, Version 10.0, Build 19041" --annotation=PID=5156 --annotation=PlatformId=2 --annotation=RobloxChannel=production --annotation=RobloxGitHash=6468eec5ddfa1510f06a43d039a72a6d9307e028 --annotation=RobloxProduct=RobloxPlayer --annotation=TotalMemoryGB=16 --annotation=UniqueId=4212714826902776221 --annotation=UploadAttachmentKiloByteLimit=1000 --annotation=UseCrashpad=True --initial-client-data=0x50c,0x510,0x514,0x4e8,0x4d4,0x7ff7caeff638,0x7ff7caeff650,0x7ff7caeff668
      4⤵
      Executes dropped EXE
      PID:5236

C:\Users\Admin\Downloads\cracked\Loader.exe
"C:\Users\Admin\Downloads\cracked\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1392

C:\Users\Admin\Downloads\cracked\RUNTHIS.exe
"C:\Users\Admin\Downloads\cracked\RUNTHIS.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4396
- C:\Users\Admin\Downloads\cracked\Madium.authspoof.exe
  "C:\Users\Admin\Downloads\cracked\Madium.authspoof.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5740.4268.14719578436046606203
    3⤵
    PID:5352
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x194,0x7ff91adab078,0x7ff91adab084,0x7ff91adab090
      4⤵
      PID:3256
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/olemad
    3⤵
    PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3840_1567430347\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3840_1567430347\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3840_765167479\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 34B
SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
MD5 e588022031c7c2cc71418c3c8ed68c5b
SHA1 77ea752c8e2b17792e48c6a45a0fdde81a9a665c
SHA512 33f84dcf3d236bb844b27a8926e190c3ca0fb2359ccf3fd781f939db752772b57c3f2dd208caf4eaaa1e21604882300aa60d4776e13a2c25ff64652ca2c457aa
MD5 SHA1 SHA512

