hxxps://uploadnow[.]io/f/94YL0zl

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://uploadnow.io/f/94YL0zl
Sample260810-ref23aar2x

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
233	3244	msedge.exe
305	3244	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
3428	RobloxPlayerInstaller.exe
5140	RobloxPlayerBeta.exe
3400	7z2602-x64.exe
5768	7z2602-x64.exe
5408	7zFM.exe
4576	UI.exe

Loads dropped DLL 3 IoCs

pid	Process
5140	RobloxPlayerBeta.exe
3180	Process not Found
5408	7zFM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5972	tasklist.exe
5836	tasklist.exe
6028	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
5140	RobloxPlayerBeta.exe
5140	RobloxPlayerBeta.exe
5140	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\Cursors\KeyboardMouse\ArrowCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\Slider\Right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\Slider\SelectedBarRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\PlayerList\Report.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VirtualCursor\cursorHover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\SpeakerNew\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\ExternalSite\guilded_white.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\graphic\Auth\reversevignette.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\icons\ic-more-about.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChatV2\actions_editing_compose.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioSharedUI\spawn_withbg_24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Vehicle\SpeedBarEmpty.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\places\VRFTUX.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_2.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2602-x64.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\sounds\action_footsteps_plastic.mp3	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\whiteCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\graphic\gr-add.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxCrashHandler.exe	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\avatar\defaultDynamicHead.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioCameraUI\iconFPS.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\InspectMenu\gr-item-selector-triangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick1Horizontal.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2602-x64.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\IBeamCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\PathEditor\Tangent_Handle_Hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\icons\ic-group.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VR\notifications.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2602-x64.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Chat\ChatFlip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\MenuBar\arrow_down.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\MenuBar\icon_leave_highlighted.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\9-slice\search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\avatar\unification\humanoidAnimateR6WithFace.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\PlatformContent\pc\textures\plastic\normal.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\PlatformContent\pc\textures\water\normal_21.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\graphic\player-tile-background-light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\configs\DateTimeLocaleConfigs\en-us.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioSharedUI\list.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\Controls\DesignSystem\DpadLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\common\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\PlayerList\FollowingIcon.png	RobloxPlayerInstaller.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2602-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3244	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308443830118311"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-d584fb6c717a43d9"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-b2d03e4efaa04174"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-d584fb6c717a43d9"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Cosmic.7z:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2602-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3428	RobloxPlayerInstaller.exe
3428	RobloxPlayerInstaller.exe
5140	RobloxPlayerBeta.exe
5044	msedge.exe
5044	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5428	OpenWith.exe
5408	7zFM.exe
3304	msinfo32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
5728	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	5408	7zFM.exe
Token: 35	5408	7zFM.exe
Token: SeSecurityPrivilege	5408	7zFM.exe
Token: SeDebugPrivilege	6028	tasklist.exe
Token: SeDebugPrivilege	5972	tasklist.exe
Token: SeDebugPrivilege	5836	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4776	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
5428	OpenWith.exe
4008	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1136	1620	msedge.exe	81
PID 1620 wrote to memory of 3244	1620	msedge.exe	82
PID 1620 wrote to memory of 2928	1620	msedge.exe	84
PID 1620 wrote to memory of 2928	1620	msedge.exe	84
PID 1620 wrote to memory of 3240	1620	msedge.exe	83
PID 1620 wrote to memory of 3240	1620	msedge.exe	83
PID 1620 wrote to memory of 3240	1620	msedge.exe	83
PID 1620 wrote to memory of 1504	1620	msedge.exe	85
PID 1620 wrote to memory of 1504	1620	msedge.exe	85
PID 1620 wrote to memory of 1504	1620	msedge.exe	85
PID 1620 wrote to memory of 2100	1620	msedge.exe	86
PID 1620 wrote to memory of 2100	1620	msedge.exe	86
PID 1620 wrote to memory of 2100	1620	msedge.exe	86
PID 1620 wrote to memory of 1520	1620	msedge.exe	88
PID 1620 wrote to memory of 1520	1620	msedge.exe	88
PID 1620 wrote to memory of 1520	1620	msedge.exe	88
PID 1620 wrote to memory of 2464	1620	msedge.exe	90
PID 1620 wrote to memory of 2464	1620	msedge.exe	90
PID 1620 wrote to memory of 3500	1620	msedge.exe	89
PID 1620 wrote to memory of 2464	1620	msedge.exe	90
PID 1620 wrote to memory of 3168	1620	msedge.exe	91
PID 1620 wrote to memory of 3500	1620	msedge.exe	89
PID 1620 wrote to memory of 3500	1620	msedge.exe	89
PID 1620 wrote to memory of 3168	1620	msedge.exe	91
PID 1620 wrote to memory of 3168	1620	msedge.exe	91
PID 1620 wrote to memory of 3448	1620	msedge.exe	94
PID 1620 wrote to memory of 3448	1620	msedge.exe	94
PID 1620 wrote to memory of 2984	1620	msedge.exe	95
PID 1620 wrote to memory of 2984	1620	msedge.exe	95
PID 1620 wrote to memory of 828	1620	msedge.exe	96
PID 828 wrote to memory of 3612	828	msedge.exe	97
PID 1620 wrote to memory of 4264	1620	msedge.exe	99
PID 1620 wrote to memory of 1384	1620	msedge.exe	100
PID 1620 wrote to memory of 4428	1620	msedge.exe	101
PID 1620 wrote to memory of 1384	1620	msedge.exe	100
PID 1620 wrote to memory of 4428	1620	msedge.exe	101
PID 1620 wrote to memory of 4428	1620	msedge.exe	101
PID 1620 wrote to memory of 1404	1620	msedge.exe	102
PID 1620 wrote to memory of 1404	1620	msedge.exe	102
PID 1620 wrote to memory of 1404	1620	msedge.exe	102
PID 1620 wrote to memory of 4956	1620	msedge.exe	105
PID 1620 wrote to memory of 4956	1620	msedge.exe	105
PID 1620 wrote to memory of 4956	1620	msedge.exe	105
PID 1620 wrote to memory of 3768	1620	msedge.exe	106
PID 1620 wrote to memory of 5888	1620	msedge.exe	107
PID 1620 wrote to memory of 5896	1620	msedge.exe	108
PID 1620 wrote to memory of 5904	1620	msedge.exe	109
PID 1620 wrote to memory of 6012	1620	msedge.exe	110
PID 1620 wrote to memory of 6012	1620	msedge.exe	110
PID 1620 wrote to memory of 6012	1620	msedge.exe	110
PID 1620 wrote to memory of 5728	1620	msedge.exe	112
PID 1620 wrote to memory of 5728	1620	msedge.exe	112
PID 1620 wrote to memory of 5728	1620	msedge.exe	112
PID 1620 wrote to memory of 5788	1620	msedge.exe	113
PID 1620 wrote to memory of 5788	1620	msedge.exe	113
PID 1620 wrote to memory of 5788	1620	msedge.exe	113
PID 1620 wrote to memory of 6132	1620	msedge.exe	114
PID 1620 wrote to memory of 6132	1620	msedge.exe	114
PID 1620 wrote to memory of 6132	1620	msedge.exe	114
PID 1620 wrote to memory of 5232	1620	msedge.exe	116
PID 1620 wrote to memory of 5232	1620	msedge.exe	116
PID 1620 wrote to memory of 5336	1620	msedge.exe	115
PID 1620 wrote to memory of 5232	1620	msedge.exe	116
PID 1620 wrote to memory of 5336	1620	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uploadnow.io/f/94YL0zl
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ff96517c188,0x7ff96517c194,0x7ff96517c1a0
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,17546200998273976234,6795785364783696064,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6936872541487469457,8932271265612960702,262144 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,15253701221617493772,13565948565187127911,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4047793866371786279,17673502932244887541,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5898711219580859595,193584632046476086,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4204,i,15077559352226664488,1859792283201931382,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4216,i,8106766243192879111,10333131436163301499,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,12190251610932684524,12596307311758694255,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,8588534978047753179,2702912562679014644,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,9614686419010168667,3994327139479437266,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,14960038060297061839,14962748554304048899,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,9273579126373807495,7113053293491697784,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,18220749824070328902,11747103374087649374,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,18220749824070328902,11747103374087649374,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,8793741291808246994,18031622818411389782,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6684,i,2616965883872824586,10667340655079827154,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7040,i,6616713843946425551,292861256192525376,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4204,i,8225497370144534213,10713610355641889519,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,10509441436316500238,5276774893094249694,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,8458022739766429187,1797674247110432025,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,8391015903666570135,12486889171053432818,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,8699996597015313239,262078274837512427,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7628,i,9325587074273784104,5369247555415957864,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7836,i,8041626608031371229,15185981180588719954,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7948,i,6567737316155174321,1692321754537171264,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7628,i,11836991200472757189,7990861067605825510,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6736,i,192018067598705831,13668286634547214587,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7776,i,7386539674989549921,6241763770773324059,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7264,i,16315014433762517768,13116372741909008151,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,16371477323458447806,14260092541931184043,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3444
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- - C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3428
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8392,i,5507783529892407730,1665549809580639485,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:14
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6776,i,1530649132315969337,2619191198617309492,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7808,i,15688512217120954724,17799928426522557544,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8800,i,10721725538932447628,15022974583827511670,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8804,i,16259950850146976322,10726065852103214171,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8940,i,15821902511142557828,11682585254444991109,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=8952 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8804,i,7322908749489318554,13431386638950510265,2097152 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,14294468574972024884,16490322196900444970,524288 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4772
- C:\Users\Admin\Downloads\7z2602-x64.exe
  "C:\Users\Admin\Downloads\7z2602-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6732,i,12211756789440572203,1422611992623143113,262144 --field-trial-handle=2572,i,6982088925165073682,11720076975730148754,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:768

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260810-1506.dmp
1⤵
PID:3316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5428

C:\Users\Admin\Downloads\7z2602-x64.exe
"C:\Users\Admin\Downloads\7z2602-x64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
PID:5768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4008

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Cosmic.7z"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\greetz.nfo"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:3304

