hxxp://roblox-exploit[.]com

Resubmissions

09/08/2026, 12:35

260809-psqsba1vbv3

09/08/2026, 11:55

260809-n3jw3sel5x8

08/08/2026, 22:35

260808-2hp49aztfw8

Analysis

user interaction
yes
max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox-exploit.com
Sample260809-psqsba1vbv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1564	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307525584995179"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{4C3400A0-9EA2-47D3-9146-B4B69C9096C6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	1392	7zG.exe
Token: 35	1392	7zG.exe
Token: SeSecurityPrivilege	1392	7zG.exe
Token: SeSecurityPrivilege	1392	7zG.exe
Token: SeRestorePrivilege	1404	7zG.exe
Token: 35	1404	7zG.exe
Token: SeSecurityPrivilege	1404	7zG.exe
Token: SeSecurityPrivilege	1404	7zG.exe
Token: SeBackupPrivilege	2792	svchost.exe
Token: SeRestorePrivilege	2792	svchost.exe
Token: SeSecurityPrivilege	2792	svchost.exe
Token: SeTakeOwnershipPrivilege	2792	svchost.exe
Token: 35	2792	svchost.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
1392	7zG.exe
1404	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4240	2652	msedge.exe	85
PID 2652 wrote to memory of 1564	2652	msedge.exe	86
PID 2652 wrote to memory of 3924	2652	msedge.exe	87
PID 2652 wrote to memory of 2544	2652	msedge.exe	88
PID 2652 wrote to memory of 3924	2652	msedge.exe	87
PID 2652 wrote to memory of 2544	2652	msedge.exe	88
PID 2652 wrote to memory of 2544	2652	msedge.exe	88
PID 2652 wrote to memory of 1884	2652	msedge.exe	89
PID 2652 wrote to memory of 3500	2652	msedge.exe	90
PID 2652 wrote to memory of 1884	2652	msedge.exe	89
PID 2652 wrote to memory of 1884	2652	msedge.exe	89
PID 2652 wrote to memory of 3500	2652	msedge.exe	90
PID 2652 wrote to memory of 3500	2652	msedge.exe	90
PID 2652 wrote to memory of 60	2652	msedge.exe	92
PID 2652 wrote to memory of 2080	2652	msedge.exe	93
PID 2652 wrote to memory of 60	2652	msedge.exe	92
PID 2652 wrote to memory of 60	2652	msedge.exe	92
PID 2652 wrote to memory of 2080	2652	msedge.exe	93
PID 2652 wrote to memory of 2080	2652	msedge.exe	93
PID 2652 wrote to memory of 3472	2652	msedge.exe	96
PID 2652 wrote to memory of 3472	2652	msedge.exe	96
PID 2652 wrote to memory of 3472	2652	msedge.exe	96
PID 2652 wrote to memory of 1068	2652	msedge.exe	98
PID 2652 wrote to memory of 1068	2652	msedge.exe	98
PID 2652 wrote to memory of 4804	2652	msedge.exe	99
PID 2652 wrote to memory of 4804	2652	msedge.exe	99
PID 2652 wrote to memory of 2424	2652	msedge.exe	100
PID 2652 wrote to memory of 2424	2652	msedge.exe	100
PID 2652 wrote to memory of 2520	2652	msedge.exe	101
PID 2652 wrote to memory of 2520	2652	msedge.exe	101
PID 2652 wrote to memory of 2520	2652	msedge.exe	101
PID 2652 wrote to memory of 4676	2652	msedge.exe	102
PID 2652 wrote to memory of 2848	2652	msedge.exe	104
PID 2652 wrote to memory of 1440	2652	msedge.exe	110
PID 2652 wrote to memory of 976	2652	msedge.exe	111
PID 2652 wrote to memory of 1944	2652	msedge.exe	112
PID 2652 wrote to memory of 976	2652	msedge.exe	121
PID 2652 wrote to memory of 976	2652	msedge.exe	121
PID 2652 wrote to memory of 3008	2652	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox-exploit.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fffe8c1c188,0x7fffe8c1c194,0x7fffe8c1c1a0
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,13618594354382830078,7345578190535635151,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,527649378132841956,15164871820877111033,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,11220330350411671792,7695254870873795607,262144 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,12465862250455644310,10870626422057182598,2097152 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,346874766189860364,3545497424370879968,2097152 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,1932325516464074926,17791663467865149482,2097152 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,10911516124113358981,6276621983066312570,2097152 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3536,i,10760678968739814859,14206184120231403725,2097152 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,15662074327013527280,2240271010352028268,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,444105501128034044,1440032121825625689,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,12596600573556380653,7565484309158542692,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5764,i,13967566313871037147,11423592328719757240,2097152 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,17775963288305198240,9527563492092448800,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,9382082771988967480,13189958550561113350,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,9382082771988967480,13189958550561113350,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,14433034685168434679,9443344517220564363,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,8571579201857448738,12919133195547423991,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,7628135099225063547,13066588621180090440,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,8670409902608707061,15693642108461745790,524288 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5488,i,13642180820422168276,5759279500166362760,262144 --field-trial-handle=2264,i,1098872582573920268,9465967531076979883,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4132