Submit Download

docs.json

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
Size 44KB
SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
MD5 d8609297ff0b94a60784d9e94f0f841e
SHA1 4ed3bcc553171e45cdd86c6af1055911b5ccf5ce
SHA512 95a91986d33bad0f3d394ae5c3230e9f49ffcdb367919df3ba92282a39e288465b258109e42948f5d9c44b13b37db91bc617074d3ec727345f52b4a68b0781f4
SSDEEP 384:Mk6zWVCu6tqYXKNK3cSZc4ImuNclknkpf+qZFHzYI:Mk6zWSso647QclDpfJZNYI
TLSH
T12813EFE37FD545030EDA12837536E258A43ED0EDF48E5C6ABCECBD18C6488AE1627647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau
Size 751KB
SHA256 dca06de17994c51bdd3f5f9fe8610fd38277a14b95a88a09527104392d317c86
MD5 42f0071399e252b89d592e911c6e6347
SHA1 b8cda9cf07f5259de8b5549f654c3083a0933cd2
SHA512 b80de9626f3cf5acca511873b41d0710ac9a60a5966200d36ce5bf74f6a63b99e37a5c61d9158ec0116cca91b1a2387ee448d08f7c6b0b40820baee04539d00d
SSDEEP 6144:UhFsApJtIZaXnoQOeugC4BNKoLJplUStDHb2YxcHmz8fyfJ7qSiqCFydNH/AaJOF:ZaXnoQOeugC41DHvzJCqI
TLSH
T171F4661DB609B1700D8F73F6A9BF8844A8759281911850FCA0F8F78A177F87D2396ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fa007a266ee833313d997b0c7f9d6790dda80e8d21d8f772f42e5d0697044880
MD5 6565a06b45690113ccb1676299d95980
SHA1 617208096dc4c9b05fd2e6314c0310842b76e2d3
SHA512 95db9ba0959152c64a910ebd968d383a9185207fc0db228655f993e9d7d5dcc7f5b389ba45a2daf33a69da08b18a3bfd0685af32204deba08da842d0c2b53132
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 abb1d798e23f7be69546b5a5b2b1e67d8e6439660528788da2eca3d7a1b37958
MD5 5bd263be7253b50027df9dcd53c3ffbc
SHA1 e50ddee768fd162b862f7b83723b2761dd3c031f
SHA512 1f0061ca172d2d78260fe50440bdc7845f335bbc8b6e444562140ab6ed3c0372d7923c6ee0f67e86138cd0bccebbd43120745d10e38379ea13bf6e3d83ec2c06
TLSH
T17CD0241373314334C41030731153F70C0C40C50F41054440743CF51F1F1C0541D43C51
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 44eaf6be3643d655e22049c1d47f413f87dddeaffbcd542b370d589935a7cf05
MD5 15af82c26ef61a1a689c376f5177bee0
SHA1 449087f0e1f0c60c33a54249cbe3286cdfee7176
SHA512 ffdc1ac958f83cb2feda23569144e19e86c586470f6fab56d8b3994a511e01007271456c8f5aef0230e8ab3735a56f57674fe82a8acaec0225aa6adeb5ceb390
TLSH
T18AD012D102383B2ACB7C15BE60C9824031B73900C913CC2ECB452D34D1C9381862569F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59930f.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59930f.TMP
Size 48B
SHA256 a714df13781c62c80079abf810eb099ab0358400511c961280b3def83b3ed601
MD5 938aaf2d5cc488c3c7c8561cc01f4fa1
SHA1 48ee51e34e7bfa68ee723188eb2795fa7ab4b6a6
SHA512 026068a3af48b2446983d6c5c53b6da624f606e938841da9eef1d33504e9eae1b771aca1bfd21bd41e5f1af68d038ff7ecc727bfbd74fbbc0062153bf8dd97e6
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 d54e799ccb28ab026bd28bdfd4817c016ae0547de974bd7c17d7c8c73286e9a9
MD5 7705314ad074060f37c450e65faadf22
SHA1 89ca99904c71cc714c9ad7e9c8607964828927fc
SHA512 d7ad521a82062eec2e398c5e7659bbef89c8e15e432f223b890a2abe6424c12d5356088bb7355611afd39c5157e73136ba6090a4bef840af1efe1fd0c383b356
TLSH
T151319292C3E4C66D895126E027347917CD2E051D92246D2BCDDBEBD6ABE2071D22164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a57e5.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State~RFe5a57e5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
Size 6KB
SHA256 ccf867b0dfb0ccdce79d91569ec080fe72c260c6f32d490826756f0e149d47da
MD5 d0a2afdaf83fc8980cd499e9ce6fc883
SHA1 bfd0c7b70d3d3062a32bea2ffa1a5531330c6465
SHA512 d0f69c204ff4fea173b43ebe58149d210fa64ced6ef3648144f3018219f61288ed66f3cf6adfd682b8ad63b386efbe804d804d24f56abde286452661076ac1b1
SSDEEP 96:stH05MaMzgb9qffRZ8i0vhEOktDm/7qx+WVHMSm+uecJ+i1iYPQjI+gN5MOB:stH0hWf5Z8pa1y/S+WiT+iwYP535MC
TLSH
T1EAE1C8425E287D774CC7E6197E35BF22E2F6502262D50E58EBFD861C08E66CC1207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
Size 6KB
SHA256 1f108e46cc45496fd14abfe020326e26c03471a8b154b9c3edca9ce9d88bdc0f
MD5 edbe0b61dbc4c762f9499b471ca852b8
SHA1 6a41ff82ab81a5dd57e2d6e50f7c40d65914c719
SHA512 f76515ea4fd9a843eef1797b66e0231b3fe86ebdb019174cf04262485d8281e48b223b6d99e4ec74517de5ac1cf8bf215128cf3cda03ebf030573f2daa155abb
SSDEEP 96:stH05oaMzgb9qffRZ8i0vhEOktkm/7qx+WVHMSm+uecJPk/gYQQjI+g7B5MOB:stH0VWf5Z8pa1t/S+WiTPkIYQ5T5MC
TLSH
T19BE1C8429E287D778CC7E6197A35BF12E2F6506266D10E98ABFDC61C09E66DC120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59d865.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences~RFe59d865.TMP
Size 6KB
SHA256 f3b0c0aed9323654910bc431a443188b0c8e5d81086bf1ccfe4328845ae0a664
MD5 36e6c507dc9384a04f500a3ff16fa753
SHA1 8c6fcfbb31d06a8de94c3243b3dc903e243945b5
SHA512 57d37a5ee0920b6a0b9873235e5f30feb02199a5ec2476bebb180612ee5e7eab148f3895d1929456c0274cff37e0a5fa6d63a0d3e895986a25a18ea319f2867e
SSDEEP 96:stH05MaMzgb9pffRZ8i0vhEOktDm/7qx+WVHMSm+uecJ+i1iYPQjI+gk5MEB:stH0h1f5Z8pa1y/S+WiT+iwYP5O5M8
TLSH
T16DD1B6429E2879774CC7E619BE35FF26D2F6502262D50E98EBFD861C08D66DC2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 1KB
SHA256 5811f6eb9653f6c1de1a687dbe03fd2ee12937b32c8ca0b2e70a1193ab725feb
MD5 f343ee6317540801aa37d30aeb21d553
SHA1 a0a1c486d3cb7428d48517feb6a5a7a01a99c178
SHA512 8e08eb6a13639fb0eb2fb0421a3b118f27107aed374bfe706bd5a3d0ce4b9d86895b28a049e2fcec6c86568da9ee99bbdce7fb88d5541f3fde143373e4460e01
TLSH
T17C31D7F2D4547B310CC1B385B6A5AF271E20503682005E5CE4DD8B2E12EB69D9226C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 65f9a1e0ce662eb9970474733072db2b3c00d6860029baeda95deb0cb0f827f8
MD5 b4fb1df9ce1f255863c44c581214959d
SHA1 36a34f7c0d0d1c0da88be08c40ada8bdec00547f
SHA512 9e6a204bc0287b17588a6c36b6318a49f57eb3cc92cd40c8a7e53816d8f6a4a2e002fe5df0a8be91af6601b2a0e21d79ccc5c254e7b36ba43cb784245cf028ec
TLSH
T10F51C7B3AC04BA7749E2E744BD993F339E35907197523F6499ED1B1D01DB66C1302C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 9efce01ae1e5c8dffcca587bac590452472e35b9533818cf5bc02b4d6bad65e1
MD5 7ba016562f75b71ab11c887c77f9d4f0
SHA1 94e4760476b7d51265be5322d6c1b77a9d8c5627