C:\Users\Admin\Desktop\UI.exe
"C:\Users\Admin\Desktop\UI.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4576
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6028
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4576.1588.9777594186741028492
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff96072b078,0x7ff96072b084,0x7ff96072b090
    3⤵
    PID:380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,12411590716212402975,14652863533303669409,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1400,i,12411590716212402975,14652863533303669409,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2300,i,12411590716212402975,14652863533303669409,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:13
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3552,i,12411590716212402975,14652863533303669409,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:228
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5972
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.chm

Path C:\Program Files\7-Zip\7-zip.chm
Size 124KB
SHA256 96dd966cef6d32126b5d1540dc0a9fa9868bb4342251acaea12710d20ac247d9
MD5 09541b240eeb3f5362d306eacc7e6ef9
SHA1 38031798a95a9d72b952c29546366a911b63b16e
SHA512 3105a74e1a81a7219d94bc2c2f8de6a863e3ea5ad959b22a5ed87a08bbb8910a42af8b9d9ca5700dc9c9a1b56fd0659d6e7f526eefa9744dcbcb5206e88f6931
SSDEEP 3072:cgsIbmKWelCXLFetn5dmKcrRUVQ3AoVaEl2X:ZaVewXLU3WUV67Ji
TLSH
T1CCC302B11B9E2893CEF5D778892F92813128572254D84DA8B62E15AE9FF0F6E14803D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 974KB
SHA256 ebc4f14a05deb7443a2ca3c8c379b6ae1b0f1a3fe193e00f51e10da6bb3adf3a
MD5 c2b436843c1a230e866e4625111d747e
SHA1 a76fc5441a4e8a2c62b19baf24cddc24ca554522
SHA512 940f92601ef3a8b013c108eee658f41efcc0b0b130875fcb7891e62c7fc8a2da3002299820de668959b3898145d2149f90ebc711a43039274acb6056d32e3d83
SSDEEP 12288:9SOBshTF0cvCQH514bzx078h+NQXWPcLWw1c3rQbq1yy+cpiAbh1gEeIpeE/:JsJXH56bzx078h+am0WwabVicpDPobE
TLSH
T14325D825F5788333D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E276D6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History.txt

Path C:\Program Files\7-Zip\History.txt
Size 10KB
SHA256 130b1971ac66eb2e4988fc2be9e1f0641ab61a13fb065bc0cb656be8127f35cc
MD5 76f502de55986504c8ff690de2abf0d4
SHA1 ca9739b499b3f974de882cbe740745497d974f07
SHA512 e478071d3c05b096bf22a4b2a4dda3cddf46b0e191c02fcf8a2f40562c4644e74c1e2e901f3b56ca953d0f3d3a74a5be69e4a39ad662cc150d959f9e57245feb
SSDEEP 192:oSa3YllswjswLwBNFcKUToWx1wSfTd/YzfN:va3YlW9EoTWx1w8YzfN
TLSH
T1463270A7BE45A3713176D2A3232DA059D30895A96F0702C0B4BD83AC33358AB57EF5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.txt

Path C:\Program Files\7-Zip\Lang\af.txt
Size 4KB
SHA256 9cf684ea88ea5a479f510750e4089aee60bbb2452aa85285312bafcc02c10a34
MD5 df216fae5b13d3c3afe87e405fd34b97
SHA1 787ccb4e18fc2f12a6528adbb7d428397fc4678a
SHA512 a6eee3d60b88f9676200b40ca9c44cc4e64cf555d9b8788d4fde05e05b8ca5da1d2c7a72114a18358829858d10f2beff094afd3bc12b370460800040537cff68
SSDEEP 96:bdDW+Wz9my7MIlXq2sQqpxjOsgEGh4YdVDpZfir99v7+bv:sfwy7XlXq2sfpxjOsRGhfVDpZfCji
TLSH
T1E691D529E08001652A463CFBFB4A1DFFDF6D461DD3767175CE928A1268207FD81A88F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

an.txt

Path C:\Program Files\7-Zip\Lang\an.txt
Size 7KB
SHA256 3ab9f7aacd38c4cde814f86bc37eec2b9df8d0dddb95fc1d09a5f5bcb11f0eeb
MD5 f16218139e027338a16c3199091d0600
SHA1 da48140a4c033eea217e97118f595394195a15d5
SHA512 b2e99d70d1a7a2a1bfa2ffb61f3ca2d1b18591c4707e4c6c5efb9becdd205d646b3baa0e8cbd28ce297d7830d3dfb8f737266c66e53a83bdbe58b117f8e3ae14
SSDEEP 96:/iCx+nicrSC2WgvUZ8I/MbcGr74hjN8H7+UeT5xMWcZlFi6lCg6l+Rl2NIqpClH5:/OnVInvQ5kN74nK+febFi6Yg62I7bPFI
TLSH
T154E1BB77E6CC09A3395B0727F783C06B859098613D17D2C9A31C27B2279CEFCC49A845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.txt

Path C:\Program Files\7-Zip\Lang\ar.txt
Size 13KB
SHA256 9b4459407e87310d5673040e5e9a364e49b430ea94037a63f30f0d9e5a34a342
MD5 a1811f34b8f15cc44ab7486ce1e7337b
SHA1 5e22a9e650886022e7754090a66a100d225315d7
SHA512 50556f93908bb9d28a2343163e8b9c055618287c60f53a458250c08b413290366865f25a9fd81e665a7346bf8de86ea2f08f168149cedcd42f8a27c41e539049
SSDEEP 384:w/YybL2XSV+IYFBLRTRZgZCjWg6IvLDAaJQZmz/mghr0MhI05ANN:y2X1BLRMZCjWgfvL0GQZCeghrvIL
TLSH
T1E6527CE21E24847217959F0ED0E2352CE972AD73EB9BFD3134532A2091EF972D24E635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ast.txt

Path C:\Program Files\7-Zip\Lang\ast.txt
Size 4KB
SHA256 f5f2174daf36e65790c7f0e9a4496b12e14816dad2ee5b1d48a52307076be35f
MD5 1cf6411ff9154a34afb512901ba3ee02
SHA1 958f7ff322475f16ca44728349934bc2f7309423
SHA512 b554c1ab165a6344982533cceed316d7f73b5b94ce483b5dc6fb1f492c6b1914773027d31c35d60ab9408669520ea0785dc0d934d3b2eb4d78570ff7ccbfcf9c
SSDEEP 96:FlZTprnge/nJYeoPyWxx6aXaNpx4pRfOvFE5Z2k3z7DWdyy/kYZTsJ:FnZ/n2eoPlxxRqNpx4jfOvFE5Ykq/o
TLSH
T1EFA17353F1CE01A33AAB1776EB82C07BCC548164BD2BC095A36C65A81ACD7BCC4A3D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

az.txt

Path C:\Program Files\7-Zip\Lang\az.txt
Size 10KB
SHA256 1da941116e20e69f61a4a68481797e302c11fcf462ca7203a565588b26011615
MD5 9cd3a23ca6f66f570607f63be6aa0001
SHA1 912837c29c0e07470e257c21775b7513e9af4475
SHA512 c90ead15096009b626b06f9eae1b004f4adba5d18ccdb5c7d92694d36903760541f8aa7352be96466f2b0775c69f850605988fa4ef86f3de4fca34f7b645457e
SSDEEP 192:3Fr7FND8Bavrw291BB5wSKS27xcf4G05gASSvtggPnTInmm4Et:3N3D8Borf5pm7xcfXALggPT0f
TLSH
T19622F846821E4C4C86EF038900DEF7FFEC8FE8AD72E66061A199621E56CBB570F5C904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba.txt

Path C:\Program Files\7-Zip\Lang\ba.txt
Size 10KB
SHA256 8a85c3fcb5f81157490971ee4f5e6b9e4f80be69a802ebed04e6724ce859713f
MD5 387ff78cf5f524fc44640f3025746145
SHA1 8480e549d00003de262b54bc342af66049c43d3b
SHA512 7851633ee62c00fa2c68f6f59220a836307e6dde37eae5e5dca3ca254d167e305fe1eb342f93112032dadafe9e9608c97036ac489761f7bdc776a98337152344
SSDEEP 192:EG9NeKlSU9fV6kPtwusVom5DvB4UlBFXCsMu:EG9FlSU9fV6kPt+hvBPLFXCE
TLSH
T1B222E260A28BF4AE5623D5913C16B7487CD6147CB9DB73124129EEBE38FB3E44269207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be.txt

Path C:\Program Files\7-Zip\Lang\be.txt
Size 11KB
SHA256 32071222af04465a3d98bb30e253579aa4beceaeb6b21ac7c15b25f46620bf30
MD5 b1dd654e9d8c8c1b001f7b3a15d7b5d3
SHA1 5a933ae8204163c90c00d97ba0c589f4d9f3f532
SHA512 0137900aeb21f53e4af4027ea15eed7696ed0156577fe6194c2b2097f5fb9d201e7e9d52a51a26ae9a426f8137692154d80676f8705f335fed9ae7e0e1d0a10e
SSDEEP 192:voiIwxssHdMMybRMIc++NBGC4ci/4f/iv1GBSHlzdRCU39ixod9t:voJ4s8SKs+NBDkA/m1GBSHlzdvMEX
TLSH
T14432438457AD48FF1502E1979E496A8E7DD604FCBBAFB302017A7C3F26A6260873D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.txt

Path C:\Program Files\7-Zip\Lang\bg.txt
Size 17KB
SHA256 62c6f410d011a109abecb79caa24d8aeb98b0046d329d611a4d07e66460eef3f
MD5 2d0c8197d84a083ef904f8f5608afe46
SHA1 5ae918d2bb3e9337538ef204342c5a1d690c7b02
SHA512 3243d24bc9fdb59e1964e4be353c10b6e9d4229ef903a5ace9c0cb6e1689403173b11db022ca2244c1ef0f568be95f21915083a8c5b016f07752026d332878a4
SSDEEP 384:MZ2tO2YSwozmsZ9mFL7AsbjftmxprJ4kgy0j7u4ybq:dCz7lbjaVgyCufq
TLSH
T1DC822EB15B9A64DF1501EA6F8C053E493DEA80FE7FE7831241712DAD31E21B483B960E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.txt

