hxxp://roblox[.]com

Resubmissions

10/08/2026, 02:28

260810-cx2n6ahn418

10/08/2026, 02:25

260810-cwbfkszapf3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
405s
max time network
408s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com
Sample260810-cx2n6ahn41

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
337	4400	msedge.exe

Executes dropped EXE 19 IoCs

pid	Process
6960	RobloxPlayerInstaller.exe
3272	RobloxPlayerBeta.exe
2132	RobloxPlayerBeta.exe
6356	RobloxPlayerBeta.exe
6364	RobloxPlayerBeta.exe
4520	RobloxPlayerBeta.exe
4292	RobloxPlayerBeta.exe
4332	RobloxPlayerBeta.exe
3016	RobloxPlayerBeta.exe
7068	RobloxPlayerBeta.exe
7124	RobloxPlayerBeta.exe
5884	RobloxPlayerBeta.exe
5808	RobloxPlayerBeta.exe
2984	RobloxPlayerBeta.exe
5740	RobloxPlayerBeta.exe
4988	RobloxPlayerBeta.exe
7088	RobloxPlayerBeta.exe
3472	RobloxPlayerBeta.exe
2612	RobloxPlayerBeta.exe

Loads dropped DLL 9 IoCs

pid	Process
2132	RobloxPlayerBeta.exe
6364	RobloxPlayerBeta.exe
4292	RobloxPlayerBeta.exe
3016	RobloxPlayerBeta.exe
7124	RobloxPlayerBeta.exe
5808	RobloxPlayerBeta.exe
5740	RobloxPlayerBeta.exe
7088	RobloxPlayerBeta.exe
2612	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs