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\uploads_Bооtsехеcs64\" -spe -an -ai#7zMap11092:102:7zEvent23191
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1392

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\uploads_Bооtsехеcs64\RobloxApp\" -spe -an -ai#7zMap25806:122:7zEvent32451
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ab43076390a13c94b75969c67e2d039969084ef834afa110eddf56bfe88d4eca
MD5 904260be2e464761d1e662a73b7149ea
SHA1 3d177a5a41181e125cb0a630d520499c5cf71772
SHA512 6c0fabe38987c16734e6a57b39cf470ad67e8db75ca0ff58672e362ae0e2d40a21763d1aeec282c01c3b375baebc177a338afd91ef3c865dbc71dadf2e4cca4e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T108B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bfda4afdf4c67967b5a784577f35763a150aa7f5bf9378808714059736a9e66c
MD5 b9148f00dfc6b7fc7e584760a1d88bb5
SHA1 a63a65f3addd4bcdbd2bef1e357ac242db9730d0
SHA512 fca7e01d63180176b4f60b8728f74d30036cec0562a9818b0cd1a5d4d8b64e46f20260af9b25be441c52b33e2561e709d995e88824d34f7c2e00fdd2085b61f7
TLSH
T1B0712DDB0D324941E7912330D0C1374475FC89A70B1F9E4D8A689FBFA51A7F18E26D19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589239.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589239.TMP
Size 3KB
SHA256 99104ca971211a2dcb0edcf764c90e40885b5f3944c0942cfeb993a84d15cf3c
MD5 3a4e7c79140d612933eafa0c603a3975
SHA1 6f0350dabfe2c89bfe675eb57362ef272179b4a9
SHA512 5d34420822154b82e3787394688cbcefc9fdf8a9f43686a58657a6c9d823a89436fcd2f6d84c81ee63c8c0512857767a61b0fda4df2be227ae59f8dfef1b9d59
TLSH
T1E3713CDB0D324981F7912730D0D1374471FC89A70B1F9E4D8A689BBFA51ABF28E26D19
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 942c6f31283e0d41ea787610864788a0ff9b974ff81db7340389e74ac82ded2b
MD5 c025f03126aef9713491dc260c17168e
SHA1 256a05ff9f6302f3ecdd5723c9de078d6dc62767
SHA512 72a4d9e27cddab5363941165ecb6be4dc0d570681efe9267c0e99a564d4a1660daccd1f1cb3f3a9ab0ffccfe3ad3bce9c961f99daad43e00d8766bff165b9eb0
TLSH
T179317CF2D2E585AE9D1216F09A286E27DE1D091442183D6DC9E4FF5F93F2470E20168F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a3fdebc20087579440b5933728af9dd908bb8d0659009946fb636a17ed1df23c
MD5 e3b19793ab395f7cf84cb553ba510918
SHA1 4cf0340c88c14c0890acd1448f255b9bf0068855
SHA512 5e187776b69c399334e432fa7d0c2ea9cea45ecee140ddc8f04a5d8df089a377215f2a44354694108958441976f4464c3d14138cd97ac3afe8ca86677170a9f8
SSDEEP 192:sxZQ6RJyM/jK1Ml8M92/fXRsnTKS/IdpuqHW6+WN9m9/YLDXHtlIgrJ:sxZlH12/fhsnZwdHbS/i9
TLSH
T15052E7116A346977CCCBD209B955BF53D6F50472A2900E58AAFCDA1C04F6AED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 80e3af49b920321b8e124dccfcfb51c568ac53ac09e4f9b2bc402aa5c4d1c39b
MD5 c442b7716ee58e022d025a110708bc11
SHA1 8b487c37b834fdc5e9cb729fc2905e2667be0936