Path C:\Program Files\7-Zip\Lang\bn.txt
Size 14KB
SHA256 3f55b2ec5033c39c159593c6f5ece667b92f32938b38fcaf58b4b2a98176c1fc
MD5 771c8b73a374cb30df4df682d9c40edf
SHA1 46aa892c3553bddc159a2c470bd317d1f7b8af2a
SHA512 8dcc9cc13322c4504ee49111e1f674809892900709290e58a4e219053b1f78747780e1266e1f4128c0c526c8c37b1a5d1a452eefba2890e3a5190eebe30657ba
SSDEEP 192:haD8h70Oi+7V+y+FJNgquLCnt/SD4mKYGn940nWXmJTQOdLrRMs:hKm5f7V+y+FJNgquIt/64tnSmJciLNMs
TLSH
T1FC629922C8AE81B1A4D5CDD907886370E613AEC39766F748CC17B116385EEBC4C9ECB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

br.txt

Path C:\Program Files\7-Zip\Lang\br.txt
Size 4KB
SHA256 432bdb3eaa9953b084ee14eee8fe0abbc1b384cbdd984ccf35f0415d45aabba8
MD5 07504a4edab058c2f67c8bcb95c605dd
SHA1 3e2ae05865fb474f10b396bfefd453c074f822fa
SHA512 b3f54d695c2a12e97c93af4df09ce1800b49e40302bec7071a151f13866edfdfafc56f70de07686650a46a8664608d8d3ea38c2939f2f1630ce0bf968d669ccc
SSDEEP 96:uyzeGsp9Qb9PzXHsRu2aPm68ZMvpZkul6Wg1AQQYBgJ0ZQBGBl6agPNH20qIvUkw:FzeGsbSu9y8WvpZR6W+AQQYG8LgFW01S
TLSH
T1E2A1A6D3C48876A42CDBB5BBC6045EEE6D65CAECD06DF7BC818F09A841E867453B910C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.txt

Path C:\Program Files\7-Zip\Lang\ca.txt
Size 9KB
SHA256 da4df6490c7bc8afd804509f696f9afa6f709b7a327044e2781fa6c95770b239
MD5 a77210be2527533d1eceb8f0ea49607a
SHA1 807e36fce4dbe269601939a8579ffb43fe43f381
SHA512 54096f332f2a9bd5690c973eae19ef4199a6acb5243133b9065f433830984f91b62a9f1d71efeed5952cff0bbcb1befdce321cbb090c620bfc13a98bcc1dc14e
SSDEEP 192:mnw9f5yhG/twoHcW5W3FupCPa5zRHKDBZ0EKKIl3d10aeKY8FDiYLSo:N5uG/twoHJ5WVu9i0E1TAiYLSo
TLSH
T12E1275E391DC23637992033FE7CAE05B84D8BD583532DA98E59812A6354CFDCC927E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

co.txt

Path C:\Program Files\7-Zip\Lang\co.txt
Size 11KB
SHA256 dcfb95b47a4435eb7504b804da47302d8a62bbe450dadf1a34baea51c7f60c77
MD5 de64842f09051e3af6792930a0456b16
SHA1 498b92a35f2a14101183ebe8a22c381610794465
SHA512 5dabeed739a753fd20807400dfc84f7bf1eb544704660a74afcf4e0205b7c71f1ddcf9f79ac2f7b63579735a38e224685b0125c49568cbde2d9d6add4c7d0ed8
SSDEEP 192:arUs6wOYcVCr1oX7A18zsuX/Y0Nf+6X5gOiAKNWw9BfpN5uc7Fd5:arWwzTr1oM1fuPJNf+26ORwAYH
TLSH
T1D232A77046D640503A9B0191FA10F268F337CC58EE9B2698E779178C11DDBAAE297F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.txt

Path C:\Program Files\7-Zip\Lang\cs.txt
Size 9KB
SHA256 da788d30aa74b3f8b3d920e98c535e4544756e9e4e235ed0221654f3177d3d2a
MD5 1130abf0e51093dc7edd2c0c334be5d8
SHA1 260a373c4df2ec71dcd343ce4cd97b65d18efa82
SHA512 0f7242992c990085b8332c7e072928a17f4fa4e729451600f1abf58158eb1b782ac4a3c200c1db510bf70f13e6790dadf897e1d1c6effb77187ad41b02e16dbc
SSDEEP 192:UmN2bjDwCaf37QHZ+Shum4Xqgbp6p17iG:TN4nw/frQHZ+Shumkqg9G
TLSH
T12A12B83DE981A132A008030C3BBAA9196BBD47C05A675DF5CCCF99C106F5BAB5D9BD31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cy.txt

Path C:\Program Files\7-Zip\Lang\cy.txt
Size 4KB
SHA256 470eaf5e67f5ead5b8c3ecc1b5b21b29d16c73591eb0047b681660346e25b3fb
MD5 6bdf25354b531370754506223b146600
SHA1 c2487c59eeeaa5c0bdb19d826fb1e926d691358e
SHA512 c357b07c176175cc36a85c42d91b0cada79dbfb584bdf57f22a6cb11898f88aecf4392037d5cea3e1bc02df7493bb27b9509226f810f1875105bbc33c6ae3f20
SSDEEP 96:8VTu+i2nCrWTXAwQGjC6IF5/uNXlziug14+UFxmeeqYgzf7Edm+8VR:8VTTCqTRC6Iv/uzg14+UFxJYgzTR
TLSH
T1FBA1D917E4E42EB8F686B1744E9A597DDE04D181F6E26E81E2200F88505EF61FBFCC41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.txt

Path C:\Program Files\7-Zip\Lang\da.txt
Size 7KB
SHA256 5ccd481367f7d8c544de6177187aff53f1143ae451ae755ce9ed9b52c5f5d478
MD5 c397e8ac4b966e1476adbce006bb49e4
SHA1 3e473e3bc11bd828a1e60225273d47c8121f3f2c
SHA512 cbbece415d16b9984c82bd8fa4c03dbd1fec58ed04e9ef0a860b74d451d03d1c7e07b23b3e652374a3b9128a7987414074c2a281087f24a77873cc45ec5aadd2
SSDEEP 192:3vn3kbZyZSXQVPLCXiG8gYnJYZDAHZE9xM7T9kur4Yc6Fw9KHl:3v3tSAVPG8gYnJYZk+g7T9kur4PUwG
TLSH
T125F1B404CF841327752617EFEA115CBACFDF4C394A30239B6AE8E15EB45B60452FA262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