pid	Process
2132	RobloxPlayerBeta.exe
2132	RobloxPlayerBeta.exe
2132	RobloxPlayerBeta.exe
6364	RobloxPlayerBeta.exe
6364	RobloxPlayerBeta.exe
6364	RobloxPlayerBeta.exe
4292	RobloxPlayerBeta.exe
4292	RobloxPlayerBeta.exe
4292	RobloxPlayerBeta.exe
3016	RobloxPlayerBeta.exe
3016	RobloxPlayerBeta.exe
3016	RobloxPlayerBeta.exe
7124	RobloxPlayerBeta.exe
7124	RobloxPlayerBeta.exe
7124	RobloxPlayerBeta.exe
5808	RobloxPlayerBeta.exe
5808	RobloxPlayerBeta.exe
5808	RobloxPlayerBeta.exe
5740	RobloxPlayerBeta.exe
5740	RobloxPlayerBeta.exe
5740	RobloxPlayerBeta.exe
7088	RobloxPlayerBeta.exe
7088	RobloxPlayerBeta.exe
7088	RobloxPlayerBeta.exe
2612	RobloxPlayerBeta.exe
2612	RobloxPlayerBeta.exe
2612	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VR\hoverPopupRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\configs\DateTimeLocaleConfigs\en-au.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\avatar\defaultShirt.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\avatar\meshes\rightleg.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\DevConsole\Arrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\LegacyRbxGui\StoneBlockSide.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\Slider\BarLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\MaterialCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_1x_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\Amazon_large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\MenuBar\icon_home.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\DefaultController\DPadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\ScreenshotHud\Close.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\smallTriangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\MaterialFramework\Grid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_3x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\graphic\profilemask.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioSharedUI\scripts.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioSharedUI\Undo.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\PlayStationController\PS5\ButtonTouchpad.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VirtualCursor\cursorArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\models\MaterialManager\material_model.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\DefaultController\ButtonL1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\PurchasePrompt\RightButtonDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\New\Blank.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\configs\PerformanceConfigs\rofiler.js	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\sounds\ouch.ogg	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\PathEditor\Control_Point.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\MenuBar\icon_seated.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\particles\fire_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\DesignSystem\Thumbstick2Horizontal.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\Controls\DesignSystem\ButtonL3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\avatar\compositing\CompositTShirt.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\DevConsole\Warning.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioSharedUI\spawn_withoutbg_24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\ImageSet\AE\img_set_3x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\PathEditor\Tangent_Handle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\MenuBarIcons\HelpTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_10.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4400	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308026049562589"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-b2d03e4efaa04174"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{2A4910A8-C186-4450-BBB2-D68C8320EA1C}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{0CE3C16E-2AB2-4E65-A6BA-19AAAF559AE6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-d584fb6c717a43d9"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-d584fb6c717a43d9"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
7148	msedge.exe
7148	msedge.exe
6960	RobloxPlayerInstaller.exe
6960	RobloxPlayerInstaller.exe
2132	RobloxPlayerBeta.exe
6364	RobloxPlayerBeta.exe
4292	RobloxPlayerBeta.exe
3016	RobloxPlayerBeta.exe
7124	RobloxPlayerBeta.exe
5808	RobloxPlayerBeta.exe
5740	RobloxPlayerBeta.exe
7088	RobloxPlayerBeta.exe
2612	RobloxPlayerBeta.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4688	ShellHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 4992	2768	msedge.exe	89
PID 2768 wrote to memory of 4188	2768	msedge.exe	91
PID 2768 wrote to memory of 4400	2768	msedge.exe	92
PID 2768 wrote to memory of 4188	2768	msedge.exe	91
PID 2768 wrote to memory of 4188	2768	msedge.exe	91
PID 2768 wrote to memory of 3252	2768	msedge.exe	93
PID 2768 wrote to memory of 2764	2768	msedge.exe	94
PID 2768 wrote to memory of 4176	2768	msedge.exe	95
PID 2768 wrote to memory of 3252	2768	msedge.exe	93
PID 2768 wrote to memory of 2764	2768	msedge.exe	94
PID 2768 wrote to memory of 2764	2768	msedge.exe	94
PID 2768 wrote to memory of 4176	2768	msedge.exe	95
PID 2768 wrote to memory of 4176	2768	msedge.exe	95
PID 2768 wrote to memory of 2232	2768	msedge.exe	96
PID 2768 wrote to memory of 2232	2768	msedge.exe	96
PID 2768 wrote to memory of 2232	2768	msedge.exe	96
PID 2768 wrote to memory of 5396	2768	msedge.exe	97
PID 2768 wrote to memory of 5396	2768	msedge.exe	97
PID 2768 wrote to memory of 5396	2768	msedge.exe	97
PID 2768 wrote to memory of 2856	2768	msedge.exe	99
PID 2768 wrote to memory of 2856	2768	msedge.exe	99
PID 2768 wrote to memory of 2856	2768	msedge.exe	99
PID 2768 wrote to memory of 1948	2768	msedge.exe	100
PID 2768 wrote to memory of 1948	2768	msedge.exe	100
PID 2768 wrote to memory of 1628	2768	msedge.exe	101
PID 2768 wrote to memory of 1628	2768	msedge.exe	101
PID 2768 wrote to memory of 1352	2768	msedge.exe	103
PID 2768 wrote to memory of 3340	2768	msedge.exe	109
PID 2768 wrote to memory of 4888	2768	msedge.exe	110
PID 2768 wrote to memory of 4344	2768	msedge.exe	111
PID 2768 wrote to memory of 8	2768	msedge.exe	112
PID 2768 wrote to memory of 8	2768	msedge.exe	112
PID 2768 wrote to memory of 560	2768	msedge.exe	113
PID 2768 wrote to memory of 560	2768	msedge.exe	113
PID 2768 wrote to memory of 3560	2768	msedge.exe	115
PID 2768 wrote to memory of 3560	2768	msedge.exe	115
PID 2768 wrote to memory of 3368	2768	msedge.exe	116
PID 2768 wrote to memory of 5744	2768	msedge.exe	117
PID 2768 wrote to memory of 5744	2768	msedge.exe	117
PID 2768 wrote to memory of 7148	2768	msedge.exe	118
PID 2768 wrote to memory of 6600	2768	msedge.exe	119
PID 2768 wrote to memory of 6600	2768	msedge.exe	119
PID 2768 wrote to memory of 6600	2768	msedge.exe	119
PID 2768 wrote to memory of 5392	2768	msedge.exe	120
PID 2768 wrote to memory of 5392	2768	msedge.exe	120
PID 2768 wrote to memory of 5392	2768	msedge.exe	120
PID 2768 wrote to memory of 6748	2768	msedge.exe	121
PID 2768 wrote to memory of 6960	2768	msedge.exe	122
PID 2768 wrote to memory of 3324	2768	msedge.exe	124
PID 2768 wrote to memory of 3324	2768	msedge.exe	124
PID 2768 wrote to memory of 4448	2768	msedge.exe	125
PID 2768 wrote to memory of 4448	2768	msedge.exe	125
PID 2768 wrote to memory of 4524	2768	msedge.exe	126
PID 2768 wrote to memory of 4524	2768	msedge.exe	126
PID 6960 wrote to memory of 2132	6960	RobloxPlayerInstaller.exe	129
PID 2768 wrote to memory of 3972	2768	msedge.exe	135
PID 2768 wrote to memory of 3972	2768	msedge.exe	135
PID 2768 wrote to memory of 3972	2768	msedge.exe	135
PID 2768 wrote to memory of 6364	2768	msedge.exe	137
PID 2768 wrote to memory of 6976	2768	msedge.exe	144
PID 2768 wrote to memory of 6976	2768	msedge.exe	144
PID 2768 wrote to memory of 6976	2768	msedge.exe	144
PID 2768 wrote to memory of 3016	2768	msedge.exe	146
PID 2768 wrote to memory of 7080	2768	msedge.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x294,0x7ffac563c188,0x7ffac563c194,0x7ffac563c1a0
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,14068261027199921693,10447586032724556134,262144 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,16237415545343304115,10449412097669490013,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,3205264792736730843,8757666257020496947,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:13