SHA512 ea75b7ef77b26aa4d3832e1e26acc4b7371099e68f488080b04d595a3c6d037d40ec199372c26633add15f687dacd637ac54905da7daaeb84d1793cff23679f7
SSDEEP 192:sxZQ6RJyM/jK1Ml8UQX92/fXRsadKS/IdpEqHW6+WN9m9/YLq4ntlIg5dJ:sxZlHqN2/fhsa3wzHbS/i5
TLSH
T17652D611AA345A77CCDBD20DB955BF53E6F50472A6900E58AAFCDA1C00F6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1bd94dfe9267537b90409459977eeafcf3826b43922aa60c2add09d2a9fd82cc
MD5 8dd89b82eb3f77c8031eaa3c4b006254
SHA1 ed5ec6d23876acee4ecc3a95643e15fa783672ad
SHA512 d0f1bc67ab35aa1132118ed79a31b8d371d03c7b42f214fde2982a2f8765803b79b5e2c336492c6fe3da059f96cf3dc087bb936f84610ead5aa428161f7d70db
SSDEEP 768:yss6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNlro4x:yss6pD1WvxzWju1jahILIsNe4x
TLSH
T118D2FA3B680CCB7E4F844E5CAC2A6F967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f4a4ad0966db7fde36de0a6a0bc9746c532a5934b477fd8f3a21d95e0370b3bf
MD5 6b37f717174be66b5a57efd2b2ba9903
SHA1 fc637999f510d9d186c8e9720521d5f170132f85
SHA512 8a658eca4a6bab0c5b7a87529ce2f7db7081848aed41681bc6ff2d96fd7d3e87290e5b419c995c9e352140c6882b90bae20fdd247f367319e8f3c560ee170b17
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIypOIPKTC8pKIPK3qkfyp0IbK9Kcs:KUAAKteP6OYKTCEK4K3qmq0gK9Kj
TLSH
T1F4C1021271BF06023DBE2A0DA2549727AB427163301DA42B77E950B11E6BE344DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1150240-37ff-4b52-a0a9-fb1c99c72c32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d1150240-37ff-4b52-a0a9-fb1c99c72c32.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 b3b55805ffcf4f9dd60ee50d654247c08e67ef4aeeda4f5b0f47fc52dca670e6
MD5 47d16481bba50c07f5101f923f46e8db
SHA1 9e98b453429f2442e37e93096be45942e7863b73
SHA512 9a3b9bedb013aa434255831d6e00682d258ce97613294cf4c0545190a2739540bff3588aa2693eada4afb5b8cc37299f34cb188e43f6d1f86a348c23aed13f7f
SSDEEP 384:MsNgK/GObBN3La95OVnuzJrsknTKwBODNZOCK52:MiG0LOjOJ2hsknewBKZOR2
TLSH
T1C8725B35782C5C779DE3A145F94B320B9EB841B7D9852E94D6ECAF0D00DB69C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 920c6141afa35412ca28161a7026efd47e4f9ff6eb490dff79ac19df2eb49ee7
MD5 a018f45e8b203576112bf57fe9d7253b
SHA1 7bf4e9b8dd2ede09b14a75a12034a1fe212560bc
SHA512 6d6f4b57ba2a66a513bbf677f2438ccda81214039b729d10b40f24aa9cdb50ddef9a74a9437cfa5a7a1a255593b6413e86511720115c73a8889e6b9087ee233b
SSDEEP 384:2iFRqsND8TUNTUlIlK/GObBN4La95OVnuzJru0knTKwBODNZOCK52:dF0YwgMG0cOjOJ2hu0knewBKZOR2
TLSH
T1FFB2F8F258DB8876D9AE5743A77E2D078EBCC0A7B4412A54B398590CCC971BFD306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 a7a0eab93d4d26e75fe99e4d339c3b2fc967a08c01d17078f9b0e24cedb1bf25
MD5 fb10dca6d219c7fcaa1809d01f665259
SHA1 5b18aff37ca774855f1a7cbbfd66b8c8886c9e61
SHA512 28a7b2218636be2def0631f1a862a5526fbbbb925f2ce10995310d9a5f0658cfe07beca4ed0aec8bf938496d3c8d5f5af814f919cba8e7de7a0ea082a2ffd32b