descript.ion

Path C:\Program Files\7-Zip\descript.ion
Size 366B
SHA256 1da513f5a4e8018b9ae143884eb3eaf72454b606fd51f2401b7cfd9be4dbbf4f
MD5 eb7e322bdc62614e49ded60e0fb23845
SHA1 1bb477811ecdb01457790c46217b61cb53153b75
SHA512 8160b581a3f237d87e664d93310f5e85a42df793b3e22390093f9fb9a0a39950be6df2a713b55259fce5d5411d0499886a8039288d9481b4095fabadddbebb60
TLSH
T1EAE026E30D6F45A6F1D511769D02988F7626C5068FB0D3C07074B7A62C120E46A90480
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 eea5136d2e39678414ffacd6b0cd17d827b94ca5e09e9468a07da262ccbf226b
MD5 a5f81d2116ef82c09ef6390931e3e516
SHA1 41bf5bc16a0461378735c770328db29958f219d5
SHA512 ea06f9a9da51c5f9121a15fe82571cdbf88e49bd142719d3217436191f7d10c6c1c99b197f7a0150b1d0200a529f0db5bb82046d39f3f178a5ab4cea9cabf121
SSDEEP 196608:Zjj7ZtY620KULyMqDzi1msxtpEdDHTXom5KRZck3T:ZDZKli1msxtGFzXom5p8T
TLSH
T1B3A6BF22B900C032E8D100B2A6BD6FF6993D99341B7954E3A7D45DBD5A305D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.dll
Size 22.1MB
SHA256 6ee5053665a3d722337d0e14becbb614b603b19d952538e3eb9ba6b76cef2ee8
MD5 c7adc2b645f3f538434e149310b2255a
SHA1 5a6ef8f384f6eff5898d72a4c9792819490bfcab
SHA512 80038b6c6f0053844c55ef1d9d0be82ad2c0c8769b3805b69d2a6203cc42c69cfd56ff96ef38372fe06c40fb7de6ceca1124e4e46dc935f38ac8f3cb3c5621a0
SSDEEP 98304:HAISODF7F+aFnWEFuqZ58PHs5bHHVwpWYKUTECZZD5j4Bbf9yW0AAYYqddfeg5Vl:Bxe5qjJPYvH/FabgalDOSBVjDrNhIHHe
TLSH
T15C37BFCFE8D70AA4CAA19070E15F67E3EB62714C5A582DF346A50120363376E265DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0f6e8797ec44866b70bb772777fccc9be92e480a6a74d7167030771d5c750125
MD5 139f17fb31df92791073000f1c84e70d
SHA1 e9e6e51d88d598a0b84044bc548b3e26e257f9e4
SHA512 30f90c4efbe6cb8610346955dea4171a79a315ef2747e4c055a5e807cc34af0e84a2234edf261f8a42231ace03a62a4fa6dc3295b65a412ffec3b262af4e0d9b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T10FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 40KB
SHA256 32757dd7cdd69fc8b77e460fcf0b4354d7ba9b12b70b92175439c18f16ecc819
MD5 63f4bf4c9e4b2f5ac4b1c8a9f4a6d20a
SHA1 40d033d0f716458228ff5ae4c623b3eebd7e8f1f
SHA512 ca748a2e7f54c22bea5b6b586082ca9be3eaf1ee199fe56c7245229ee4f73d99778beb019d8eb33f2aff1800a3233a31d506274259cd791dcf82a994120143a2
SSDEEP 768:rQ0uU6UEmqopa8oTvB6vf26ER+musSjAPWL9f3+dvZDNiS+Hfkae76gpGnueZG:rQ0mUha8Hvf/mutjsU/Ux8S+/5e7FGI
TLSH
T18513F292D7F44C509F5DF2D163086CA1A77A2CF5A388529CB5E08F22A49457D018EFEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 204KB
SHA256 a5fb7b35785b107a7483a2608e5ac8ef7956482c8e2a15fa9d45aee41908ca96
MD5 3600e07bfb3f0cefc48ec1b5f04e8c47
SHA1 af6e8d4e6a3566f31f5abab041eca62e0c2c568b
SHA512 63e6aab0457e3683f172b9f0f6b08cce76dec43441c9bfdb28fef5a50395198bf6c5d37d688f867a9b0f1b52c15fd43054bb3a1b21813d80392049099163172d
SSDEEP 3072:7Qf6wsx5fLr6tVBQWZNJpI6dZTQMxzxFjPG8A51Tj4O153bEPJ98UsR2ZyZSy1ah:7RwiuBnvf9xFa8A5pwB9ER2ZyMrlD
TLSH
T15C1423D3545E16CF5E4D22763FFAD00A48AC458F6A1992CD9CCEEC33AE8DC743264568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 83KB
SHA256 b9cf829054644112cad26f89076f408cecf4260bc41ecf58632fd3b5d6fe9425
MD5 4f54fcea847826f6726a8a9f7c263fbe
SHA1 ffe769144e3f5a7aab2896c851d0ce1188d246fc
SHA512 997b7c85ad425a1206c08ce75e2634395ca28f18d0f93a8b31d55318c1d87f60b9d129dd6cf27901249ca47fa7a245d3d4fbd95b35d0010dce2480b49a755950
SSDEEP 1536:Nly7os2TXdq2GQFT99Qu+Kb5+z9xhWhJk4dMrXy4kR/HAvVlOINPDreRnL9ST7s:NSIMMRAo+z9xhMKrXyTolOINneNLkPs
TLSH
T14D830245A27FA80B18504EEDBFCD7ABA0F766B21D86580410D1B48D9E2A6D3D1633F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 56KB
SHA256 631ac6b47af403356db81376220724c58604074ae4e6312f775dc5783ab6ce61
MD5 95219edc7f5339209a4b0e69d3a3b5ae
SHA1 e95736dcec5ff384bf23573cc0e6e72e2f518da8
SHA512 b989653d617e404b92dcabafd7489a596e3fc026b675b0abef3bd9d8fb338c1bc8c629deaa1a46a30b0975fcd712c8a18533dad983ce8aec14b4f4db078d6d8a
SSDEEP 1536:xNA8L9B6UDoJEHt7fJb+/wN65MFsNaxWUmR0WNmCo:nHpNb+/p5vaxWt0Ezo
TLSH
T10B4301E313A523334A9B6D7C101E5B175A973B2A3F2C84EE57A4426D7804EF89D20CB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 17KB
SHA256 7db8d29c8169f3611a9ee9f05f9d3fd5caedc7693af33feb65f436a80bd33240
MD5 24ab21da3b67f721475e95ac2770dc21
SHA1 b964c8bdbc4ff708b283d9e052c1bf4947b29e09
SHA512 45e939b7bbc3b7ae47ea3b778f4ddabc3bce06f0d3fad4d2f1851fb43597e4c2b7eabd0678110a20a0181709b7dd039191adbd40e7b6f1588f2a3d5024268a27
SSDEEP 384:8KinigLYvNlzoASrDAR/Vy0CbVJn2esg1OZh/3ie:8Fi6YVl+Da475sFf
TLSH
T12D82D0556096AA71023FFD477D0243ACC69D38A8B4D7EECA5930AFDC08296D1D64CEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 60KB
SHA256 973d7c4cd91c428490204d4647f283b60daacc9ff0e8c83bf8c1bf994528602d
MD5 b96f8d90119f9f8307274adc5695da21
SHA1 57e36157b36dbc401c5701d0e27ec2885193a4ae
SHA512 e267cd9d04f6ced28190e549640aa7e08060673a0f616b7ade1ef3aba4f7c8ef52a082266ec362f42ad2bf3982141bb8476e4be4c97ef8c40248a1d9e25efea1
SSDEEP 1536:G3gKQfQWtQJzaGw3WZiWX0K1pFlvnC2c+6LABHgO:G3g94oSZFkulqJ+6LAZ
TLSH
T1895302A1F19608BE6EBA88B35DEC427A99F9F4E653D66D32D54F124021B8821D937C04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 72KB
SHA256 e21ce53d43bd9e404759b9a267e44c63106a423e70263f87d9e13ccfad4f61f3
MD5 1d4e7b902aa7d072fff5861353725adf
SHA1 3ab24c6848aa072854995d7f477604f2474fd6a6
SHA512 4667de5c55d95d200c604614114228180b0bec7b1e2f4bc204de5e28048301dd956ac0105516cc734757da33643cbef9ef42a2a04ca7ec6810200fed1f842d05
SSDEEP 768:U8XRyk5xUzO+ZR6lrxcgNbZcHTnGWRVmcrODcgAhR0C35hYNeJET+KoASRBqFqTE:UKRfo0rxzbcbzfSDccNaAJ0W9nKr+wM
TLSH
T1DD73023BCC97140DC7999B27A829A32EC10892C6A01F7D3B46C4347975233C5B667DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 46KB
SHA256 fb1f7da31b3e3a52619ef8586e9fbe2a2d08608fa4075a3b3e54006db1affa60
MD5 8a0603a7b217b3b806642b5fa5552951
SHA1 947a90c7869413b842b88011eaf81e4b76f10111
SHA512 45a97b0297ee39679887ea5b6aa432affa9fc97acbfd44556e5da3e8e24f0a7bf162ad7fb5bfe00118d0c73ec6ec1fad55071f81ce882148c6a814d3c9a6a731
SSDEEP 768:kXpPULjakGUNTbU5DpU0fDYqF77iyq0NXtvLaTMvmUDcdgODKFkdNaR9mqh4iqev:OKG8NTbUHlfDoqXtOTM+9dghR9mvEl
TLSH