SHA512 5756bb915c29e90dddcba0cbaf548f74887042bccc5c281f8719e9958024018738870a6aea62c69e621e0e46fa552b82c20266584bceae460f0a0a6df562af78
TLSH
T13C71A676A864B9374DE2EA45BDC52F26BAA55033D2813FA8D9EC0F1D01DB79C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 16KB
SHA256 d2948ff772e7f9b2b6052c1a84db521d9866be36c34c3c50bcd331dec1ea66ac
MD5 c9aa2a3f724a772a8491b15209166852
SHA1 690a072bdb715396d4c87bb161e6c49a3529d060
SHA512 a496c441bdee508c008bcd4aa8498267d158bb1110228fb61eba5d023b347184ed4180efe70b1f358d0eb06e955a7fdfe193b04805bb679483e8da8318aea818
SSDEEP 384:zy+aQikB+z/xvxjg/qhEwNb3SSw62zynuEQ:J/UxvxjgC+hpvd
TLSH
T13A728D3A98297D2796F2F6047D595B5BDBB8847291C17EB88DFC5F0D46CB3981302D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 17KB
SHA256 06be077a1dd21f9507093d4054c69a3048bbb30b06d3e7b50452ed03fa599e27
MD5 5a64bec50275f78227d34c458a4dd09a
SHA1 49d8accf83fab8eb7f21b817184d7a899fb1df66
SHA512 93cda9f155cbd124c4bd40da7ca642f91540597e72d2dd605d0d361e4180dc120df85742c354f6f24b0d091d2d767da4fa60bf6974aea71bac36237cdd5280a3
SSDEEP 384:z5+aQikB+z/xvxjg/qhEENgySSUVr73tJyi62zynuEQ:Q/UxvxjgC+Rd73tJyivd
TLSH
T1F5828D3AD829BD2399F3E6457E596B5BD7B4807291C16EE88DE81F0D06CB7DC0302C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 17KB
SHA256 d2dd4f454da0e749d9f7d974ba61d13c66433c73bf62f4d72bf6f690939c453f
MD5 6c19761324b9ee663a2c5697f1ef6f50
SHA1 22c23a6d0d1a9661dfed81beadaec47afcb528bf
SHA512 0d40107e91305f95338376863789c51003cd8bfed041a76e6c6a7887d1c0089c7e118d949da399c799125e5ea6d79673f6e588f074d1e8088b87b406c8ee2aa0
SSDEEP 384:zL+aQikB+z/xvxjg/qhEKNgCp0UVr73tJyi62zynuEQ:W/UxvxjgC+of73tJyivd
TLSH
T1FF829D3AD829BD2399F3E6857E196B5BD7B4807291C16DE88DE81F0D0AC77DC0302C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5937df.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe5937df.TMP
Size 1KB
SHA256 0647a7970f8b0fcf5f3b4404eb38a5d6ef62f238ed4b6a11c159600964193811
MD5 f6269eca337cee87ce2161f743f4b576
SHA1 d327ddcd8557e7450a4f5a96e628443d22aace57
SHA512 fff616baaea02a09a7809d0e043463d7db44cec7dc149e2b908915f3ea7965aaa6692f8421b6ab340f6e10f4a3a3ed335c08bfe757a37517d7df0ff9e9c3d72c
TLSH
T1332195B3C4597A7148816345B6A5BF5B1E60903A8200AF1CE4CD972E23EF6AD8237C33
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b5189b76052b9a0c7f7be1c52470c95284ff5cc4164a2094ba413c5abf0db3c6
MD5 9a4a8055722d9dbe1b3db40e56267b69
SHA1 6e66876c2535ec8b5edc68de324c0dde9ef7e978
SHA512 527e125d0aeda7bc78c39186149e397a7a8b92a09dc86ec8f8f7a62448b47c87bf5323d7dc064accecca5fefcd5348a4b6a875865e33f5fdf99ad711012c9c23
TLSH
T15CE0809515CDC39F5504A4CF539C534CC6D1770ED7C5A95F1B048CC5724154477D1971
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 587a8f20f4acfe3b8f96aef3488dcae0d3c2971fa3144bddf43122d64078b0bc
MD5 161d8e9ce1005cee3492a695cabbc4d5
SHA1 4fc3d32a45046b105f120d3746debba523873f1c
SHA512 ed35931094c92bd4ac7b7fb08b41378403a61207e9c30a4249bea9d5993beb1fb78c4bd7e227bb9bf778950b93744d4249b42971a92e3ad5ef92f1b1fa312977
SSDEEP 48:8WvGsqNgI0ZQvoFGbAQ1CzPfQdhS4HXdVDUl2ceYi5LggVqlu7:bL/ZQvoF6CKhSwN182c3QD7
TLSH
T13881F91D44D2D496E3D41EB8F5E232D33D3281B88AAB0D7527409EBD6D15F1E1CA52F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 76cf94e6b3a095a3bb55ce7cb1cea87930af9e5ed8dbf4fc146a49586f4aa338
MD5 0dc807d1d5c95aed5655e896f46cb725
SHA1 e3827e9f1a52dd0037d112723a65036a85f008dd
SHA512 6daf480e828101d5ef948fa12216c97f6f2b6ff01c0f9ce396dd55ac07761af33e43bd0dfb8c3f3dc29eea79b988def05d7e8447d676fbccc7898730f40e7a5c
SSDEEP 48:DWN4l2ol7g5gQvoluzbAQ1CzPvBdOS0IfXdVP/l2czeo4ipLggVqlr:p85gQvolu7CPOS0UNVt2czus+
TLSH
T11981C809C4D2D0C2E3E42A30F9D23A973531C5F885072E3696849ABC6D15F2D1CA72F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5890a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5890a2.TMP
Size 3KB
SHA256 fb87a9e593b18062aa5706457105896d75f2adb0f81def941ff457dc14702abb
MD5 737f172b14bfb1756c768d843baa85c6
SHA1 f9334df7016c2d81c76956df6ea03f24d7df41a2
SHA512 d9f30b18309aa249e75d162dff9a2cf3604142edc732fd3148905239d13808bdfa4061c2c894e4333efc69b413c46b7bd493186825ec441b4ecaf9e792faea2b
TLSH
T12171800D09D20492F3E51E31F8D236D7753280B94A470E7206809BBDAE16F2D0CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7067bc4710b63efb05be4cdd82876a2f9cd1e945edee65ecc5fb68ee45898d99
MD5 1c53d7a0dd01ffae86bbe2ef4fa04788
SHA1 2eeed38343c8248101ae5a3d30484b3326aae2c9
SHA512 e5cc4433e1e10ccb1235cfc0e76897b01a13760c31f37e8f84193bfe80590d1b84e3b2c187858ee7b626d6dd52f48ed0c98f54e9e53aa9658e7941f9d3a1ad9b
TLSH
T1C241ADF3C3F8956D8D2252F4AE14AE1BCE5C1016832C79798AD4AE17A3E3431D10574F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a09a6e3539a2c9911f5743a36fd4d5f86e2873035a43ddf7c10d5de4cfbc2f3d
MD5 c7cd9d46bcf48778d85f02d2d9d87c87
SHA1 4dbdd1e8a8b15af3dd84105f13431acab58e0b0b
SHA512 ef0e8c8ee8febc8cb2c20cdaa371c9103f54971d9cbce95e711b402f9a516b4bc2fc8fd3e5814ba591c39cae48fdd0d6d5e34b1168123fa3f3545f8bb64d4270
SSDEEP 192:sxZMRiyM/jK1Ml8Mky/fbs1o/IdpjlbHW6+WNean/YwaXoOIgrJ:sxZM8My/fbs1owxHb7/E9
TLSH
T1A64209016B34A97BCCDBD209FA557F53D6F9447292900E44AAFCDA0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 42bdd26885ff37bc3669d374a9b538dd2d1159540816eb3b4702a20173ccb566
MD5 290556b4fd4e3641a45959afb8211ede
SHA1 117d3dc959ccaef412f002a1f77cc6b9997dcfa9
SHA512 b5fb095d7732deb61e97e3276bc80b875cf27a34dc0a0859693961a3a6c1ca3ce73c11929a3c21e067426a3803991838fdbc277d3f9e242732fb0af09850508c
SSDEEP 192:sxZMRiyM/jK1Ml8M9y/fbspTAIdpjlEhHW6+WNelidYwm7oOIg5GJ:sxZM81y/fbspTB6hHbvd+g
TLSH
T14652E811AB34A97BCCDBD209BA457F53E6F5447292910E44AAFCDA1C05E2BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 020532671aa5a4604f356ac66f28cbba6093d75a33eb6633e27fd89dc40efe6f
MD5 8a1221d51b869568da82b669c00f87d6
SHA1 bf07b7f4d6e8595fe994821846724a28072a93b4
SHA512 7f56ca4fc9e5e56aed17eec6e045013117b40eccccfe9d55d9d68ad9afeafbe883ab3bf1d3ebf632115989ed5dc92fcc5099f6ae901024540f996fca332b6ed0