SSDEEP 384:2iFRqsNg8TUNTUlIlK/GObBN4La95OVnuzJrLknTKwBODNZOCK52:dF01wgMG0cOjOJ2hLknewBKZOR2
TLSH
T1A7B2E7F258DB8876D9AE5743A73E2D078EBCC0A7B4412A54B398590CCC9B1BFD306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 26d21589951a9a5913514fbcca22c30e30cdb2bc10f54c42bd04a6ab36100f07
MD5 0a1225b9793ebab52ae26203c38d7063
SHA1 97097da22ddc553acd46855701e06949cbcc577a
SHA512 fb982fbb161437d6aec6c0d22cdafeb4ffcc756c2ff999608c34a35d2bfa5912bc1a9c2c8c7d4d5521e3760f25cac3d8734a7570644efe4604115121ace8c423
SSDEEP 192:qONi6O7+3hQmiUy0AGttb0gO2KDgGGqdU6:qONi61AGt95OVHvdU6
TLSH
T18A02E8357D286CB78EF2AD45FA8727179FA5113BE9912F40D9E85E0C00D765C2343C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 adca76bb57a666ece3c08090b0ecf2413be44c54c4170c869845aef347483b95
MD5 8f1d44758c282ea3f02e3928cba902ca
SHA1 c4d87f7696909af64627544c58729e25486ee14b
SHA512 430ee2c25c38bbec5ce4fa50bc8b955617a0f6bf89bb2c5d21c32db8e67366e797b12303efa2d4236a0efdf29ab0ca6746bf47f1bc4f667b4d0e12c05ad50d0c
SSDEEP 192:uQ1ysNgaQKHG27bq7+3voYQmiU1Nf04atb0gO2KnyF0SJr7LMDq0aU8:asNga/GObBN3La95OVnuzJrskU8
TLSH
T1C8322831B868AC769DA3A141F94736139FB50077DA892F94D2EC6E0C01DF6AC230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 12899b0d4665a37b94d343ea6ed22da67a2848801476d12314c3d4932999fca2
MD5 e2650267c778ceeb34b5da4f35f5fa69
SHA1 8e9e2230808981f2b3af93cb8a397983f84a5d17
SHA512 72f09ded3f4c6a3613d2770d26884bd818d51da57f9bc3465550905e3fe73c704b53e65ddb18f8e85b7c69956e2b4c415f5b93bbd24da9108da4d1be8e38965c
SSDEEP 192:uQ1CsNgYlQKHG27bq7+3voYQmiU1Nf04atb0gO2KnyF0SJr7LMDq0aU8:qsNgO/GObBN3La95OVnuzJrskU8
TLSH
T10E421835B868AC769DA3A141F9473613DFB54077DA892F94D2EC6E0C01DF6AC230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9aae76439fb20971560a0dacbea34004a152c6f4e30dbdaf42deab957c0a9997
MD5 2ff3449082adf2930b50df7c1cd5fd14
SHA1 a0a81c5c0e2358ad10db2038528b735773373794
SHA512 f9a7b45929a129fc021d3969f5e39a86cc2bfa50f5e6ae4cf1134dfab9e607293667a5aa2775ea499d479b4bb09c00db16babc422d199d1409ebf4ea63706008
SSDEEP 192:lONp6O7+31QmiUyuAJttb0gO2KnyF0SJrGcNDq0aU6:lONp6ByJt95OVnuzJrnkU6
TLSH
T110122B35B828AC775EE2A541F5873617DEA54137D9462F80D5EC6E0C01EFAAC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b692ebb-640e-4f0b-a933-98b06f66b793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2b692ebb-640e-4f0b-a933-98b06f66b793.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 15330ce2706aba3d63a792000435f2874e2d27f8c06dc75f6739695584aa0066
MD5 e39d040662ebce24d38594a98d3e526c
SHA1 366379033e4d4339ee9c78c20b9628b18e3204e6
SHA512 c032ee7e25e7f5b5f2f9860784f6f78669e82b0699921d8f3fc3ca3935104c9d0e16e6dbfbff3bd4bf12e03f96ff3bd3744e079057210face7eaf7bf6e984461
TLSH
T19B410C4D76E91144B3B76E4A9BF7646D447F78731F06D5AD10110D4E0772B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