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8804479410113952770,5897511503054279034,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,12264190627989314362,9717685095199622391,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,12435931377075879866,16530179641482803005,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,9497351719988169154,18378349385138457041,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5304,i,18383936128401733958,13667437298469263413,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,18029551619125844433,13783656308878093625,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,12269812929055770017,7617949661288371171,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,133396587372230465,12193107957618178466,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,133396587372230465,12193107957618178466,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,12096674540430633160,3378185748914551113,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,10610011761977453817,11671219124197224089,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,16448585719460653579,763575394026567025,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,402752850310977080,69631154082655180,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,17601703575710221596,14237581992151245294,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,11317084656139622831,496375832776018759,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,8369893986355154774,2636099911510351633,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,4332839763394102574,6881393415073778271,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:12
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1200,i,11129330936170137389,1992298334740200744,262144 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6568,i,9310100421354958530,10590284037702608253,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:6600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5352,i,14313430191314708583,10626064261193257665,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,3535886570240729594,6542682783255491433,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:6748
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6960
- - C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6960
    3⤵
    - Executes dropped EXE
    PID:3272
- - C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6960
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,3631539704696991327,119505238319054396,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,17870871757447670758,12756558262215695556,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7536,i,14049152897207549840,3566857746044678222,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6492,i,14317738277122221003,13574033804178653004,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:KfqyLwsGG6ecPtjfyQ045Ovgy6Lv22MgkVsMiDN5zFlPKNAVXTDq9PYlT2Is1KetAumLKw3tCEvD26TEuGodFFsEU0yO-j2WKL_yQ_concOnSWKMe5OUclP6GeYodaVh-0YQ2yM5w-e175E6sH0cgGxUzHiILiyigurZSHTMNa69wg1biNFwSpotA7vS4Cs9keWFp9L0w1M7pbsFVGPWgilcBEOlWJ8oHxVZ6-I1V0sBE2Sl3y8wz3CyK24JCC1DicQKA7688RCSqOEQSB_goUNt9D372-K3WX77yv6ZY037vkcS1RAt32RDITw5vTEv7mmFvrzYfDAoFaYm26Br2IEnYQqXBtbS_vvl85mZ56Sd0XzWWW2dl8dtQ0p746fzic-n6KPHUeBBwG3fGHCNaKdiWNo7nQ-T1EB4xpip0WyzPbhogxg84cipTasD1XlpCZaXhBy4KIDhK9lgul8l2QK-22RTovBOCDHUYT6yEGo78RURsmSiHnG7O8EDVvXD_f-9KTRpdW4PofVwtfJxy2rNC847KyrnDk_JRpb7aJHftYVdkarRxwYDnfMFvxBe+launchtime:1786329213383+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestFollowUser%26browserTrackerId%3D1786329000091004%26userId%3D66782689%26joinAttemptId%3D%26joinAttemptOrigin%3DJoinUser+browsertrackerid:1786329000091004+robloxLocale:en_us+gameLocale:en_us+channel:zdrsexperimentjuly22+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  PID:6356
- C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:KfqyLwsGG6ecPtjfyQ045Ovgy6Lv22MgkVsMiDN5zFlPKNAVXTDq9PYlT2Is1KetAumLKw3tCEvD26TEuGodFFsEU0yO-j2WKL_yQ_concOnSWKMe5OUclP6GeYodaVh-0YQ2yM5w-e175E6sH0cgGxUzHiILiyigurZSHTMNa69wg1biNFwSpotA7vS4Cs9keWFp9L0w1M7pbsFVGPWgilcBEOlWJ8oHxVZ6-I1V0sBE2Sl3y8wz3CyK24JCC1DicQKA7688RCSqOEQSB_goUNt9D372-K3WX77yv6ZY037vkcS1RAt32RDITw5vTEv7mmFvrzYfDAoFaYm26Br2IEnYQqXBtbS_vvl85mZ56Sd0XzWWW2dl8dtQ0p746fzic-n6KPHUeBBwG3fGHCNaKdiWNo7nQ-T1EB4xpip0WyzPbhogxg84cipTasD1XlpCZaXhBy4KIDhK9lgul8l2QK-22RTovBOCDHUYT6yEGo78RURsmSiHnG7O8EDVvXD_f-9KTRpdW4PofVwtfJxy2rNC847KyrnDk_JRpb7aJHftYVdkarRxwYDnfMFvxBe+launchtime:1786329213383+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestFollowUser%26browserTrackerId%3D1786329000091004%26userId%3D66782689%26joinAttemptId%3D%26joinAttemptOrigin%3DJoinUser+browsertrackerid:1786329000091004+robloxLocale:en_us+gameLocale:en_us+channel:zdrsexperimentjuly22+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:6364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5260,i,10253296519848874408,12120613254451649858,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=1096 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:AFFYqf8FVTy7EIj5LZJp7VXJyWmuUQF0NY7p5mnWZfw5UcGe06SVeAyb-PmxNRPj5Vdo1tvI2ZQetytepfXwz2pdH4tzu-FGzXEq44aGKiE6ATSfR_3mWqcnx6qaYsTGqh82ijdpV-XWtk_Ih5NJXAYiOaRaP_oa_VlNH3NCt-G4jaubdFPMY1eOZlMhyBpWGPR-u7m5HGZWP7Asoot6TdQf3DIsscjlf8QRHaYbiKihxzPmKdDtG5Z0vrUF4ThjhaQhtHrB12xzeAFJPL8xHLfOUVe3unc34HWa27Or4Mm12WqPEcuP0C1RnkbgdvHmU--PtfTfG5Ye-OE9yy3ry0X4zdHlb1DPgKwxDnFd1i90rXBDJ9c7x7TdQ1bJjzijN3aTTLL-mR_MKPVjC25qbxe-BF2MeauUf4DMrixArX-fbBdRHphKGD2oSlcWeWLXvS-gFrE1C4aFrzv8T1RonmTyG9a819vtPsxTkEgu-kAJ3HEPPrxTCta7z8GyfJ-gUHfWgU0dRzf4Z0jkPKCvZhjCZ-fiWT0u7L8UEe45e_ZBxSwViVftJqssWHzD8zfK+launchtime:1786329263988+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestFollowUser%26browserTrackerId%3D1786329000091004%26userId%3D66782689%26joinAttemptId%3D%26joinAttemptOrigin%3DJoinUser+browsertrackerid:1786329000091004+robloxLocale:en_us+gameLocale:en_us+channel:zdrsexperimentjuly22+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:AFFYqf8FVTy7EIj5LZJp7VXJyWmuUQF0NY7p5mnWZfw5UcGe06SVeAyb-PmxNRPj5Vdo1tvI2ZQetytepfXwz2pdH4tzu-FGzXEq44aGKiE6ATSfR_3mWqcnx6qaYsTGqh82ijdpV-XWtk_Ih5NJXAYiOaRaP_oa_VlNH3NCt-G4jaubdFPMY1eOZlMhyBpWGPR-u7m5HGZWP7Asoot6TdQf3DIsscjlf8QRHaYbiKihxzPmKdDtG5Z0vrUF4ThjhaQhtHrB12xzeAFJPL8xHLfOUVe3unc34HWa27Or4Mm12WqPEcuP0C1RnkbgdvHmU--PtfTfG5Ye-OE9yy3ry0X4zdHlb1DPgKwxDnFd1i90rXBDJ9c7x7TdQ1bJjzijN3aTTLL-mR_MKPVjC25qbxe-BF2MeauUf4DMrixArX-fbBdRHphKGD2oSlcWeWLXvS-gFrE1C4aFrzv8T1RonmTyG9a819vtPsxTkEgu-kAJ3HEPPrxTCta7z8GyfJ-gUHfWgU0dRzf4Z0jkPKCvZhjCZ-fiWT0u7L8UEe45e_ZBxSwViVftJqssWHzD8zfK+launchtime:1786329263988+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestFollowUser%26browserTrackerId%3D1786329000091004%26userId%3D66782689%26joinAttemptId%3D%26joinAttemptOrigin%3DJoinUser+browsertrackerid:1786329000091004+robloxLocale:en_us+gameLocale:en_us+channel:zdrsexperimentjuly22+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3384,i,14988397785211484800,14044710592033142153,2097152 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:7080
- C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:GqSYhjhsTMqPkQF0r24fmiVJmYoOxwCDKVP0ptqDlEQEO-0GBiXFuV6m3dEWC_sLBZMw2sf43v1Q788Mct4CbU5Kscuq5FR8BrYeelKYNh0Lf9dLtCbEhpSo3Fch0bdlbIc4dhPagqS1rt69rS5htoBazMtzMWFxr03KDfhZSId36Pmdh1sNhq3nU9m5JkVQ4UtYhzsDoyVMbmEx3gGHw8S41bmjJzOJfrtCPY1fwv-o25lC8JyDKguXa55eAJMt7LQ1X7aOYMYeip2-USiZ3EYcLILl91neQWtd9ifGZggbyS1BNtQJ0mheDtHnV6b8C-GFlgGfkP2UnUNm974kd70FnDZY0o8CR5VgYji2IxOMCIlCsCWfrkc8tr028QgSTs6qBZvDYizNkhQzqLaYJw3OPzNKNraFA8AcENClFpoOfehVuO4t15SJ0TbBj7Nn14qC2Slstk-ircp7CcXf0giZgnqd0-yLsn-_I8H3HEw4OeRNbYkeCLlT3_xgkogyy13qCIktXwS40d5oy4Ds_bfw-IHWlv_HNud1GyCezKNxMjP6khUmtMjkdGEvZPJE+launchtime:1786329278492+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestFollowUser%26browserTrackerId%3D1786329000091004%26userId%3D66782689%26joinAttemptId%3D%26joinAttemptOrigin%3DJoinUser+browsertrackerid:1786329000091004+robloxLocale:en_us+gameLocale:en_us+channel:zdrsexperimentjuly22+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  PID:7068
- C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:GqSYhjhsTMqPkQF0r24fmiVJmYoOxwCDKVP0ptqDlEQEO-0GBiXFuV6m3dEWC_sLBZMw2sf43v1Q788Mct4CbU5Kscuq5FR8BrYeelKYNh0Lf9dLtCbEhpSo3Fch0bdlbIc4dhPagqS1rt69rS5htoBazMtzMWFxr03KDfhZSId36Pmdh1sNhq3nU9m5JkVQ4UtYhzsDoyVMbmEx3gGHw8S41bmjJzOJfrtCPY1fwv-o25lC8JyDKguXa55eAJMt7LQ1X7aOYMYeip2-USiZ3EYcLILl91neQWtd9ifGZggbyS1BNtQJ0mheDtHnV6b8C-GFlgGfkP2UnUNm974kd70FnDZY0o8CR5VgYji2IxOMCIlCsCWfrkc8tr028QgSTs6qBZvDYizNkhQzqLaYJw3OPzNKNraFA8AcENClFpoOfehVuO4t15SJ0TbBj7Nn14qC2Slstk-ircp7CcXf0giZgnqd0-yLsn-_I8H3HEw4OeRNbYkeCLlT3_xgkogyy13qCIktXwS40d5oy4Ds_bfw-IHWlv_HNud1GyCezKNxMjP6khUmtMjkdGEvZPJE+launchtime:1786329278492+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestFollowUser%26browserTrackerId%3D1786329000091004%26userId%3D66782689%26joinAttemptId%3D%26joinAttemptOrigin%3DJoinUser+browsertrackerid:1786329000091004+robloxLocale:en_us+gameLocale:en_us+channel:zdrsexperimentjuly22+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,7921744303398098778,9250077217661272123,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:6356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,4981771870355917364,14804455340844973405,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:14
  2⤵
  PID:7152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,14847914101448533773,13430683595160648328,524288 --field-trial-handle=2584,i,3154287479731856504,3273170065407608880,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
  2⤵
  PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3936