SSDEEP 192:sxZMRiyM/jK1Ml8UQT9y/fbspTAIdpRlEhHW6+WNeXFhYwYQoOIg5GJ:sxZM8qhy/fbspTB4hHb4hhg
TLSH
T10552F851AA34AA77CCDBD209F945BF53E6F5447292900E44AAFCDA1C05E2AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1a849a59d8f371a720cf07029b24099b86656f741138fd022e484332d986cd57
MD5 13f03952fd6e067050b2c1e0918225cd
SHA1 668d04537d7fd1ffc5061910b8d2bb42780a333c
SHA512 175ae6e4f6df5d1b672d700445f6b1b3a37c1fec04664f79668bb4048069f0371fd80b197dc1b52cd5925ed2c1d94c138982c26f25c9b164e70243341f9e29db
SSDEEP 768:Ru4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+darohzCcPak:Ru4jeXmWvmKLEu1jacPLZQdR3T
TLSH
T1DCD2093B284CCF7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\f992ebe9-4f71-473d-9926-080b9b759cc7\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 baa1b95332fd8ee1211b743d580170d37310225a2c661931f7c4a09c6f1cc321
MD5 ef53aeb76afc78ef73d975694494e1e6
SHA1 e2884e4ab4cc3c2bf9aa562b68d9ed98fb4bbba9
SHA512 5d0dbda912f1b52a385a4d3ed89c72caa01f54ba4e5a67eea9d35a5467f924d792f4d2eff8185d2f100d0c3996e41913352dc08010496de8a7dbd33f7c223fc6
TLSH
T163D0A75FF06504D8E6B657935633445E82ADBCC918E6D0CDE423242D58B4A4BD611FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c2bab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5c2bab.TMP
Size 138B
SHA256 79a1e2aa56ffbe745796226d01a669d0f2c2ebc387db3284203c880f5416b923
MD5 6e25e073296e3c3724e1e7e9d476f8ba
SHA1 14817c57bb507764199b2df25e887957c745b77f
SHA512 381c3c6b8eb37bdcf79df5f48958070b5c4f3ccdcf35331178f9bd09202d67631f2b4a468fe6c4f9d2e84e71e217ae0694f3ea216ece7466a7a8743fcacd588b
TLSH
T141C08C67A0400009862512424232000E878EACCD08C1C08CA01338286834A27A101FA1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 43f6f2e8784c062598b60b42d85ff99653639061b24674c46b7a4a23926ba499
MD5 9e3d8d8cc25acddddb13db3d0dead3f8
SHA1 3c58278088127c36eb53cdd01d9a00cc6749e834
SHA512 cfa4976aba6910bac30958b0ae766b218f83139f159fc052f182f31129e369f09435fadaefde150ec0f2496b82e9eec9bd6c3c2f9603a7fdbce795fa43e75744
SSDEEP 24:Kd9f4LiandPrD4bf+yIj3DKiMhaZD1ElTSmtMI8LAyXY0fbwRaudmWy4uK+BIjcx:KsiIfKnKQDyN1IRK+0MSjIBKgAk7y/
TLSH
T17F91975670BF16023D7E2F0CA294A61A5B42B163715DA52F7BE805B14E6AF320DFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8f3ceeb-c4b7-42e8-bdc9-53a165db37b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a8f3ceeb-c4b7-42e8-bdc9-53a165db37b6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 962fde5105ff63b0754e6cce1497bbaafe57a8d024d98923a4c9601eebacc573
MD5 662b298e5414f7526e65be44ea1709e0
SHA1 fbd74d0fc1368f589df9b03cda61b663dbfd34a9
SHA512 b2a13ed8373bc300a9993ba23871af35bcbd68b8128866ad956ea11ade66c1b7db60fa848492451c4d24c752f6c8a674845a30055a7ac9a1c729b76b4d44ee3b
SSDEEP 384:6AZcIhsNsyjhSj4f+xOE1hpxJrlFkXK9Li6Uq58bhP+4Hn7Buq:6+hvgYOshLhfkwLw7H7Buq
TLSH
T19E928C7168786C735DE6E141F80736138EF8907BABC57ED4E5EC6B1D019A6AC131AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a6c4b740d65343cd5cb65aaf2de00c996988e6556d0c51d666b8be3e42ed9864
MD5 05fd53bddf78c04e20aee7c6c131e024
SHA1 5c537feead6a919e3c5661e2692bc47f4d9b13cb
SHA512 b0d31ab4c5ca17c1bce847cb2d5671a96caa7d4bbb22873cf144c1860b037db9e18203411516651d2560f8941f19ea057c56759da68723c395cea7770690ad7b
SSDEEP 192:EONa6hZ0QmiUyoGpc/+jVnO1u1m5wOZX5fvU6:EONa6oypu+xOE1F2pfvU6
TLSH
T11A02D8356C686C778EE2AE45F48727235FE5212BEA917F84D5E82B1C00C775C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad34897b7d130aec77873fecb1ee94226d7355bb6c5a78df04688fa61f639cdc
MD5 6418ba44faf0e1d138ad20e41c541db1
SHA1 316af99da7d6230eff0a95c2ec932f3b236ca5bd
SHA512 165b6cbe44c87b19ae6f03ea73e79208814548ea882f12fba40c06bc05d5acdf8ebc555828e8c4d17421bc33680cc5e3fbe9dc6304911a3a7e683450c8eca022
SSDEEP 384:YAZcIDsNsDjhSj4f+xOE1hpxJrlFkXK9Li6Uq58bhP+4Hn7Buq:Y+DigYOshLhfkwLw7H7Buq
TLSH
T1C3928CB168786C735DE6E141F80736138EF8907BABC57FD4E5EC6B1D019A6AC131AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4606ffe31380e4241a5189015fa71c61658bd3f5677ed47d420d89445a101cb7
MD5 7289f53aa2bed48c4df52a042374756d
SHA1 ae1c71e30d20b343b3eda833fc76a010d82ed54a
SHA512 116939055c98c88a2daca5e2f337006c352330c9fed797e873ba5a63b245b74c2eac45ff5d43603649ac9bdd763119c5c4e2efb7991207ef85082bf5ad2a4476
SSDEEP 384:QriFEZcIP1sNk8TUNTUlIlvjhSw4f+xOE1hpxJrbFkXK9Li6Uq58bhP+4Hn7Buq:QGFitxwgXgYOshLhJkwLw7H7Buq
TLSH
T130D22AF148D79436D9AE9743E73E2E138EBCC067B585AA90B3985A1CCC561BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c63353efb0bba6d5f9daa3d263742d2b89f2a688cc9beec2a285ae921e325535
MD5 d9d3885b4e2bde3c5a37321cf0687833
SHA1 45622e6e0fe14eb82958d585e79cf58d00b97912
SHA512 7eecdb0ef0ea674e9ab63589b52d9561c86b16ec7d01305311df8b4488d3c6e9ee1b45a49ffe5e1ba696cceb83e4f78cae031b6f8df346405f74f6541c173efb
SSDEEP 192:LONd6hZZQmiUyQGIc/+jVnO1u1hjFuSJr95cOqrqTU6:LONd6L0Iu+xOE1hpxJrI9kU6
TLSH
T174120A316968AC375DE2A591F48736139EE5512BEE857FD4D1DC3F1C01DB66C230AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 062fc4a20afadefef7b54f680836923da2d85829bc28c4c419434f744f968f9f
MD5 9faa1454820f54058939c55e56833a07
SHA1 9fe2f48b77007c0072f61e681fb8f5e329487f26
SHA512 f17b50c70292f574661d2a6094a1af6774a459b670ef7009bd9289c56edf4cfa42117fd0832e2fb41156d32630db4fbb0727b9a45064a3b49a816f5d2c4fb9c1
SSDEEP 384:YaZcIDsNsvjhSj4f+xOE1hpxJrlFkXK9Li6Uq58bhP+4Hn7Buq:YYDmgYOshLhfkwLw7H7Buq
TLSH
T135928DB168686C735DE6E141F8073613CEF8907BABC57FD0D1EC6B1D019A6AC131AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d025d2e6-d5ed-4838-adb5-55946059a57d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d025d2e6-d5ed-4838-adb5-55946059a57d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0470b0028a84f4c342ec9bf421572193de4589a4a599e604f2a6bbba3d48083e
MD5 17ef3ef1b3cd14545e5e956dc6c86b2f
SHA1 9d74ef5360e8f97f5f63069a9e1f33f378db7cca
SHA512 a278f64b1e25c66e336d72366ea37d443876f1be88449fdb4d430820f41dcae474a30af45da383dc6e0edc311d60a7f45d64a8e80d007e27a5cf0d37f0179511
TLSH
T17C41E758A6FD1148B3B76E5A9FF6A86D487FB8772F17945E10010E8F0672E40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