uploads_Bооtsехеcs64.zip

Path C:\Users\Admin\Downloads\uploads_Bооtsехеcs64.zip
Size 6.0MB
SHA256 bdcd4000c0024c7a3531a1fb3d3d7f5c804f9095cfabc208ee293b3b96eb3238
MD5 06c05df45dc34973e4684b26847f8fe4
SHA1 7c24fe7449cea64aea1c2bcab70d6b8ca92bfef6
SHA512 7eed87b3b6fe4de579c65bc8787bb76ed1db34f45a3bc21b1d943952bfc0e37430af379bfeedffe8de2be8dc6f94f06c40a6d7710d421d4eb4ba88b53f841e7f
SSDEEP 98304:eo6R0AGu7CAtT4a4l51trC3e7CDs/87hPGXBh52WZd3xmGCShbPxNPSKxyliA1ws:L6OUBTul5q3e7is/2POx3YWZxNP9kiAZ
TLSH
T1805633F3959BB38986600162698E2E3233D75E36D53432479428913F9AC04C7E6EEF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxApp.zip

Path C:\Users\Admin\Downloads\uploads_Bооtsехеcs64\RobloxApp.zip
Size 6.0MB
SHA256 00873dfd235bc96e57f7f696eb8a8e27d88cd6c4157b063fccff628fab7af95f
MD5 dcbe0e4a25f5a50937743524a1024f8b
SHA1 a1d7494c06bc4c755f768b80d0686f11382eb973
SHA512 0b9866a76e9b57da50c6c1b2e88cbfbb27496b1cdcb40cb2ea558eb359d94378b7ef16687833066427c103ced33fb8c7e4ab8d85dabef094d6a3238567547669
SSDEEP 98304:tz/90lTghFn4D0+dSRb27yKzKiSiMz+OGQC4dxBK1hUCAQl7xJAqyneSBhinEjaP:VWghFn4o+MRI2ilOGQ3dHpxTcnEjaeaT
TLSH
T1AB56335CD56E3BD09E11D0B0FEE09551DC420667C40C7BAAB832C9A3B6DE7EB60937A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download