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4292

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5884

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1548

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004C4
1⤵
PID:5800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4456

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2984

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5740

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4988

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7088

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:3472

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 eea5136d2e39678414ffacd6b0cd17d827b94ca5e09e9468a07da262ccbf226b
MD5 a5f81d2116ef82c09ef6390931e3e516
SHA1 41bf5bc16a0461378735c770328db29958f219d5
SHA512 ea06f9a9da51c5f9121a15fe82571cdbf88e49bd142719d3217436191f7d10c6c1c99b197f7a0150b1d0200a529f0db5bb82046d39f3f178a5ab4cea9cabf121
SSDEEP 196608:Zjj7ZtY620KULyMqDzi1msxtpEdDHTXom5KRZck3T:ZDZKli1msxtGFzXom5p8T
TLSH
T1B3A6BF22B900C032E8D100B2A6BD6FF6993D99341B7954E3A7D45DBD5A305D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.dll
Size 22.1MB
SHA256 6ee5053665a3d722337d0e14becbb614b603b19d952538e3eb9ba6b76cef2ee8
MD5 c7adc2b645f3f538434e149310b2255a
SHA1 5a6ef8f384f6eff5898d72a4c9792819490bfcab
SHA512 80038b6c6f0053844c55ef1d9d0be82ad2c0c8769b3805b69d2a6203cc42c69cfd56ff96ef38372fe06c40fb7de6ceca1124e4e46dc935f38ac8f3cb3c5621a0
SSDEEP 98304:HAISODF7F+aFnWEFuqZ58PHs5bHHVwpWYKUTECZZD5j4Bbf9yW0AAYYqddfeg5Vl:Bxe5qjJPYvH/FabgalDOSBVjDrNhIHHe
TLSH
T15C37BFCFE8D70AA4CAA19070E15F67E3EB62714C5A582DF346A50120363376E265DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3a46b843d37fe8bdf4f43f0b755fb39b81b9bc5d5417dbafc89196422f9b6e50
MD5 58bd86b6438796a042588cfaa881096e
SHA1 4bc499aafa0d1d1d1a5e9e79a506278c3f69287d
SHA512 5b9c8059c9ae368b21bcef6c6a7e55c1edb23f87b86a98b94871650c83fd4ebd23187f825a6d0b68414c598e2c0e4736710564da28594378207342e63f158ff2
TLSH
T14FE086DC05D9C3AEE61D758791789B4CD6E03A4EABC8E94A2B0484947341584B7E2BB8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 59aa1785567c045380e4da94cbebd466cef215d3c0029748b2061b9e2dbf916e
MD5 c3073c9caf4b86c750639ff25dddf590
SHA1 cae8458e7835ba475c583d26a0cbdd52b48edf9b
SHA512 7bf2fb6bc18ed2a3b2c0430ede122c3644eaec304253899ae688371dc189dadc067cc54b64be9af26e5bdb28268d7b6bd3b4e3cffafaf08a79e73b7bdf4abd07
TLSH
T103E04FD845C9C3AEA60CA7679278474CC6E0360EABC8ED4A27088888B642544E2D2BB0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 19KB
SHA256 b93897b55cf7673af38d1ce4c6748cb2fbdda42d6677b8ff699be5f901f2a464
MD5 1f9aa04776c05b74c3bed39246fada18
SHA1 4d9c2f4e6c04590bff01f82f0580dba8987536b9
SHA512 b6f701fe75d826f72b115053a606ca4d44d5e8e72931a272e88c9a9c0d3c15ab7b32bad0decbd25711c7aca234cff4aaf5b4569f7990d34696d8d47b68d9928b
SSDEEP 384:fahXnQcwrmf3aDVvdzI2BGkjYO+pZGkTRo51BGeEWKbcDUWG:fhdrmf36ZBBYPp/lolGeEWs8G
TLSH
T1F292D1FD9E618C0DAAF7903F553208CA949043B77C803624FBE81D0EB692B1E967179D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 30KB
SHA256 b559f683a2baad2f7f391038d4cf860c63fcabe9b3256aadc67c8f6e69008e89
MD5 7c59be9e85a9d3ce11e7a935c3d4c825
SHA1 403fc943b9e3334aa5265a65276505b3b922f7e0
SHA512 da90a93c10d4f6bd86672f48e03fd00ddaf41e5d6c62cca4e6b2c2350fe038d15e83db59d4cbac435616b84d424b9a95db6da47d621fb2151a4929d1051fb3c7
SSDEEP 768:ll+uhLxYKKqSGRDQOWORhRrO42BryTDsUqLVa:l0uhTRTRr7izVa
TLSH
T10BD2F1C98FE438C4C28D2175C3943ADA35AAB5D2948B9465528F5F6D37C6FB3E386204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 27KB
SHA256 4d7eed3aa84206a899b462522c82a0328d844ce5c1b2fe02f43ae9fd28fad875
MD5 3adcd14c900fe9c77c3d449adc1ae072
SHA1 8910c0b06c027809ff126d9c5b992aafbad7a8f5
SHA512 c6e3b89d2ae8b0820113c3e67255a644aee19af820e3344d6c8e3f8e0da36557cde1085b51dcb7b8bb98ee3c269aef385e80f2f1e94002b526c392e634196306
SSDEEP 768:qdtpEyXAmnI7VbPirP5O0V6Dd8E4BxSU+:qdtpEywcIhziT5O0gD+jbI
TLSH
T157C2F1924A8B39E3614E02617F4605721941AE6BDB00EECF077EE33C34EA8577C168E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049
Size 104KB
SHA256 495e17ceb16db5cfaa2a74b9d7c2b719bfaa50a92f38512bbb29ee62295a8586
MD5 58c8135e9e1779350abd69e907c3b964
SHA1 2cafd043661fae52241304559cd6d3ab68f14bf7
SHA512 0eaef2d731a69a317ef8f68f140b1b2ec6d04714598e81952938b16ae69b37e57f0c77dedaf89586a0acbee363ff03e91ceb51c46fd8e474b37e78b5c51aec4d
SSDEEP 1536:Nozd7HYd9e8g7cMFG8riSvLGDAvi63aeLHu5yvsj2/cUxRbincRpU53T3:o7HYdi7vGe3GkVDTLUEpU53T3
TLSH
T100A3126475E5C324E3EDC303B4B16C321C5B100FD9B394A1A99A0EF5E92A7F5308DB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00013a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00013a
Size 43KB
SHA256 cb6620443b6016b487f50a7b1cabcf083692e5b2f86586b627cab17382ea851d
MD5 68697070c3f7ac51bf2d254c0912e6ac
SHA1 84484540f493ca1c7eb15002a07b97beae030598