appStorage.json

Path C:\Users\Admin\AppData\Local\Roblox\LocalStorage\appStorage.json
Size 9KB
SHA256 7d7156520b6ca0e22aad9e7b0531ec8909b547f87aadb481fbd2e5eedf063024
MD5 e37a969bb6c6bca3b199aaa7ab81d173
SHA1 3b6d9f323a010988a26a780657861b147480612b
SHA512 1aea25c3087bf6b2bc3592bb95953f7df0e03cc35d294c410f3b0b73893137cc32d62aeb17f3d4b287364cca73fc0679785267b3b7c738d88bb3af4587fb9879
SSDEEP 192:1Lv6A9lVrAO3czqTYjctMTRut0F5Om18t8B7a4QOURwgLJ6S9utv:1m47Rhxgv
TLSH
T171129FF65048D4BBC0468869EBCB7F265A6114F538C63E3DE2ADBD0DDCBB1069E15A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memProfStorage5156.json

Path C:\Users\Admin\AppData\Local\Roblox\LocalStorage\memProfStorage5156.json
Size 100KB
SHA256 fbc5aace873d98becc4c1a8b07dd3497ea2fd8a1f29b675844b3a3073abafae5
MD5 65b2cf3e2015cac56452cd8c628e0f5f
SHA1 f34651f38cb7354762d299440438a65fca6fd11b
SHA512 2f962c1e2afe434f6da0d98d0a5680c215dbd0fbb13ead0527356619e22605ef598484f3150f530e4e8ffde5a74793fb7d7d50fd775ab86051efdab5bc12348a
SSDEEP 12:Y2ZiRIPs+FPNmnfA1Nm33IPEV40VnRZd8o:YMPPs+PQfOQ34P2/
TLSH
T1BAA3C0A6D28BB8B1CF7EB9B2096842097BF43B5E2A144F1C739C314D1155D4DBBE2116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.xml

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\AppSettings.xml
Size 149B
SHA256 893a58e7946728c9dd5caac10e5bdc306a465e406c1f979ded52a13dafebce2d
MD5 48f58abeaac832f838efd2beb25f4c90
SHA1 7878e28b62e5d9bc9042a3e44094e39668f03384
SHA512 c5e3025b63eead12a0f8192ea41afd1216dd87b14a07d22ebafc6d3d899a06e80da947b3fcd1b3f2cf53b89b3de9967f89c415394d66c277556373b620dc827e
TLSH
T117C09BA85361CC1697A5DE38977FFF50F3A17574447140989491347B0DC11C427D13E2
MD5 SHA1 SHA512 TLSH

Submit Download

Madium.dll

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\Madium.dll
Size 9.5MB
SHA256 f64afe9cc4d903cbe5210ed3aa612b60362307c3f3d2c763be35f03b21213588
MD5 8d3dd5550b4d4e8418a767530b5f5270
SHA1 bae639faa636ada52427c253c90a042ab49fafca
SHA512 fd31f82dcae11661db3af21b8d4ff6e9c7384d497e0ff279acd146a5d112798f1952b056b7286294e78f77a04eb48d8829ae97c88920420ba3b1cbefc4897774
SSDEEP 98304:SXXkKfMYWA5zc72GDzjUa3hTJwOEN2oKVQ8vZue+E0lOPE:YkKfMW5zq/Ua39JzEN3KVQ8dbn
TLSH
T1F3A6AF66F67910B9D8AAC074C3975233DB31B09617707ADF169097B92F63BE01B3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Madium.dll.pre-stackfix.bak

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\Madium.dll.pre-stackfix.bak
Size 9.5MB
SHA256 0a7082d4c2cf5e8fa43aad4a10c0189f47cc0b0cbd768d02d255d6b3a49aa8a9
MD5 6a60ffe164b1b89c8726ac4aa7b7dabd
SHA1 348b9b4603bc8aa8fccabbcf82320868b44f6b1b
SHA512 5245112e67cd316e019c349e3df27115326cad30d6cae5500fd5761b273ba4e7a0777347d5954f3c2b984031143cf812c6b6d1ccc1b51df234196631cd21a48e
SSDEEP 98304:VXXkKfMYWA5zc72GDzjUa3hTJwOEN2oKVQ8vZue+E0lOPE:1kKfMW5zq/Ua39JzEN3KVQ8dbn
TLSH
T1D9A6AF66F67910B9D8AAC074C3975233DB31B09617707ADF169097B92F63BE01B3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9a7ea9ad620bcc3bb6d39b6b0d9317fcc5c3500fb2022744894749b7c78bf89.dict