T16223F206E1213FA171E17F25C7DA0842BC6F4DB52C9503A8B8B9AB5A1F9453FE4906CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 71KB
SHA256 d40ca516a00f4b6ae9937cf0eaa8e1f0c2033aaf783dae3c461d68b8b142bc4e
MD5 8f850aaafc8da0df7f8f0a0b682a934b
SHA1 ef55df2e866abed76fe19b05ceb51c1147a6961f
SHA512 15160500824282d1e829908670dc7405abeb4d571ffdcf94532f55294fce77552c832f27fc14b91141ffd2aa142c441fd8e48df8e43cdbfe9283a043da2460dd
SSDEEP 1536:m4kLBYkMICj9ZBz3ff3Vpsrc6gy86ywUOWo3xmWVNKz/8A7yWuBKZS4PHS:elsr9Lrf3VGQ88hLoxPq/N7y0ZS4Py
TLSH
T14573F15242B8D90C1F6550E30BAA1EF1CD6B18CB94D4A0CCE8C7EF9DD259EAB4D66880
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 256KB
SHA256 542ac655cca6f4835f0752937b8144fa3620dfec1b42b5277470217010a621c0
MD5 c21d5d29eb3014fdb864f388b34145ad
SHA1 85f724b019e8d04f50b336631c66f788c2b8f651
SHA512 a67da76326688dcd2de7ab513669246bdaddfda93635de9ef7db820243f3c4087e6166836f8b9cd09830873f0b375d2b720241734eb50d5cc8340d0592e9dd3b
SSDEEP 3072:aeE4Sz4c+ygjpraJ9XQu7fZ/4aUe+w3O2jD/JQw0hHyt8Vn60pGt:Qz4TyXJ9XBfZ/4aqw3O2mRyB0
TLSH
T166448C70F7C3E782CB431AB9A07C3D771FA504C562C51E1786A3AD219098B6AE71B53E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 512KB
SHA256 02b0a8ad7f3e9727b28cebc2ee1663712b990da7cc10dd96025420be6315dc94
MD5 9c4994ee71ed65500105b3f15520946a
SHA1 d2b907a0d4e91781e6a84acc400658e2244d9c12
SHA512 6e23ab30afb45947f85feaeae82cdb3603b250f0175a346820ea9a125bffbd3d57d5140a92b8c0af36e6cb60aca2f51fedbaf0796a6834cff95b953658bf71fc
SSDEEP 6144:LOudzRoFS0/wxHqywh0aNqbi3oCKImWcbL5MSRSMzc1DN1cGexAlfE:3dzRiwC2at3OIYbzRSWc5N1cGexwfE
TLSH
T136B4E0B0FBC3DB80C74326BDA0BD3E371B1204C161D94A0789537D519461FA6AB2BA7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 17KB
SHA256 47849169f7bbd67b9ec089dbf0d3c48905899ea2dd797701da9d7e0ab8828bd3
MD5 7d2885375e234250fd5402c5807fb2c4
SHA1 c7dae83944e86749f221cf0ec8498f8a8ad500b6
SHA512 fc9fa236ba5528ff37da711ee76f426411c0e02ab15941b76389ff3cb5d2c4848f92feb10d420953aba81a2e404557b7fcc5bea2b976fab48ca366ca48f4961d
SSDEEP 384:I6bIOtpB8E58XxbwPTG9xWUf6ULe//OiofThj7CS4CnzdWqKD+lVzUl:IQI6wEuXJUTOhSUsWiyThnRfzcqKai
TLSH
T1E082C0FD0B5EEE07691A3988C6619B63084875D7A28D251877C4E4ADCEF7B32DC031D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4
Size 17KB
SHA256 17bd64c4f43d604309e87d916f9233115180c0dc0cb5a94cdda36a2add279da6
MD5 64c1bca1e5194269bb0d451eab354a00
SHA1 42a610220f8d89348e0b21e928521bdb681e7431
SHA512 fe3615a09e7e83f01412f62e2b9d6c446d238efe59cc48edde5d50729f1ff700d9772fdaf0e64ef180c068dace00abcd2e284a2effd14db90b44a18fda9a870d
SSDEEP 384:T7ua+M7O7xk0Ib68GKHk6hZ/IwuXClM3lz0EXw8OHI2D7PwwjmTT:T7uxkZb3k3elM3p0Er2PIwmTT
TLSH
T16582C0C04F7AA46E28DB99B9C436CAFC716B8553721E19A1C07B0EDCCB050B29F975C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 19KB
SHA256 e638f299997ee5dae3c3ebe6f2b9d2ea4707281e5c5a03062ab680d012ee86a5
MD5 f661de2fac30eb8b85bf199124d973af
SHA1 f2831b1c44b0ac8ac97f126bbfc1a2b7bdc55229
SHA512 4d1733ef3ae093f68ead0c40c32178c07575e320cdc704bb64576fb8d65540afb5e942155ab44b842224f33eb94f1f7552da7a2612fcb8a3b5ae319f88fb7362
SSDEEP 384:Y27r6oMJ9jurWur+zo4XBzRuiOD8VSJwE2GZLLkkwqAeR4OQ0GnX:V7r/UAJ+04DbOePE1ZL7KePQ5X
TLSH
T13B92D0AC3E10AA05EFB1219E59B73A07DA07518F25387162A14C48FF1DEA95C50FB27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 32KB
SHA256 baa1977b45467d93164a21ca8f1740256eb538cd925e3521b56cbeccd4fcd60d
MD5 d0a33e840b3127553011e92af4d28bbf
SHA1 c8192f72f6630548b1b5ebf085138f5e201b0d7b
SHA512 964e57c62050b41e31c37d487c3eabfbac6a9afa5d3325c8441c596cc2f9646ff02d8aa09f2ae1a103e94e45144df9186f98a8e341496e39aca613ecc0ee4528
SSDEEP 768:htjSLYGAChaQ/C0Vazvcg4NWjCw4ujfvdyxeS930rwVaMrKN:hsLYGeUVaIgP9ndU9EkVaMrKN
TLSH
T110E2E1413F9F2A79599C9C2A92EF81F23CB2839967BDF1096C8B6178C35834244735BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 45KB
SHA256 740baf26688d33e59a77b942d3328a547b4ccbbb7415d9dd75a313c30f4587c3
MD5 4156468198cac764f8488b5eb64c6529
SHA1 6d9a69034a795910c1830900792756394f1909a1
SHA512 4b497c4895a8c63c440ba462df53530a692cd251a2e8ff8209cd13e1793b4d818d1c7d167c64601cab5b04ecb37a745623ba81d7a474aff058a9d52ecad5b720
SSDEEP 768:Zkn5tLspOT3hWLJXiVxJk/c8CS7bXN5279uetzx+GjmK6Wd2/88EsDmdtluVAzLD:ZknvLsFXibtSe7wetzUK6WIk38mdtluS
TLSH
T1DE23F1398C72C55219FF0CF424CA8C98888E044DBF25BA5D169447AEF0F7E1CC609FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 18KB
SHA256 ad2483a56557a1ca259dccec7279591abc39b9565f3513c676384dfe060fde4b
MD5 15fac14dedb96ecf1077775671d31141
SHA1 58e8b251869ab8d9c32ea3c297d6f438eed16dcd
SHA512 8eb98407a0afba6b2aec5188883bd129d00e3559a6705e1b1843bd4cae9081a4faed6af5984a29f38f9c4a0cfd548ebe5f29f3aab6942c34e21dcf1e33c065aa
SSDEEP 384:1p/7GUPciEEd227+e8A/cMYIxK82an8b1LUFQVUGLbT46tBKdG8rD:37GUPDEEdlKe8AEs7zfQT3EqBK0Y
TLSH
T1F882D0B84EBC3B5673618B7E42C4B251A87668C30AE4AE38EB35DC337C125469D25353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 68KB
SHA256 9e4788840f43b463a51534f036f6bd9a36e5293bd6da8e4654b43e1d83714d81
MD5 0032df338799c529f8900ed1df3fe473
SHA1 3552463fe133dad96c5fbb369d3225e51f729c51
SHA512 15265ff935bcd4e70263c233fcc97185785291a454838bde98267e26dc2143af16720dae70710ff0149a783ffa484ca7478ae76fc451fe2743c2c1069d7b04e0
SSDEEP 1536:U6UIpg9QPWEgHpuRQAPmrc930G+7F4rwzk50fpuMSKlZh:U6LO9AQy+GnSfDS+Zh
TLSH
T12863129CB8B56F8C40B28EB153ABA01DD306C65DC47B93FAC214B64F029D129A43769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ce
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cf
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
Size 38KB
SHA256 49e64d3ed6fa7cd75bd9e1d68a4a6db1667e4706f6354a97bf562dced5c78464
MD5 543599d2ca352c98f24b367fed1efe87
SHA1 a478e6c9c448b507158198b2b9936c8fab198cdc
SHA512 ad6705236eebff2e182a7dc1a1163741962ca6d87e485663843a4badece80424fec831260826f95890b1d4663026198ec5646cb5c7b9ed813374627ec2a96147
SSDEEP 768:GHRXACTGqn4j/ADPN0Qo7pPg0gbCy6E9pvZwcWx83rmnbhaRbRkhQl6:HeR4bA7CVjgbZpP3Wk6b8ruT
TLSH
T1DF03F1AF2B7D6A752F2A9394013F0AF4D48DE01E3465A158A26721F97D2C8D7748B0DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