SHA512 c9940ff8c9255583e2d8f849d7d545051959d061c6fb7135e38bd67ea7be54b4ba4c8368cb1251d718bb91e2b0d89633011ecff1a4262ddf04237c652f75c3a7
SSDEEP 768:e/kfI1psSCLRdOEYLoO1C75H5H5coYGWGZx0zpkOKVAConfh/GmXGw6K:+SSWRdl8oX9ZZckcConfh/ZGjK
TLSH
T178135275C56C92799A51F7FC5F727263A19EA0CBDB230547B2E8C1B013A3E67FA14800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00014e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00014e
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 0044c697bd8b540c09631bf75ada7bfaaacd110ea7d8cd4416ba6c23432e9fec
MD5 52f0a08ad0b7ba60198634fa001d9ab7
SHA1 da243ac37a2dfbb5b36561c6d0141f5207a8d7f6
SHA512 71591f7f3bc5dc6a63f6ffe105dbd4d4329037ad1dd7f07fc4060972c394e3eb34960a284df92b009ef47f2a563bb3532912b1444dcca0ee9ed317a75ea48625
SSDEEP 192:OCb53A549IFKYghDyUhBqlsGA1+cLPeykf:OCb53AC9/YSuIBqlsZPL9kf
TLSH
T17002BEE562EFC9C1EF4304FB30A1DEF57A24A94B469F1B6761B5EC742413798A08D388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 f4fc17d481847e9bda4cfdaaf93f73d77335394d384588f69275571c6e27ee78
MD5 52b080208c25a5e5a275288ffaaf4401
SHA1 8afd0f34c6bab47e5455dc039a76aa009b66ea1e
SHA512 51fdda884995eec2caebe72d215da57b2b214d45890c32dbcdda24cc79999ea2d2a83da003fe4ebf8a178f844204c4082a03359eec7f89c5550fddf69be473f4
SSDEEP 96:VgFiR1UIP2rS5+KXw6yLgCHlkDJ6r+uM1RKo:Vgha/5+KHyUNVlz
TLSH
T103D167E5A2EFC9C2EF5344FB30A1DAF47A344946468E2B2671B6DC742453798A08D38C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 afe8cf4ee2d7f34a0f9342f96ee4144853816565fa683532abeff365797846a9
MD5 73fcdcaaba4ab9b513d57011bfa554de
SHA1 c9ce54a689d99071e900b2b1b356be7c3c3ea340
SHA512 4de46eb3f377f510ae2bd537ff7d85eb1f15be4b6ce50ef4fbbddb4d1b648e8eb3556c16b1ab06c903f6141489da8de4b6372f6da4feb5dab6276b4b02208210
SSDEEP 192:eCb53p549mFKYghDyUhBqlsXA1+cLPeykh:eCb53pC9lYSuIBqlswPL9kh
TLSH
T14A02BDE562EFC9C1EF4304FB30A1DEF57A24A94B469F1B6761B5EC742413798A08D388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 25cb6a9facbef592302cc628c936daa4ef0a49ad2f48ac29f499ebbfeb4231c6
MD5 ee33a3859be34601f03ffbaa6b90403d
SHA1 e3db8e7a08f35fe14a63338af5cc561691d23f1d
SHA512 9458036ed8d069f5267f1b0a795c09542f9e8fc745de8ee954b3b4f74182c93d7293a7d49cac79e515b61ef87e6d31a8b4bec4783590d636427ff8234e724294
SSDEEP 96:nOciR1UIP2rS5+KXwlyLgZHJkDJ6r+uM1Zx:nOUa/5+KYyUOVlH
TLSH
T12CD177E5A2EFC9C2EF5344FB30A1DAF47A344946468E2B2671B6DC746453798A08D388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59b3c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b3c6.TMP
Size 2KB
SHA256 484b83954a6af58e4c0f2060b44e4b8b2414c41ffd10daa68db4bab82cb2a45c
MD5 7bb8c4dfd351015de6bc6fb498cc133e
SHA1 0665f8c4aae7af29a81789425fca61d8743996bb
SHA512 aad039cdaa3735db146109401ffb01b7794a914948019fe6db2899da90a104d7058a9aab3be0f7256558b055ee635035e3ed83affb0e249e28e0d3d0906508fa
TLSH
T13B5121F7E3EFCAD1CF5544BF64E2E5D43238895A47036AB1827650B8697271CA0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000003.log
Size 162KB
SHA256 b2da47f0cd16ff8c69ea5bd4db08b35c4dedf03a64d82af68632d74034d9b2bf
MD5 f8a9d538e1478a6fe8eabc050e39f460
SHA1 641b2befd38a6b2f9ad2b07837dc65f4a1bf9894
SHA512 89d5de53b08eb6a9a55d012293a951dd0a813451201dadfa4048ed755329aae4568e64abfa11e04c95add2dd22ccc837db9c98f391aefafe8c28fd95852473cc
SSDEEP 3072:Z7khJ75F7i7sl7e7fB7w7lf7x7oP777WJ7o7h97E7Ul7y7Hh7i7CZ7W7tl7K7Qdr:Z7w7b7i7i7e7p7w7x7x7k777Q7o777E2
TLSH
T11DF38C8667D1C925C2B40CBFC8701BDB4B8FBBD47CD3521F95D072A9F9320868E9A612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 515B
SHA256 6b6cd572cade3de3df5f76e81f394e922865bb96003d18b22db182b0731ce571
MD5 5843a8729589be41eda256aca7ff7927
SHA1 221b95bd857569a773238c1431af1027070e44b0
SHA512 9d2cc987a201a824290a476f877969f25ae003f78ccd48ac80cf3b83724c356e8c60ac4c15cf0d8c6261badef3a67ecf61eadd56592302f4db28152ccf7e0ac4
TLSH
T12EF08BAD8588C15A6288A0B3DA3C3B0DD999651EEB8CEF415F41E941A381149A4EA0B2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 6599c8b47b6423afffc828c760cc6096cde910df5b3da570e8869e27326d857e
MD5 b0cb23b84c7259392aee4beaa8c6c09c
SHA1 39fd583b3c7d3a574f76cfb249ab5d27888053c6
SHA512 999b0cab34a0631d9fc2193d875a56a3778527e0262df2d0c33bb76aa174879b97cfd2341e5c06245a98499229f8ff303bfbaed97ab45a1b921660055a94078d
SSDEEP 192:DWWIu+SAVaZai1qj9XuPQTJBQUhUa5VuMHjuGHxAPLLZ9ON1tdWnpHEeP6Ntzf+p:DWnbSAVaZai1qj9XuPmJBQUhUa5VuMHO
TLSH
T199022BF75371C96DAB1696F0DA09AD1B8F980530075C74B6C6E07E2393B36A1F101BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4c488dc22db23316ceb59743c344518bafaa85aa2e3ee06dba7e5cc84654ea1c
MD5 adff22ea350b7fae6f92b57f703d20cd
SHA1 27f93007cdd10c2d346dcb49f37e976d5b9137f0
SHA512 5bc951389040b9e3084b62837749c66324a81759561718726eec4a89684e0ebdf7dba3d5d6012860663a924682aad60ef8795330a34fdbb2eae54ed0957d15c4
TLSH