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\PlatformContent\pc\shared_compression_dictionaries\f9a7ea9ad620bcc3bb6d39b6b0d9317fcc5c3500fb2022744894749b7c78bf89.dict
Size 1.3MB
SHA256 f9a7ea9ad620bcc3bb6d39b6b0d9317fcc5c3500fb2022744894749b7c78bf89
MD5 7cd1f887d1d568e9a5dc5d2d148210bb
SHA1 42bd8b7856371e01d620e276fdea200d7193f7f7
SHA512 1ec9c530fa9f82b0ea379430bfb3520d67d0b9a4b9427e252094e41f0e344fd62c8ba2fdf0473016fe42830eb9e3482d023a260dc2554171403eb078f5d1fd54
SSDEEP 12288:43h353nL7C57I6MBk/HZUkih4IwWhZAXoHT2u5Um:BHZUeWhZ2uN
TLSH
T16A55E761D64C3EA282DE427E7557ED03376CDBDD42C448A7B385C58E3FA8185322EA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxCrashHandler.exe

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\RobloxCrashHandler.exe
Size 12.5MB
SHA256 98e939835d022d9430ccfca5cc654380c04d33fb26b335f74cada93729c030cc
MD5 ac8c12c968848e294520e95ce7294732
SHA1 cfd3146938076a345e79bb8741891ddc376f9cf4
SHA512 aca3ae478a3113659941696dba8ed29f2a2c4ae1054348e52a3a5ec4995dc06a1cb0ed57fd79a13de612ad019ffbd8f0b9340ed264254e045b5300c0b1cca939
SSDEEP 196608:ZUeTnfzN5Nm2Ne+eJ4rJGTzkhtE6BNx/BYedf:Zv9m2FJGnkht1NL
TLSH
T1FFD69E6AA2BC00E8D4BBD17CC6469617E7B1B815037067DF16A04ABA1F23BE41F7E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.dll
Size 22.1MB
SHA256 6ee5053665a3d722337d0e14becbb614b603b19d952538e3eb9ba6b76cef2ee8
MD5 c7adc2b645f3f538434e149310b2255a
SHA1 5a6ef8f384f6eff5898d72a4c9792819490bfcab
SHA512 80038b6c6f0053844c55ef1d9d0be82ad2c0c8769b3805b69d2a6203cc42c69cfd56ff96ef38372fe06c40fb7de6ceca1124e4e46dc935f38ac8f3cb3c5621a0
SSDEEP 98304:HAISODF7F+aFnWEFuqZ58PHs5bHHVwpWYKUTECZZD5j4Bbf9yW0AAYYqddfeg5Vl:Bxe5qjJPYvH/FabgalDOSBVjDrNhIHHe
TLSH
T15C37BFCFE8D70AA4CAA19070E15F67E3EB62714C5A582DF346A50120363376E265DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\WebView2Loader.dll
Size 162KB
SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
MD5 e2f9d2ef3446e70b50de50f577c6939e
SHA1 48e7721704249cebd1267280459b7b36ce99e177
SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
TLSH
T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UniversalAppPatchConfig.json

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\content\configs\UniversalAppPatchConfig\UniversalAppPatchConfig.json
Size 253B
SHA256 af56f033d5e60e51282f0dbfbada1f2b86a12ae8a5b31fef0c61feb0b78a3c15
MD5 c2e39a842c8d5a04748869c0e4fcf7fe
SHA1 c540d3c4b9cfb8268a045537be905846ca347453
SHA512 b7ab71d329b415bfb27b02f5836a0e5aa4b551cc82ab7c7ff5f397afdab93c701dc627ab8ff906a88bdc755d7f58abb47251997650eb91a3e94f14ec8f3c94af
TLSH
T165D09754B932C8EB808A4B5C206D3210139C63BF1301CA0CC2C7B820C22E1BD6732F29
MD5 SHA1 SHA512 TLSH

Submit Download

SourceSansPro-It.ttf

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\content\fonts\SourceSansPro-It.ttf
Size 92KB
SHA256 1b78bc1c8104348e13fcc043331926f818ce290556350b1a90a735fe038c73d4
MD5 3d7cb86547ce5075625915f2e86d0687
SHA1 e2c802b01d5437f3901773b2183c461efa49eaa4
SHA512 d2ff0d2bfe01d3a1dddf6c04f2cd3aa6b65c77eb7b0e9774aed3cd4b7096ed4ffff45e4373850348c0321d27361b2a95b63151f48d9e96baf29afa751302b3fc
SSDEEP 1536:RknOCowsSiyOKF6aUCPCJvil+MvEqELElU+HB6:RknIwsS5nF6aU2GilvMSHI
TLSH
T176930943BBFB9957EF265EF8CDE1C3A54375F802FF74A50E9851AA91C89F2010807A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SourceSansPro-Light.ttf

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\content\fonts\SourceSansPro-Light.ttf
Size 262KB
SHA256 3eb3ad852d98c139c78064804524d0d2472b3efb872dc176b217fb57ae6a6f78
MD5 81cd217e4a8160a930c6d5fb8d1e8e82
SHA1 6150358395ba0c580e04841a7a4635ba014dbbc1
SHA512 4c2abde3813a9ccd332cb84a4a91f7e1854b9efa641b60facf19b3fb21f08d67b8d32ec1f7aeb3ac704238e754477fbd9a135a46357e96a001954dcd89f7b044
SSDEEP 3072:4gie4yh11CJ6ManpFSU/EyQfpBDPRORxt/oo6rGpxJvE53hcV:r4yowF1/EyKp2Rxt/oo66pxu53hcV
TLSH
T169441A8BFBFB5A0BF7562DF08ED2C3A95770F802BF70650B7852A6A0C99B25405039D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SourceSansPro-Regular.ttf