058146d8688ca2f4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\058146d8688ca2f4_0
Size 6KB
SHA256 7702600c4cd0488d82df57f449a8a0ceb9ec54e2fa47a9b36e2e8ce75de43a08
MD5 6687036de368f9efb5114bfe750c255e
SHA1 61f9ed62b2193e34dd2e148d7bb22854a41abaf4
SHA512 3ceb80db161dd2e0cec9383a6e497d4ff98d1a5f0356536318bd7bbb54be7b40ccf9312b7e1cffa5c69b52cbbfaeedaa63d528f3820409bbaaccf9ef553213ca
SSDEEP 96:ouwyEIMv5tnZ09VUcPkELI/ijdThej5kQZxr96YspFPQ/XnI1VJ+:oYMRtSjaRijdThej5kYx5WDoaVJ
TLSH
T1A7E19246CAB04174C9B673F0079A8903F63904140B57F29EA7F432363EDBAA35B67869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e661907c2f9f071_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e661907c2f9f071_0
Size 10KB
SHA256 d0bc1510f94a9f1c7b566a87c0e9d9cd60ae624de8ef91cc72b606c94acab657
MD5 4ff55318a3f1042a96122202facbd9e8
SHA1 6fd50a296206dd858db2359a93656913311b38c7
SHA512 36fc291bda4ce718ab4fd29e69412d82553195f9d31b894413b0d83490a2ba5293de78111724928333eae85ecc235166985283a9173d5e4d2203a56e4ea68752
SSDEEP 192:6jbMimOPo2SN33EgweJjDS3Lz2pDItKs:kTJQXN3WeJDoLz2pUK
TLSH
T13F229A16D57041F9CA2523F0866FD843DA3704651B81CA0FA7F8337AA8A7B67DD17C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

648f438c0428b6ef_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\648f438c0428b6ef_0
Size 2KB
SHA256 92a57c6d9ac08b8373a833505a75629580e3c7b9fd98d83ad5d471148eeef339
MD5 488d62261dd666000bb839f4e49a0c06
SHA1 709784c970735dcfd08b0d007f6e6cf22dc69842
SHA512 eb52ffad072bfac1995ea536f08effdbf572c131464b70b43c14c68203f3597bd4e47dcd276cedc01e7c86707dfd1b73989e2cc51ef9a31367a2eb97b1b37e1c
TLSH
T17D519557EF6450A8CD77D2F1166A400AD71308290A42E25F8275B3FA7D87F635F96824
MD5 SHA1 SHA512 TLSH

Submit Download

6d79b1382dc24762_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d79b1382dc24762_0
Size 2KB
SHA256 6ae82d50bd0b715cdaac9d3902074aa83b65c4ed08df1ece4452b75ffd332006
MD5 a57ddaadad7ae898b7eed787cbbbf565
SHA1 c9addb14097097e7074bf3cec7c7839a92e06484
SHA512 307ec3f1739f54571d364ca593927eace41494656ebd3c76ad461a1ddc8156e37407d5bbdd032b2d7abccf442a1e85d61fd74be319425849fae2cd6326d2cb01
TLSH
T1DD517603EBA440B4CE6323F440478E42E33645385F41D64FA3A8A2323DCF7972D6B96A
MD5 SHA1 SHA512 TLSH

Submit Download

c4170f3fec6523be_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4170f3fec6523be_0
Size 2KB
SHA256 ca7471c34f83b50c5b37665c52a0d26515ca6993214d2b480cc6c980a098d9ae
MD5 f534bdfaf116d592fe9b5ef7c2b0de5f
SHA1 5c6f7e7eddbe871cbea641f7cd1d900ef4a05f2b
SHA512 475a554da9fc5ea4a7b28d664b694d239f24c1860cc3fec3a8e3622722d29a5c89edb488d638babf287ca78575c222c0e8e649ed415696809813db737539bc4e
TLSH
T18551F813D70C2D90FF3233B9466BAF43E73945196A83E25582F8335A6D4BA179F07484
MD5 SHA1 SHA512 TLSH