T1F521B1F7C3F8597E8A4182F867142E1BCE2D0815431C7E5BC4D46F5BA3E2871D28095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d6822149d06d89f2ac539f266f94a2f6633cce90300716a7adb56d7a2e3d943e
MD5 12a030e24f2f8223bdd4bdcc1e892f0b
SHA1 7ca0044492e52afdba946da0e727484fd8d7bb84
SHA512 f30a4047c82e2d1783ce0b3e18e1050895a251caf5c5a8cfaa90c92c872ed6cad0eea7f050585ba4dd60acda3f2b7419cf84b5bebf64744b0d10d61a942d161b
SSDEEP 96:DAOKIYCWVaZaXzsbGqXwBjhHj9uGLQTJHxAxB8HS:DbKIYCWVaZaXgGqXkjhHj9uGLQTJHxAb
TLSH
T187916BF343B5C66D9A1696F0AA08AE1BCF5D0520471C7876C5E0BE2793F35B2E101B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 27894558ecb598aa4268bd16aa3615ffc0a7aa24795c144c8c69e5d667cd13c7
MD5 b5178694e204f807f69819bdfb8700f3
SHA1 4cebcd5c0b8f69f00afdb1fad25518a7454ba8c1
SHA512 ac702262a3d07b5fbb6dcdbf4d479e99ce7885172af9a71a100da40a99f9fb4f73af0cf44b494baae2369da665476d615abde46bb24c82dab7fc39bfd6fa9bbb
TLSH
T1EC21B1F7C3F8597E8A4182F867142E1BCE2D0815431C7E5BC4D46F5BA3E2871D28095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 cf988264af3ddf6e2c282df4b7229b2e0439e21ba3074ca1ce1a8f1f0e7b5ff6
MD5 7fbc605e66ad2a0c4b54d97808fb72cb
SHA1 800c8e68a0439552634ba001b8ed295f0771b434
SHA512 85edefc19263e26c4010ca10babf2370cd1bf43fa09a745e39867e58af6ab05ebac699491498ee6b5e8fb679f274fe4609d1dd99914c184a47906e648e02ead7
SSDEEP 192:DbKIYC+KVaZaX1qj9XuCQTJBQUhUa5V+/GMHjuhvHxAPLLZ9ON1tdWnpHEeP6NtL:DbDYHKVaZaX1qj9XuCmJBQUhUa5V+/GR
TLSH
T117026DF753B1C96DAB1696F0DA09AD1B8F580530071C74B6C6E07E2793B36A1F201B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7a1f32c0840326e29b36b0db5e513e4370406ec12341b4293ef650d840c31c2a
MD5 a522036a68f9ee2f0b1b912ce7ba74f2
SHA1 40b1c76c92f7b82ac6891391b44ac6f8f26bd5e4
SHA512 fa9873672a6a93664f7ba409d3992eb65e62263546b5b3d42933f8b3349aed9347737cd64b6820e270968d2ab434bcdcda7b3ca1d2d8b76428a830ec2fdfe3b0
SSDEEP 192:sxRDuRzbq/fpsAjG/m/zoA8pxo/g6+WN028/YZ7lqxBKGAIgDFXJ:sxRDuVq/fpsAiOWm/5a/XOJ5
TLSH
T10342A5156928A93B9CCBD20DFA55BB53E2FD1033A1D41E58AAFC9A1C04E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2fd29cdeb0a5eb30b7891d7e5defdc36b8a8c87011b841bdf1fd722c25316a62
MD5 8e72da3a56af1ebc19b1c261bd9556ca
SHA1 e3f3f57bdb70cccb8216d89d8f206699665e668e
SHA512 574a4e967b17c3eeadc72bea56c3a48c4e2221f8194cfe4cdc3fc516adf5d895dc33291f293298f44fb32a310e0e3c0fdedfeebac04caa4e7e90502ec562c77c
SSDEEP 192:sxRDuRQOq/fpsAjI/C/zoA8pxs/g6+WN0/EdYZ7cl/BKGAIgDFpJ:sxRDuNq/fpsAEKWu/5/drOJT
TLSH
T10C42B5156928A93B9CCBD20DFA55BF53E2FD1032A1D01E58ABFC9A1C04E7ADD220751F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1b0d44ff440003b67ad6dc24fd4479d9aa59c737a18c5b22e3f2fa2e3cfa287a
MD5 a8bfd524451bd142c3516588e0a961d9
SHA1 d7e813d96f8157156e522552442905dd3725a16c
SHA512 ae3a1cd153cea6e9455b2ea6474242271334357192aa62571025131619a3d452f51b5aa46f32697d081033c93fe232498992c44399c8984ae375fdda04847f14
SSDEEP 192:sxRDBRzbq/fpsYjG/m/zoA8pxo/g6+WN028/YZ7lq7BKGAIgIJ:sxRDBVq/fpsYiOWm/5a/ROs
TLSH
T12C42B5156A28A93B9CCBD20DFA55BF53E2FD5033A1D41E58AAFC961C04E7ACD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d3532b57789196e4af0847e72af284a9930cc07c76ea031c1636937d6e472ff
MD5 be790ff5fe42fb755729bdceb96684f7
SHA1 ba51e097a1086342c4b379808644f258381b036d
SHA512 57dd74f6758c880e157c5477309d05058295859d2ee42e9f3bb1c1ad298b449404f1c8d4c9f7b501c3c9a4ecc7e0b4e27fa3a9b8d3aaa6995d9d4f34344368ba
SSDEEP 192:sxRDuRzOq/fpsAjI/C/zoA8pxs/g6+WN0BlXYZ76l/BKGAIgDFpJ:sxRDuYq/fpsAEKWu/5cXBOJT
TLSH
T15442C6156928A93B9CCBD20DFA55BF53E2FD5033A1D01E58AAFC9A1C04E7ADD220351F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 3f954a8611cb80b9321042d1ceb62f4550087b97f1385939cd078995d63aac5c
MD5 bf3e634dd7a691b05a936d8807f24ebb
SHA1 3f6967594af616a20c1df76302d91a3e96c031da
SHA512 4dcee56963422f68ac5620890a87d5ddd8d7977884a3f2ac3b075e0393e4f7b078982b6e93f4a7d8212f6bf55bfd00a8ec792b0e788950afa040da6b6ca3dea4
SSDEEP 384:sxRD4FNq/fpsAF66sjqMpRiYnazAW8pZS15posJWeT+GhWz/5rdoOJT:sANq/fPF4nnc7WeT+Gm/5Ro6T
TLSH
T1B5C219059924C83B9EC35D1DA93D7E33E6EC106222C5DEDE5AECCA1C019E1F9AB07467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 df4effc3190a020f869678c7633e73928a1ab4ca599c1fe3c0d5daac6036ee5f
MD5 ae31ac7bb8a4e4d1242502c2d309031c
SHA1 33fcea572d2331a9528b534115193d9e6e783174
SHA512 df6ead4d1a8bb7d334e2c399da2f07462067d5d6f98d272f99c069e733d1ee24b507f7adb6b45908c42d1ec226ccbbafeb58134a4524fb477077de83c36eb598
SSDEEP 192:sxRD4FRQOq/fpsAjI/c/zoA8pDk/g6+WN0LgFYZ7wl/4KGAIgDFpJ:sxRD4FNq/fpsAEkW4/5PFuOJT
TLSH
T1D542C6156938A93B9CCBD20DFA55BF52E2FD1033A1D01E58BAFC9A1C04E7ADD220351B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 83f647a0b7f5cdf9198dacf2578aaa01192cc49cad470037120c9c619f69b40a
MD5 cbcc369f37918b8b1668b97822574fee
SHA1 500518e9a50b6ccb4f18a658ca1e794e80d4565f
SHA512 edf088fe82b86d9fcaa0436c6d373729896f999d60274c20b5d7e4b760d40d57166eed6c30723cc4e1cc7976bcf1b41c1efc9f1c983944be115cefeffdc98358