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\content\fonts\SourceSansPro-Regular.ttf
Size 262KB
SHA256 c9868de61ff2bab0b5a3a6d01c4b76f299459f08c6ae2f2c0383b4f9f6bedbf3
MD5 c1678b46f7dd3f50ceac94ed4e0ad01a
SHA1 fa4e303960cd8bf37a2171c4bc6186684f2d4178
SHA512 1b3ee35f20fd8245f9178a34a7c7754e30eac6f863ebf686116f87f41eabf39465fa09f576a5df2369808a3c3cc0a8ecd2da9cf01a29e67db9123c5cd2be61b8
SSDEEP 6144:Q7ojGvahXMjAtl3sRTt/ooor+iErBnhcV:QcltyACPnhq
TLSH
T1E2440787FBFB460BE7865DF48ED1C3A96671BC43FF70650A7852AAA1C8DB24144039D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SourceSansPro.json

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\content\fonts\families\SourceSansPro.json
Size 1KB
SHA256 c09f02584dcfb24cc9eba138638789f7b44460c3e71455e29140439813336402
MD5 c1bc6a36c492967c5457a783280e55ea
SHA1 b0147fb9166d78ec8da07058191c508275299971
SHA512 59b3c72e37f7df31491df237349e76c3bed6c0c14ed8589a0259b98242d3c1e502c672f85425a5bb4af2410ada12a34fe818ae5abcee5ae2b8be0edd02eb02e2
TLSH
T148310B6FD54C61C74E90088E213C29C0516C13379AD8C8DEFE784C3AB1E88756177EB8
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\Versions\version-d584fb6c717a43d9\ssl\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.733.0.7330989_20260807T025702Z_Player_DA113_last.log

Path C:\Users\Admin\AppData\Local\Roblox\logs\0.733.0.7330989_20260807T025702Z_Player_DA113_last.log
Size 2KB
SHA256 110bf9c085bca1c1980b256d4d8f61076a7a9b1ed5edbb3ecf70bb58363370be
MD5 c21c9ffa173db1b68b7a85889e195517
SHA1 2977f23b345b7e0f9182039fd74e5d6e92b1386f
SHA512 83b320148e924d55f0e990685b3f52a59fcf8b81b810884fc9739a60a4f887417617c6ffdb325e47f3093756633103c1188d403124d863240f7fd6d99bf71f08
TLSH
T1DE419BF9C2A606BFA98D036FC6989B7DAB0338C0272F1318E11CB54C51D40559975EF8
MD5 SHA1 SHA512 TLSH

Submit Download

0.733.0.7330989_20260807T025702Z_Player_DA113_last.log

Path C:\Users\Admin\AppData\Local\Roblox\logs\0.733.0.7330989_20260807T025702Z_Player_DA113_last.log
Size 3KB
SHA256 018bd1975685018c959d1ed9fda7a250bc059e6093290c8867f68b497bc37ef5
MD5 47e394de5d2fd49250e7821fab442351
SHA1 9f7dbab20993da5a285d118d811cceeb732d8002
SHA512 5dbee40580b79071ca9fc80f9385101c32554142765e6e4ee123b7fd715d174790bad890867ef48dd0ee669bcd4eb894f3dbb3a3f7dd1101e627b09a9f750277
TLSH
T16A71FCF882A6067FA99E139FC5AC9B3CAE133880372F2355F20DB54D40D44659971AFC
MD5 SHA1 SHA512 TLSH

Submit Download

0.733.0.7330989_20260807T025702Z_Player_DA113_last.log

Path C:\Users\Admin\AppData\Local\Roblox\logs\0.733.0.7330989_20260807T025702Z_Player_DA113_last.log
Size 9KB
SHA256 b478d9b1cdfda8250ec894cab62198a7c71f927b952abc8abf5a7d2fab51da7b
MD5 3a79eec489cb88185cb2179105b3b3ea
SHA1 bc30a9ccb90acd71bfad8cf5a55cfcb2867eb9d9
SHA512 34f006fab973d6b60bcb70b0d0da917197a3df5befbe203ccf268bd1ecd123fae8d69450c4c7ae19a6c53c33bc6438d550e9c983da5ad418f9bfbe377e5f0143
SSDEEP 192:aL1HJja0aoyg8l2dwXpGFQPvUR9ADzcD/c0q1+w3S3gMGQS00ZhlC7dFYtPWL83x:wN8MqXpGFQPvUR9ADzcD/c0q1H3S3gMk
TLSH
T11022FEB4C264947F548F679FFA6C2B3D5E1331403F1BB228B70C9A0E55C8D6989229F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Users\Admin\AppData\Local\Temp\madium-patch\C__Users_Admin_AppData_Local_Roblox_Versions_version_d584fb6c717a43d9\RobloxPlayerBeta.dll
Size 18.9MB
SHA256 67d36d7f49eac6e53fc1344b0e5a17609dda25df1086dd9ad7bbaa3d05cbd339
MD5 11ac104f86488b124b631257c7eb9499
SHA1 67d08cb56db073bbe477a6d0db0a44fe689b3e8f
SHA512 ec21637ec90d02aa50433ec6472e7af9e6cc0c564a2467fbc28bdac045aa87e07595eef37481970d3a4e57d3d2498a28faed8681b20d2f73bd70ecbbacc898f8
SSDEEP 393216:6NZB7W2alVxXf828BuHfd68j0amSfpVDimCuj6JZ6jfTU:SPMXf82AAP+SLnD6Jeg
TLSH
T13717F1BEEA8153C4D946ACFA91DF3DE6B3D0393C8F26E4716D1B828693301245F54E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rblx_version-d584fb6c717a43d9_RobloxPlayerInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\rblx_version-d584fb6c717a43d9_RobloxPlayerInstaller.exe
Size 13.0MB
SHA256 d527cd3c5d7506571d5d6902cbf90015f05574a57d611b616052877957bcd659
MD5 d444176101c29a0b4a4edaee7215443a
SHA1 da4a9447fda68deaf9b4c57d2978d894804e2b0b
SHA512 185dbe780fe982009920c8a4050ca8f8ecbe1a87d1221dc8cd3df43c74e86436e7deee59c976ebbebd616656c2e5904aa3a9685d4241b4cf191a3b46f61edaad
SSDEEP 196608:MYBPWIdJg1wdZ/mwSSh48J3b8U16O5uJtmBd:NJXTg1smwS848Vb8BJABd
TLSH
T1F3D69D5AB2B800E8D4BBD178CA565617EBB1B41603709BDF17A046E61F63BE02F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 278fb42b4a9863ae2e676c337fcf6d37b7d2418d665e5732c4dfd54990b5e9c9
MD5 c55e22c4a926ec6e09f2620959f9a2db
SHA1 68948daee4af5e68fd854d431bb9951b4dbc3a8f
SHA512 6337a6e3d2b68dbaf136eba5eb4778ab7b945a8f460022b8a523ec7ec22e27b4dfd6da8a6d8d1ef4fcce775a2eab5ccbcde34423559f3f2e10e4b89ed1694363
SSDEEP 96:P9VzYmkJmRazHumz7zQN9VzYmkJyRozHumz7kG:P92LERA6N92LQRi6G
TLSH
T183A1CE0406E21A52F2F7EE7355F3BA119677B845EA044EDE04C183040DB2B80BDB9F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 fd4ebfb4d41674797b70422abbc2485465c050ecf24b1cc72f276595c8c362d7
MD5 ae6e31b286766c58fe6343ec3433b6c3
SHA1 7539571992682df49c6fc23f5a04fe672384882c
SHA512 d0228f87be7a2c125722ebf6bc9d69018f7c092600d7d92563df944f56eb75ce95897c12b52c14e842d431bd4deedb1c887b40c77ae51ec1f310e0c7476937d6
SSDEEP 96:aQZzYmkJmRazHumz7zQ79VzYmkJyRozHumz7kG:aQKLERA6792LQRi6G
TLSH
T1F4A1DF0406E21A52F2F7DE7355F3BA119677B84AEA044BDE04C183050DB6B80BDB9F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cracked.zip