Submit Download

c834326152660054_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c834326152660054_0
Size 3KB
SHA256 eb1f190debb047f88e6d296894978091a815ef3465d2537c5ef031177d2f69aa
MD5 6a4451dd3172d2a337d03cb2176b833c
SHA1 e4f35596c41d2a51ff167bb8b646dbee6e645c34
SHA512 6648adcd79283027215f614827dc76d3fe14c7cbbd30445f9ff31f79b87682d20c633d056fac05ff3585c85190947cc3f4ab94a8256f0d08d2f720a0aca43387
TLSH
T104818562D6B4802CDE2213F08A6BD807A329056C16019B7F979473323DDFED7592B876
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 9bb74576c46b17d486310ccbb5a780a56e44f41ce255037cf503a0f3fc86ac80
MD5 0350f690a9a4a54a117369dfa41a381e
SHA1 c99d9435989d896fc02ab7db33ad6a4b387322d6
SHA512 4cd6ed039050453fcb5f5f9d9e8d633d953e72adfccc1228e245aa3159e3c83ada63f41efc1a9659ee6c2893c14be44cdc852a74429f24733bf3ce42248fce07
SSDEEP 192:4lPqCkyo8D+LIW673KGXGlDupfvnUSbOlHmWRWlpdkZA+cDbNGJpHIvdCQv++i3M:yPjJmZQEZyooJ
TLSH
T16302208408BE664BEF48A43192D60B633A7323F659373F3A06943EB4A526FDDC5C5C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 119f6419a9bab8cff434252a0eb0b0231ed04c6af54d2aba92ef54422724df25
MD5 d60e16ef05da29d0df5ffdbf3f041cbe
SHA1 e8b8404e2c558f654555a13a8067e26d6bb9c048
SHA512 0c08a2f5462dff55f3c48938fad965540f5078601fc2701466dd2464ccd7ab965956b20850598046f54d30e22033934cc5f441bc040c92a6aae9cc3360c6bb8b
SSDEEP 192:D2rDKIFhtQg8rspwSr65iaGDbzkXsAs3/QDJKjOKzSmYjLTTZOky6vJw2I8+YOxk:DChzHJH7v0
TLSH
T1F702DA8541B9769BEF48A47592D24E627A3372AB59373F7B02803EB41527FCDC285C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5932fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5932fd.TMP
Size 3KB
SHA256 2b1e5c52f896b27d6f69c7c5219d3c0b656e3e3f8e0cc6c3d0efe525f948c11a
MD5 515d0ba97a8ba8007d702a5b4b0708c8
SHA1 19ece51485dfb2b0d44df786e935d2394debde3d
SHA512 be64081b677f97841bea066274efbb8a67f95e92434e6e6b57c93b219a836a1014f51015fe76050867aa8d83aa126ffff2b969e4972ab15c54239168cfbed161
TLSH
T15D711ADE0131184FE75C317267E3A3A13C7187D97A337E6945E825FA1911F2DD094D16
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 198981452cab8b34a816a5cf19a6f7eb92d791c6146a03ee8f973cb064db7a3a
MD5 783233407f754a85ced6efbad5794156
SHA1 a96feb332891e27f760d4f5327dc6cd3208bc5af
SHA512 493caa5b9c177e8a692d796de336cad2c709305d781b2b9a7cde97a7ef7c18a167769fa3cc037140b47222ce10f65dd8d852f9e8f8b0d3f77712bcdb65b3bd17
SSDEEP 192:DG2MzjJGmL+hR8yIvAsVBDQw75ecSxKiUhqXv6wK2BYx5HxlVGnk:DxMz1GmL+hR8pvAsVBDQw75ecSxKiUgy
TLSH
T14CF1BFF3C7E5862DDD2152F0AA146E1BCE1C0925432C7D6AC5E4BE5BA3E2471E241B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 210B
SHA256 ed4b07933a1532510adbb743503e88e3cc293b1370633c82b66665577d059b3b
MD5 476129146101b50a5b7ba61b4457a662
SHA1 dd60ed910e30fa33772501fd7e5499ac3ddcdc51
SHA512 bff33d4937681d753e21ad5c1ca643a0b683c1b121eea3f929c15b5fabf09f654875e820c44ce08de26878b38e509d67d031888a3f2ec91ad39eee217ed3f680
TLSH
T12FD022E3122530B4A55D3E92806ABCCFC32B107048C2EEEA11D468AC06B796D1A0B186
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 821ab27fe2d953de3b0b78c92a08bd3af23e0aff51d0b2ef8985690d27655294
MD5 8e019378566890b574b05cfbb218a872
SHA1 fb2cd573e4cf68d91243d2af8d309a1d97a9e5cc
SHA512 de9929c652d7a98f9cd5031af804dcf2838445c432e9fa9000b02db0156f59a2aae8346560121ff71bdac0a50b9940b70871639185b214ab6c5d28985e9b41ee
TLSH
T192D022A3222130F5A5AC3E81916ABC8FC32B003008C2DEE711D8989C15B796D4A0B285
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58e4dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58e4dd.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 771fed5ae889835c74dcd5763350aab18c611c5a4a31a81c533bde11b497ff6f
MD5 e78244d0e6d362a2d05f4fd0f026cd0e
SHA1 c8e86f58d036ca9679438b6958fab6ed5c0cc558
SHA512 ae68c61803ba28b2727ac8e04ea5eb3777c23432a59c49c0072d6d45bd5353cb6b00bfaf830ea207fb7949724879289f85a302fc5f27be558b60e3c00665df68
SSDEEP 192:sxZWRSyM/jK1Ml8M8PP/f/sI73/IyrdpDlm/W6+WNX2V/Y0uBHOVZjIgrJ:sxZW0EPP/f/sI73/I0w/bw/5uw9
TLSH
T17B52F7116B34AA77CCCBD209F915BF53D6F90573A6910E54AAFCDA1C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 3bb80f7a499ec3f49d8ac2d3bf7829f91bb6348bcb5a6e7468cf36fc812c6b39
MD5 a20c0d5303fe823071be36ab201b26d0
SHA1 eb887e8f84d92b9ff4ffcd7c3bfe60f998123e06
SHA512 da09a8941c0b1340ef2395d88be805c27f1632c93119544493399ae6cd44654008563825a31518d25f2e79788dfc839c97fd94bef3b8cc52478e9ac948205e62
SSDEEP 384:sxZ3n70qtm4P/f/swf33I5TtTSJT+T6TMTXdffJTvF/bVJTf5uqLcY975:sv7jtm4P/fLf33I6q/bH5j5
TLSH
T130920752663099B7CDDBC519F825BF63E6F80423DD914F58AAFCD91C00EA6ED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 92051a0450b5f635f3b54c0bbd702bc91686b9a112a9e3b23e1c84419579b424
MD5 097ebc069d025d70b84e3723ba77ec30
SHA1 306fe4e698ea2006883a8b298d6692e8b11243f0
SHA512 dee0b9727e3a99d3de4cc3513f86920c2b11bc525c21db5303cadf1c6922ed8c765e6d5e3422d4832b1437cee76dfdb0a83fcbfbd5e7d01bd9b2e811e5cbacc9
SSDEEP 384:sxZ3n70Bm4P/f/swf33I5FnJAnhQdffo9d/bVJTf5uqLPY975:sv7wm4P/fLf33IbG/bH565
TLSH
T11892F65266309977CDDBD219F825BF63E6F80423DD814E58AAFCD91C00EA6ED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e49cccfcf58a3f625caba8bd2fb1368f6c8c81f0197e57542ff507ffa080a0a7
MD5 6f9cc26f2a2de3e5cc3ef149bc496099
SHA1 207a99cf0b38c2c26fbe4046ea6a465ccc1a8248
SHA512 bb0673bea359d7856496c7342c7ffd6e66869390b0346b3afdce344c542aebabab2701519782559fc9a3eec22f73bc5937ae9e755a4b5eb70227e7b77c8bbb7e
SSDEEP 384:sxZ3nN0Bm4P/f/swf34IKdhJrcCD889F2J/b9JP/5ufXVn75:svNwm4P/fLf34I8K/bL5G5
TLSH
T14382075266249A77CDDBD608F926BF63D6F80463DD814E5CA9FCD91C00EA6ED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 e92e97f89a6873a13971431004cdad129da3c93d6f57725f82e93190d8ed4cd0
MD5 cbbf37d64c0828ee2dba14ba13c3e4fe
SHA1 27b6bbde4e8b237fc6dbcf02536280a0eab63f65
SHA512 1c9145c6a981df60568cabf8ea236ce24ec48cb5c766cba5f64e9ee1891d550517db8a93664010edc66416c96d16b945dac83b00e5a2f36eac3eb692b1a37fb6
SSDEEP 768:Ab/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lswurox:Ab/Lh8dF2/kWRmAcQ3wu1jaKKjLp0DlX
TLSH
T12BE23A3B690CCB7E4F844EADEC266F976ED801CB96684D5447FA894C03C73EA411A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\83facec9-0843-46c0-8caf-89ceb43fda9f\index-dir\the-real-index
Size 3KB
SHA256 2691097d70828744023ffbbe1955a822c15bb77ee5fbd88c835fc6771aba7e0c
MD5 4309ffa5bcb8165d2e40b3c16db99ed3
SHA1 ef87ac61a253942e263b1b8674a6d73ee5c307f5
SHA512 9759f46f6212825cfcac7112dbc8b9d896f70dcdbc6938fbda9622cf4ec04f76f13231bb55258f54776fac3d174773b1a97d40c46e6062a6098b24ad5de2adb6
TLSH
T173513C4D4C421D5EC9AC01F22CFA2450777968DE9685DE0BA69CA0307CC333E1D55214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\83facec9-0843-46c0-8caf-89ceb43fda9f\index-dir\the-real-index
Size 1KB
SHA256 ada9a49b5e187cf0184a8005439c1533be4aed7b34622ebb3508d2ebf450ab74
MD5 7755f6f1673c339ee8a4f7d25d4e8042
SHA1 a07a8b939da55bfb00c3107d2d3f2ba4c1f2407b
SHA512 d186ab9c74e520d47f04501ed404f9acaac8d37bff7caab107a6410032fdf143ff8983917493e8a8c24b0d662b7b253c4c084ed99d9a94d50560d4fb456c6feb
TLSH
T1F831A5498D908D5BFC6406B115B26568327445CD1711A2238C2C3236BD5332A1ADF5EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589073.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\83facec9-0843-46c0-8caf-89ceb43fda9f\index-dir\the-real-index~RFe589073.TMP
Size 1KB
SHA256 9fc337cae4f0a4ffe601c2251b7fea21c5a435433efc4f1e50a97fb3b165545b
MD5 58df2882c6902d1ae49a7db2f8231f01
SHA1 1fd74b32c8ff10f83e336b1161332f771335bc97
SHA512 744693b5fc931717cc2fba77e34276377fcfc613762981e7bf90831bc13ca54d8d7d01da6ff2de1c54788d3a1049f78af717e8e0d74e6d902edaae5d8f165e0e
TLSH
T1C131774A4E958A1BF8C440770EE3E8B8333594404712B797947C5139FD65BBE1E4E0ED
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cb5b9c17-d98c-485e-8d33-0d4b0dcd5b1c\4f2277ea2139c475_0
Size 62KB
SHA256 d8de1fe9a9177daa6f949b718d5d6c2020a299184a6ce25b91c06fe606894687
MD5 d7b570b9972eceec8d209de35f09fd92
SHA1 2499fc43f879078a05f632c4d3359630723304fe
SHA512 b5781734898a7faa20e75cb40289e3b88d1c88520e267b57c8d0bac82b067b378555b2e1e1031cbdd32dcc67f1a73008f76eaeaa00f2b59524273dc9dd066bb7
SSDEEP 1536:cZq2Qj4JfCS+ksYyiApR+M0DpbarcjeUhxyCxY5HPwqpzG4/N:c4j48bC6Rx0DNDoJ/N
TLSH
T1CF533AA3A2626135C7AD21D1A49A7F01F11B17465444C9ECF0BD7A913B08E8B67B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cb5b9c17-d98c-485e-8d33-0d4b0dcd5b1c\index-dir\the-real-index
Size 72B
SHA256 ddda24a964e2ce5cf746136aa08014a2ae4fea796c013e7084ececa271d8f67c
MD5 73e4a5f00922f146032fed6abdfced82
SHA1 d31e21f19098f829ab212c386a9f5e977caf1bfc
SHA512 36f7451c3fa1ac89676810aecc28d90d815303726e3f24130f4e63e1099507c817b256da2adc771087c520b45ef75fe96db68a508862f1c7bf4e79bfa7c913ab
TLSH
T1B0A002B28594024AC1115AB0614305E6731BDC1E0246C3C58491845ACC535984E21455
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cb5b9c17-d98c-485e-8d33-0d4b0dcd5b1c\index-dir\the-real-index
Size 72B
SHA256 7a0caa1e6dd74683a592d5280390c3bbe79cc97cbd6e0d5c1b93984b1ab4a498
MD5 a9445058e4a49306e20c15aaee47b8b8
SHA1 a804ae99b90acb3714f5b87e4a82809c2febb0ef
SHA512 fb14ca646b7f770ba1ce18c89177e1a6d3ed2dfc2355b50cf5809726c74471578bbe8a1f8ab938e0740017cdf063ec1f066a2662c1a6ce69b521639167e2e89d
TLSH
T10FA002324199014DD44106B052464691633ADC5D11434705C5D0C45A8D515D94E76045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ec8fb1fc-b45a-46ea-bdc8-61944735ffe5\index-dir\the-real-index
Size 72B
SHA256 8256481e6174a7af32e32c51c68cfeec3166dfe02783596756ed7f07937c079e
MD5 2cbb6e4fcb8e9832193707553dd9da4f
SHA1 beb0c94247a6af238fcc73f1b85680306bedcaaf
SHA512 5d26d59271f1207516fa5b5ae35e9e0eafd65d9144caee5dee28673f973a78f4a32475cc4bf90636f37ab2b00df19c0e8530350c3817cbdc3878f91624efee9b
TLSH
T1F3A0026405DDC445C0948375179B9BC52A16481561F1428147B1A0F8EC986E656A6164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d96e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ec8fb1fc-b45a-46ea-bdc8-61944735ffe5\index-dir\the-real-index~RFe59d96e.TMP
Size 48B
SHA256 600bc46a22a12a51776eede119673ffd38bddd12a0ef381eb274cafaf6717167
MD5 ac38c08d1aa9ca237a3f4df07ac30e4a
SHA1 8db6123f189cc116bcb330f7e518262168b86266
SHA512 602815f99ea4e03f5a9373866fabd90127228884b7f073c53fc6d4d51338cb3a9c576b12235bc473f0e9839316aa8e730c78a80881b6c1ac7f27b0081a7ab8c4
MD5 SHA1 SHA512