SSDEEP 384:kyr2SGXfCtgdDFf7bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6iroOSA:ky2SGvWgd5f7b8F1+UoAYDCx9Tuqh0Vc
TLSH
T106B2DA2B604DCB7F9FC01A9DAC196FD66D9802C797588D4047FED90C03C77EA922A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cd64fa43-726c-41ea-b8f4-855c4b50cdd9\index-dir\the-real-index
Size 72B
SHA256 bbf8a5546f784d05c069b9c8bf3b8d8adf045469e7bec6031f780e3ef588cb1a
MD5 582527066b7fc12ac5978494b525c3a7
SHA1 fefb697887c271209ab599b5217ca89cd2fb242f
SHA512 939d01e4ac694efb516d13744e81ebebb1a22c1e85de3a130d4d980721d6d9ba62f08dddc657d4dec3107799362995fe2b3d247f7efbb9c7523efda4e37851aa
TLSH
T1F3A0025116DE28EBDE42117451E3658862134C580C54870350FC119D89A2045D2C6001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d856f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cd64fa43-726c-41ea-b8f4-855c4b50cdd9\index-dir\the-real-index~RFe5d856f.TMP
Size 72B
SHA256 4176c87220ceb6bf996bbb2562e22801f41292115316fbcd96199e997584abf8
MD5 03d3cc01f13385beb343dc22b2bcb481
SHA1 2c9378d9b1fa0eb4ba61110db8569c15f9cb73fb
SHA512 47ec3437684b85d42dfd744c5b9b3a5eecd04deebfa8ac96330229b77486194685a7470aafab5e3624a59a9e2d4575b7713b64b8a52f7e89a0c88c9315e4f6c5
TLSH
T144A0025213CE2CD8CD0251B46003C78C32838C181054C70B60F4559D8DA205559C610A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 2ba478add7a3d28ca3cb039c9b6d45c2bc38f960292bd7c5a563332a959d4f58
MD5 8fe01e73f829efc5031f29c108dcb0eb
SHA1 d089ff4efbab2c621320966fa58630c2e97c7e4a
SHA512 a6bd4c37ea7072f3315b999d12c105ed5e7aa758905c6c3fef873b009d38858a17e7bab470763e20c3b2467d484e4f871bc1a4a914e840c54079b70b67f545e7
TLSH
T17FE0C0BB7DDB1C24F96FC3F7743194700103BD54854DEC0F602A918754B2314202BC25
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 87e157736e53ddaf750a61e6d7ea0fad20aa91485b656edaece694d09de841f9
MD5 9f227ff313039c564bc924000dd50168
SHA1 ea9e79bf9a55391a52611e6ede9352028916f4d5
SHA512 2ba66d3fce54be9490ea6f64d4b926f66055bcf8f776b53a6eeb720f7fef41a5b728ad37178bc66b6e89ba7ac4fc22c761b5e2a6e37dd0d249bd91269ca878e1
SSDEEP 48:Kj2PKmgsIkYshPIhukKiBqokeG0fBgG5yJUIDKticmlIdKuY4fyu:KIB2KysCqUgKti7l2KuYyp
TLSH
T17F917152747E56003CBE2A0C9565C63ADA82B1B3305AA46B7BED00B51F6FF019DFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f3c448d8-7686-4e41-9838-564cae1ad503.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f3c448d8-7686-4e41-9838-564cae1ad503.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 349147a86f031571adfb765d105f495f338bed504aa9a42355e48bc5734daacd
MD5 af32c4c45756b1fc3fc364b27a7e6459
SHA1 a4ebfc8a73f7e9316dd6fd4d08ba253b3cf80341
SHA512 837f39a1f67a75bab7a361be1785889a347226b9eb290720c500a9483cc2301a320a5ee85014802b0e8311baf1e8ace4a8844c72d529af3e6b814bb83d42a5d8
SSDEEP 768:urv+4UNbdM3xiqi8Aam6aQMGdjWca4Ghf9NgV:ubsbS3MumaME6pNc
TLSH
T14DF2BE31A8B8D9779CB79695F21B3643BEB451A385C80E90D9D92B1D03DB4CE230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 76f4c50fa1db8dfd39e9c4deb4bfdd875785afec1f7cc92a0afefa7b05f069c9
MD5 acdc29b0ebd22faa7dd651547fc51833
SHA1 a4e5dcef0f1b6b7a533d59bea36d19349c77c11a
SHA512 ddded5718d6dcdf562c52afde4f974df956b0b99ba9830ffb1132e8e90833fa65276659406ebb00e7533950f91f4ee55edd444191e18ec7126ef09880d1e5430
SSDEEP 768:vrv+4UNbdq3aUqi0Aam6aQMGdjWca4GhfwNPeU/:vbsbc3/WmaME6pKH
TLSH
T113F2AE31A8A899779CB79695F21B3643BEB411A385C80E90D9DD2A1D43DB4CE330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 809d36208e451d371e89227f9dca64c0cced227d1703f34cd3f1fe212540ab64
MD5 e0919ec823aee62c78c71cce289573b7
SHA1 19e35b9b4dc379c74b810f65a0f7efa070672a0c
SHA512 cadfaddac475738f484ac5cc031de885989dad449b3fd749fc6dd817e435d67bcc7ac2d524f59bf441799962986fcc284f27fb6e2a05aacbcb2335434d4f51bb
SSDEEP 384:4ZcIf38NEh4mivXy44d+dfYbqXF5WmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9Ni8Ld:Gf3viqi8Aam6aQMGdjWca4Ghf9N8u
TLSH
T11FE2AE3198B498779CABD695F62A3643BEF4416385C84E80D5ED6B1E03DB58E2307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fad16a4f21f27f6e1846f189f4d410b5d1c6d5bb5dafafd16c364963affe6c32
MD5 11683c7057af558c5e05fa3af1c72bbc
SHA1 9360dd8e6bb61715fc842a17a9be34c25b57afa4
SHA512 a89d1646189ddcac0c9ecb49633c812d4d8cdf781e5a6acef94b9bcd82a0ec2be0dbac1ab065f05a3ff847e8996d36d4f87d9c5eee6a9df3ded433e4265830e7
SSDEEP 768:/rv+4UNbdq3AJq+AAam6aQMGdjWca4GhfBkPeU/:/bsbc3mKmaME6pcH
TLSH
T127F2BE31A87C9973DDB79A99F21B6747BEF421A384D40E80D9D92B0D439748E330792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2293ce5ae4aea13881e9882af0f76398319677f99540cc95ff3cfc73ecbdeefe
MD5 1003fcf892e48a7c561f18b9f4f0d844
SHA1 21b9068c9249c72ba4e00073de0b59f9f90a2c17
SHA512 612045c9a9d01ad08fff72eaa5e4e78290311fe4e61d78e64fde16cf3d866ca8f933ced2c5499710def2a4b744de4e90a73fdd006bb23175ff10cd769f9e2ff3
SSDEEP 384:ZZcIf38NEh4mivSy44d+dfYbqXFIWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9Ni8Ld:xf3Wiqi9Aam6aQMGdjWca4Ghf9N8u