Path C:\Users\Admin\Downloads\cracked.zip
Size 16.5MB
SHA256 cf4af9742230d2e28f40812f6fc29aecdd7721080c936c7e027e203efee8fcdc
MD5 74f62ec84d8392d0f16f705b987702b3
SHA1 036cfc4d922a95990262e071a5efd984eef1b3f2
SHA512 2f7df77f353f9d03cec42d3da30097a7be377928048ff6ca6403cc21770a58f3f5f1dc46c1d77b89bc52d027e4eaaa072c25fb3411a582fe3f7ec0397c900225
SSDEEP 393216:IZqVOsLf68YNBgT2DxHZ9nPKGMgqrxK6TGJAP24NPjeBjkJiR4uMqQ:IcMWAg67L2RTo6B6BbR4uMqQ
TLSH
T1DA0733290A847C10ED94DB8C324860EB977590A1FD964EC9930F6A06ECCB59F673FCE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\Downloads\cracked\Loader.exe
Size 298KB
SHA256 2b61296fafa08458e1e3e3d131b20634fcebbac1be8b71374cb3c03303612638
MD5 f39ad06b7b82f0470e34d3652dd38c80
SHA1 329b712c1117727f2d8709d4b720569144784430
SHA512 a5eb7d9c5ddd44f30c4af1f0a12076c3864f000fae5614710bb908176441a183f76f791961a9add516380beb06fdf3d2b602157c0c1c107f3b1e5ab4fb25e348
SSDEEP 6144:TVePbDuA1Ie3dWmwc3KrLoCrtuXw8Taa3p1NjiU40i/QqkUSutYFrjW0DzQiROJJ:TVePbDuAT3dWmwc3KrLoCrtuXw8Ta99f
TLSH
T15354EA17E18AB07DD21896F8D395CE75C638B43D8328DDEB1BA18D6119329D36FB1A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Madium.authspoof.exe

Path C:\Users\Admin\Downloads\cracked\Madium.authspoof.exe
Size 12.0MB
SHA256 c2bd8149ab84f1faa5d91898c2be384b0c61130580acff8b2e30845fbcaa99a1
MD5 9e02992b6274ac18168b021794720267
SHA1 02e5a5e24219470aa650dad9915579e3dca864d9
SHA512 84fbc4b6bc0b313072aaf82ceac9f20e7c45e7b0b54289921af6916f504096e13f5b8de908dca25d7f0e711ff7378a03aa97b422dd09cbfd874a90004c91dd7d
SSDEEP 196608:/V7/9hXNfqln+/Bwar7BpPH3hjL7HfD0DUWw:lF9NfqN+/VBpvl7HfDEUW
TLSH
T1CBC6AF07F684C1F4C4AEC278836B9636EA32B8894524729F1BE45B112F2BF606F1D75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUNTHIS.exe

Path C:\Users\Admin\Downloads\cracked\RUNTHIS.exe
Size 6KB
SHA256 0f9de1348ae8631769a4a59ed17aba91e83fdc251af35b8334f5982bdec57e3f
MD5 052315b2b90d36ea7c81149caee90541
SHA1 740333b21d6af28653cfe8e6449d48594b7f00a5
SHA512 fcfd81033ef65061ada88a1618a1c24099a0d2a50fd907189badd70cc7d9bb56f857873ad8c7292098b4333deadb2a1d3cd599c6790549b058f4fdb740610911
SSDEEP 96:3GZjaEEISl7Wwlg2xNlEJ5YAyW0PGhGaa5iS+NbzNt:IjaJISNlJxNlQ5YAd0PGhGzMDN9
TLSH
T1F9D1FA119BF84712E1FF8B7C1EB303202772F623953A878F68C8629A6D127940675BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-3794-0x000002082E9B0000-0x000002082E9B1000-memory.dmp

Download

memory/2356-3801-0x000002082E980000-0x000002082E9AB000-memory.dmp

Download

memory/2800-548-0x00007FF93D3C0000-0x00007FF93D3C1000-memory.dmp

Download

memory/2800-730-0x000001BC82B20000-0x000001BC82B4B000-memory.dmp

Download

memory/2800-549-0x000001BC82B50000-0x000001BC82B51000-memory.dmp

Download

memory/2992-3958-0x0000020495650000-0x0000020495651000-memory.dmp

Download

memory/2992-3973-0x0000020495620000-0x000002049564B000-memory.dmp

Download

memory/3960-442-0x00000000000D0000-0x00000000000D8000-memory.dmp

Download

memory/4108-3864-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3860-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3855-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3862-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3854-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3863-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3856-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3861-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3866-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4108-3865-0x000002A8825D0000-0x000002A8825D1000-memory.dmp

Download

memory/4196-472-0x00007FF93C890000-0x00007FF93C891000-memory.dmp

Download

memory/5156-4047-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp

Download

memory/5156-4013-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp

Download

memory/5156-4011-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp

Download

memory/5156-4004-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp

Download

memory/5156-3974-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp

Download

memory/5156-3890-0x00007FF90E5A0000-0x00007FF91028A000-memory.dmp

Download

memory/5540-575-0x00007FF93C890000-0x00007FF93C891000-memory.dmp

Download