TLSH
T135E2AE3198B498779CABD295F62A3643BEF4416385C84E40D5ED6B1E02D758E2307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b96f90903642a8df22f564a8e1ab933a21cd8143eed5a4eb878a4dacab75bd8f
MD5 8a692649f706b25559811f58cecb1d5b
SHA1 4388509b956fb43a9e28a16f33f733fd7cb46198
SHA512 bae829749ee8d433061d510c47d5c8c70a72e1ed143b109a64386998de74db454281a02c683311638ebbdbdd965cea58018c825d8fac6c4916120b40cd24acaa
SSDEEP 384:IZcI338NEw4mivSy44d+dfYbqXFIWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9Ni8Ld:233Liqi9Aam6aQMGdjWca4Ghf9N8u
TLSH
T16CE2AE3198B498779CABE295F62A3643FEF4416385CC4E40D5ED6B1E02D758E2307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1e2c96154f17572e4f3539a0e9091bff993c59d90a35fc4af5f21f2f2d654d85
MD5 e6ce6554e0429e48bf34cd37483d3a38
SHA1 44987dd414fbbc479874f5d5e1084faab6b1247c
SHA512 4c7dcce87608640dfd07e55106c376329afe1c6b45d3325fb5a2d67a3ab256984e69069fd90d95c040caf2946bc1d6adda0c09969341d92fd569389e2366b6bf
SSDEEP 768:cFA339wgNiqHAam6aQMGdjWca4Ghf9N8u:133PmaME6pNT
TLSH
T13B0339F148E78477DCAE9787A73E2D02ADBCC163B4885940B7D9590DCE960BFD20781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 149291ad599865404c7c4741ee17d0fd1ada4564ee12a4fcb0afa229666c2d77
MD5 c0393276bf608acdddd32f38d8f2d5e2
SHA1 609d15e3972e6f7557e5bc522976a931d70a5116
SHA512 36063967d4663e36b59394f4d04926bd7fddcaeebc2929535306259bf27b3d962fcf0babb1aa0688ee426de72b887c6ce07a050064326e67842e06ab02745faf
SSDEEP 768:cFHD3vwgCiqaAam6aQMGdjWca4Ghf9N8u:ED3JmaME6pNT
TLSH
T1F40338F148E78477DCAE9783A73E2D02ADBCC163B4885940B7D9690DCE960BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 19d033d9842b8a546c31d404e7127a9b57d1b3d97c60516e647add1ce157f299
MD5 744d9271e8a0a0e940e018d2f1ff4f51
SHA1 9cc9d31dd48dceae24754ff155d7b0ff232be266
SHA512 5bc131effb78f9a4ed1b60b45bb4bcbf59ffe3d683a190ae0a3935a9a70be3b509a44a72574a74dc5eb17823d7e9c3664b556c9d4aa0c828dbf37e3c6a25827a
SSDEEP 768:cFCs39wgGiqcAam6aQMGdjWca4Ghf9N8u:Ts3tmaME6pNT
TLSH
T1EC0339F148E78477DCAE9787A73E2D02ADBCC163B4885940B7D9590DCE960BFD20781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0bffaf09a6063678756b7b6f7856a1a88e15c77331cc2c62a7050880977c34ad
MD5 6c895df2c5ef10fd84eca35b0a0b18ed
SHA1 ef2d57d0672a43ab31a1952905fdc3413ce46ce7
SHA512 75f4fe43fb39b566192cc29c9711ea190230e696c415b7515be5f7e2d77840f0a5397460de552073b642154ff91d081f5ac5d0833bee69d4aaceee52e8edd4c8
TLSH
T1C7E00203935040FEC034033000832F302EE3947003B303094F71496C1C317143F20AD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fe9b94149a0b91e3fee50155d26b459d033af93fce6c8cc883121214caf0332a
MD5 f498ff8cd405d1ff64ab463964052aa9
SHA1 e350e6d6d291a39122db6aeb99f80e8970f92d17
SHA512 af7b50c6356214210baec099f00fb3ac64ca2dbdb1c356951888959cada6c4e5df42123c0cd2bb67f7351e0c515d86a98c792003bfe5c88bff2ab8164c6c4b58
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 485d68b381f6ad80ef28efbdfdb7e58e01efc88327c80aa58ebdeaa31c852ec9
MD5 3bb26caa8af0ec3d0104664a9dbc8def
SHA1 bbde310cb95815d3847b231b70ab72efc8c848c3
SHA512 e1631d594f6aef1e7ffd82f3169fd3c4881b98cd94cc022272714af2c9215ba9721b06cb80ce8a90e3e75a8850080b80e1a2c0523b41f4409e349cb2c8ebbcb4
TLSH
T1CDE00103D75040AAC024073000832B302FE3947003B2030A4E6149682C227542E20A90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 37a4d2f6f8936d3f9f4b468210186b2b6ed36a5607e76f18085a11a59ed087d5
MD5 72030f1db1e1cb028e6ac640893dcef3
SHA1 49f786509ad2245069c5ae2045b2730012b9737e
SHA512 4b448ffec10b640b44adea5bb975c8d666847a23fb00d900b6bea4f83cc19e9ddc597ecf40c5577a41e77b6448e2b1728a846670345a437534eef19933c339d8
TLSH
T169E00103D76040BFC0340B3100832B702FE7987003B2070B4E6159682C227542F22B90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59f11d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59f11d.TMP
Size 392B
SHA256 e5b1b6b97e12a49e637e3efd9d9b38b732fbcbe745ff8760227ed92e44f8a071
MD5 3ad3b7ed92fc5e939e955363c0751ddc
SHA1 1f623c0df64bece563e143ee45b6856fa3276b81
SHA512 80d93b3464cd554a6f1b968adc77059c3dab9deac40a5b76b328d27ce8dbcef5e6b9772eebb342c94504c46bb64c4c5b3fcb2be6e4834a0cf3125cb2f753848e
MD5 SHA1 SHA512

Submit Download

6204de35-9397-435f-b964-11d6a8954cec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6204de35-9397-435f-b964-11d6a8954cec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 13.0MB
SHA256 d527cd3c5d7506571d5d6902cbf90015f05574a57d611b616052877957bcd659
MD5 d444176101c29a0b4a4edaee7215443a
SHA1 da4a9447fda68deaf9b4c57d2978d894804e2b0b
SHA512 185dbe780fe982009920c8a4050ca8f8ecbe1a87d1221dc8cd3df43c74e86436e7deee59c976ebbebd616656c2e5904aa3a9685d4241b4cf191a3b46f61edaad
SSDEEP 196608:MYBPWIdJg1wdZ/mwSSh48J3b8U16O5uJtmBd:NJXTg1smwS848Vb8BJABd
TLSH
T1F3D69D5AB2B800E8D4BBD178CA565617EBB1B41603709BDF17A046E61F63BE02F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download