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd93df7b-5d4c-401b-a994-7654540e6312\623cd082b6202da0_0
Size 62KB
SHA256 17e1d689d7a6be9be0658bc61a009fcf63a07b6af682c226eb583b1ffc8b664c
MD5 10354438158a894c98ee42c255d10c21
SHA1 7680b3c5df1f68ea05d9d8a3ec844993cff8658d
SHA512 435aabc3f3d3eb270944142e68c9a3cc42d42cdaa0b788cabbf9421878f60479be0f63c5b2f49823eee7d44d448d742f30252b2d7462347d50328dec1c301895
SSDEEP 1536:VT2MY4JfCS+ksYyiApR+M0Dpbarcj75+Y1jog5HPwqpzGZ/S:ZU48bC6Rx0DNDh0/S
TLSH
T1755339A7A162603587AC21D6A49A7F01F11B17561444C9ECF0BD7A913F08E8B67B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd93df7b-5d4c-401b-a994-7654540e6312\index-dir\the-real-index
Size 72B
SHA256 84266113138a6504a6a57e929929b2aaac934c6caae6d7b6d2cc810277682c9d
MD5 708501935f7cc2ce9244d322d5874ce6
SHA1 d221f5a015701ec53134cacbea2b04c7171314ac
SHA512 e8755d049b36c3cd6398251d076ecc807d0012f0efb02dc9d0e5c41bdf164570d78df5dd0a4eb7d740ff42a94063d6d78c7659558d55e9fc404f31a6b24cdd90
TLSH
T14EA002128BD14006C51221B196534346A300DD901500939740A10455CC659844D8200C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd93df7b-5d4c-401b-a994-7654540e6312\index-dir\the-real-index
Size 72B
SHA256 c8dbb3ee67a9e4b10b44aee2579840cb60808f10038c8086f263042182d6ce1d
MD5 fb266ab15689d0eb93503450a161103e
SHA1 44c1de17e21cbfde543426fc11953044ef6c1e5e
SHA512 34c1fd88fcbb82320c94cb0d7cc957dfa450bcdef596a6a5103083b4f8c6e4ae9c1fc3a9fddfeedd9085e41234896022527ddc0154352ab22d792b95af9a3822
TLSH
T16DA002924A800029C00F57B2359651837317D8290A62560545918098D9509944961C0E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd93df7b-5d4c-401b-a994-7654540e6312\index-dir\the-real-index
Size 72B
SHA256 8c17c5af1bc2c0eb051c7d14ab918a720b765caa4e3e50b18962321b7c2aee8b
MD5 8e9bd6f4f1b308a7a489f82a2cb656a5
SHA1 a4054f0eb895c4f7195a1e38d164ed595d492f4b
SHA512 0bd382050b2f5e2bc3f3baac93a34de7bdc46aa5589305d7097c188da51998714cd8bf008656d81640d487c42f1a346aa9c7f7d3493734092271a5faa455954e
TLSH
T126A00254A7803001C45212F266EA056733124A901211532D939140DCCCE2F95454140C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 9c1a92e6b6fd0a54b56bc5cc5958cc26c284d8384be8363887a74acc3e0f3363
MD5 fa3243130994c35eac24b3382c8ae192
SHA1 baa95cc913baf9eb1e4c4eb4f413061e948000b0
SHA512 ef90eeaacaf92575a1c26d72beecfa0257cf7b3fc34a20493e13a07a37ba570b371be125cc4d0d6f6523d98137619aefb5d7826b8576f65edee8e246ea65d44b
TLSH
T1CEF05CF77FF72804F8AFC3E968315020461578788552ED8F242BB9E641B23A9641DC63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 db9d4cae8304814e6521d04db344546ee4d298b7304ea7baf7efa7dc436410ac
MD5 2c9d1e5eb4cbeb04cba097b48abb3cc8
SHA1 07f895df0e17dc6745af2b29d9df9c4be2fe655b
SHA512 14d5fc969b1dae7e7847960742b70fe3c8decab2ed21caacf0738bd30649574fb7e01a898064f60d65643c3cd4d4fcf462c3139bf83ca0a772fa4a9aa9e8a930
TLSH
T186E0C0F63FF72804F8AFC3D62C309060454578788941FDCF145EAAD716723683816C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 f2b156600fba326a7b0e9683b5d0539cdc98ac6809363f54c5cf1d82974e8200
MD5 0a44de4583aa6e7f4badaa346f67d8ee
SHA1 2a40058c6c9ac21dbfbb2be8b9aaabfa8143bafa
SHA512 2e58f83e6bd0444a80007d230ea68a58bec3d4b6a968157c4ebca8543548d657fbe20979ee165882e8169cf6e0d6ee0772dfe9cccb1bf443c8852b233e43f571
TLSH
T1D3F054F77FF72C04F49FC3D66830505049157C648546ED8F141BB5E651B1359641DC52
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cf1f80f0c89a0d49715ebfeefba2e79bc0c21f8c3fd4fa2ae19490addc12e285
MD5 c2a0227ebb26c7ee050c90e3ba2f503e
SHA1 91f4069e0b907f27b21fa7ca0c277bb7521f7342
SHA512 2af669eb61c5fa1b0710272905bf023cb738c7dce779ae9666a3efa2d1449793d0ec349230c3e474c26bd59940b7268af3a3f61d238e79daa82fc2a0ce0024ba
TLSH
T1E4A00229EF6CA855C5041270906211ED7E20DC985686733159AD105488EA54045D6224
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e6c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e6c1.TMP
Size 48B
SHA256 26ed793cd17ed0ab135c3fc2bc4e270436081e4fb0345ed41993e58cf3d19e5c
MD5 c343e56bae31ef14340233a8212ee187
SHA1 57556f663ea9d18772c9bb73e5170d24679414b6
SHA512 2bf495f33da9b2d2bd90132f0ca0671860b60b5cf0b89b936a2cc5e32096efd6f61a88a427b527cbc769080ece85cf2fcd535940ca42d62220c879007580151c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 583fce668382cc5017a2d9e921a59fe3bea975c535c3cbf3f6ad3d29a5d88901
MD5 85bb47bd0a6a89baff545f33df7292f4
SHA1 002bef0940b6957a4eb29e9eb24f184a5611626c
SHA512 04ac02411bfe9800d5a1a460f0b0c976ef8af556a53e3d91066c9e1abbed2f91128a4c5d9f2773efcafbda98333ce48033271015aa53b350714d045008322059
SSDEEP 24:KdHfel8a5dttd4pl+QIjZdKiqhaXd1EPNSm3M7fiB4addRxh4VR+8IjNhKiehajJ:K08I/KFGsPUILKd68fyLkIbK56MJU
TLSH
T14F91E59631BA02123C7E250CA666977A1B42B3A73454ED2F3FB840B90E67E114EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c760d344-d7ee-4166-9522-71c4bddc8a74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c760d344-d7ee-4166-9522-71c4bddc8a74.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 43a92948c28f74ba9271583370efdd10f7bd352f937e2fc2b30a0a5b9700091e
MD5 f45a118f5bd2fee18b29062a5fbedb1b
SHA1 0d51a511691698726cc98f0ae66522c58550a92c
SHA512 f43e7694e7956e7f1584a16233cb72d75881e5e3ca02ad863fbaf6fea5a0fefaf2bfd6faf0d3ce6c77400c7eb582c9010c6539465388b7ebc0fdf80291d3164e
SSDEEP 384:bZcIH8NYE7TJ40HAp4xo0Fpt8ZvSYYfy6HlytEDq1HCU4:DH8frnbiFS/Koy6Dq94
TLSH
T1F5928D31487468379EFBB955F4863D175DF88127ABC86F84A4ECAB1D40EF2AC130B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d04b0d888501408551e88149f75bbe42283430bd1267cdb110de2bfec30454b7
MD5 becef50549507302eeed1269ddbc16e0
SHA1 953cfc925fbd418e53133f3831e68524746b1122
SHA512 bdc8646cfdcd44cff7a89a1894033437a7b0bb6e5b80e94fd322cf2c447c40045a4731fc457e364dc443fec1890a2223b4f890e316d04bc536fdb9626861a0e5
SSDEEP 384:ViF9wZcIz8Nn8TUNTUlIlY7TJ40HAp4S00Fpt8ZvSYGXfy6HlytEDq1HCU4:cFUzgwgGfcrbiFSXKoy6Dq94
TLSH
T118D217F248E74436DAAE5B47E77D3D124DBCC067B5846A90B3D85A1CCC9A1BFC30A810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 68985c6a7b12cf6f4e556ca509fc89532b34ef90e400f1cc7c12b44aba9cf8ac
MD5 c840d5d81d19d6f46ee6d02db5aca138
SHA1 cad4fedf8b0413d54f33af90ac8467b193befbdc
SHA512 8837d0c700633c7c58797e01e3f88f542605548e381397308044e35918f5500dd3bd290c85df61f1cb0fcfc435da99b347a84abff149b1b643f6a4f3abcb3fd3
SSDEEP 384:ViF9SZcIp8Nn8TUNTUlIlY7TJ40HAM4S00Fpt8ZvSYGQfy6HlytEDq1HCU4:cFWpgwgGfbrbiFSQKoy6Dq94
TLSH
T195D228F248E74436DAAE5B47E77D3D124DBCC067B5846A90B3D85A1CCC9A1BFC30A810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 43fa2c25bcd78480092092a54bfca6a82c0ef753a39c097d071deecf6f9c310d
MD5 4244985e46cf3d72334a6555a5259415
SHA1 a2d7d1196068a3019dda7450cafe816516177add
SHA512 cabfdb4350278d50e2452899b22ae068071ae3749eb99868637752ff4f0315daa65b98595aa7a4b4804c549c4c27576dcd51b84f1e3ccb21279d2db024303e12
SSDEEP 384:IJZcIM8NYE7TJ40HAp4Qo0Fpt8ZvSYYfy6HlytEDq1HCU4:iM8fWnbiFS/Koy6Dq94
TLSH
T15C929D31487458379EFBB955F48639175DF88127BBC86F84A5ECAB1D40DF2AC130B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c38208ed909aa3ced8ab510acd09b138ef05275c31c404534efebc5c0aa35981
MD5 d6e760b43f1733f27e3470ceb26eab23
SHA1 f206371322966d207436aff510df3b33913a0444
SHA512 d92f23cf55432d87d88af8839d5118b1ecca0c51aab436e2d17793c763582b9c3dbe09c37fb82ebdbbb288a9c44312dc0baacc28367477621a6e51be3825479f
SSDEEP 384:lZcIh8NYhrV40H94sN20Fpt8ZvSYYfy6HlytEDq1HCU4:dhpH7N1biFS/Koy6Dq94
TLSH
T1E7928D31487458379EF7A956F48A39175DF88127ABC86FC4A5ECAB1D40EF2A8130B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1cd1eb26a581d42b8048aaeaefa880b6dc47ba9e0401602a09ec17b9905b577e
MD5 4f665c94256c0edee219bc37db87e4c8
SHA1 a6ab15bd71b7f50a12b90b8d4a9bed7143b92f14
SHA512 fdfc25ac47232ba8c07ba8f88585d24b39b112fcb4402790c7cad1429908acddfce50b04dcdeee752cf8e793226739bcc52cbfac2d90ee0c8ba6bc2b559f08c0
SSDEEP 384:bZcIZ8NYE7TJ40HAg4Lo0Fpt8ZvSYYfy6HlytEDq1HCU4:DZ8fKnbiFS/Koy6Dq94
TLSH
T130929D31487468379EFBB955F4863D175DF88127ABC86F84A4ECAB1D41EF2A8130B425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 74693afda73c9005c495ab25d4dae857f28868d1c9c45bd9200de37e7e275ad9
MD5 bacdd6af48673b39df5c4db892c03000
SHA1 e5c2938fd53aaa8d882bd62464c41e5de77b075c
SHA512 a3a9f1950d82b7cff1764dbd3c5a813f19209e933213454dfb812691fd8d56d1ad65b5b4154db0fad6174fa610e9251ccfb1193f5fcef19598fdfc2ad29c0065
SSDEEP 384:ViFPZcI98NI8TUNTUlIlY7TJ40HAN4vo0Fpt8ZvSYyVfy6HlytEDq1HCU4:cFH9BwgGfLnbiFSpKoy6Dq94
TLSH
T1CDD228F248E74436DAAE5B47E77D3D124DBCC067B9846A90B3D85A1CCC9A1BFD30A810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a4689e20aaab145a3d6f818cedd72ccd048bbb7465b1e18226d6ef0fdfcd445b
MD5 5b909412fb907710fb67296a3b5dd87e
SHA1 42ab6a931678b195fdbb1c0fd385d0a1f64d525a
SHA512 4499344c7fc54a20d0ec45825df32a995f6c5c35b72a880675b3573a96dc274232a1d202cdc2879d4602b77defdbc41f1e21a65669d5e86b714d71cf8cccc488
SSDEEP 192:qGN+6d9402QmiUyKuvNTBF2oP18ZkowGwqurU6:qGN+6740ShuVTBFpt8Zvm5U6
TLSH
T1A402E8356C782CBB9FF36E46F4873B175ED5116BEA842B84D9E81B1C40DB29C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8848c650493bbea4ccb4515382bb64c70e35d684d442318e4d28f7f33a46e4b5
MD5 8b27bde4f5b09b407e6bc015cbc0aa37
SHA1 a77da101f4a61528ad4799b19ccdb2c610203830
SHA512 3fc8a3d21bf19a8533d0aa3f677bd23b1cc7342f17d7bf41c6281796e312566f93499d76754f7afd98f235411ff36da5dd94687b555baeb7809acf67c5f40b02
SSDEEP 192:UGNh6d940rQmiUyK+NsBF2oP18ZkoSY1xiD2qLyU6:UGNh6740dhUsBFpt8ZvSYGfyU6
TLSH
T12A121A3658786C3B5EE3AD55F48339135DF5822BEA857B80D5EC2B1C41EF39C130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d03f9a32a485850f8a713dbcad8d97367e1dc17bd51a9fdd69fdf9276480677
MD5 9a53df4b2ccd0ef93ccdfc62b0599fff
SHA1 2314b55e79d8887d63cc87da932622dbb76d0926
SHA512 5abbe0bba96bbc36e680f7fddda7077bb9a43d60d54895db98d021e02a7f2c885db7f901e2eeda75aabb525e27e95d8d7d30e34253d84c6e4bba6befd9e4ab08
TLSH
T10FE00913E31800FFC428033501C31A6076F7803403F7868A9E6016B838237106E61FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 93843ea20e5236127c09bed4f2501e4f0431dc8771c73eb8c8984ca61d8ed675
MD5 f1ba99b75b72459ce27aad7ca56d390c
SHA1 86bfc87f9869cdcdd0011ad9e0bd7de99a34a661
SHA512 d88c8ee3494575ce60c33487d375f075571359bc9bd215839d44a73355945f4767690abc93148f2185079806555970c1cea638afd4a48a89e174556d89e6f7cf
TLSH
T16EE00103A31400FFC028033500C31A6072F7803403B746894E5011B828137001E61BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2262e4f1a60b739ae4e0b06dffb8740ebb1e7f44fec76ba04ff0ec95e4eb7c4c
MD5 35582d801cc2fc6eafe4793ecf1877cb
SHA1 e9f1e63af5b0d265577313add0c31153c6c2558b
SHA512 ce2130a35d994f249fd6f91654a003428ab2134230edf26750aa193cb0f2412f68849f0daddeb84c7758db6e715bcbed03807ab775ee8d2adc8a3fdb93ae3507
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58b1d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b1d6.TMP
Size 392B
SHA256 82a7e571e67cc2c9aed71406b5c0ad8767f9c001ba264d27caf7bbbf51b1046e
MD5 f5e3a6e7749cfe8a0f3e2c3f246c9f5e
SHA1 97eec32b784d49a1ee729060c5f9aedc26d156c9
SHA512 0ec51a7d0b07d4d3997c38b77c2beccbe541e9f817f80798be170c887f00c4469e7c167c9a2f64f883afbbd97f1f77394a8b4bc202668212a731aab9cfe92609
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 32d4faec66b1784660e1f47ed5a534c0c52955f20e0f2aea51b17a153cb3bfd9
MD5 27b1f6ec129a3c2067b88b7cfa39a56a
SHA1 b7286d3d139f85fe2d6c90055d48405b6225dc55
SHA512 81e3a817fa11a5a5bf7ef230b72eb1abf4f7e8a52e4accaf69c134c92568387f9b9df6e679d3f08f012630e99390e95b53ae225ec721938d3a821572feb1335c
TLSH
T158D0112A32220238C82032330022B22C0800CB8F80AA8200A83A8AAEAE0C0B00E028C2
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 2071a101c5e5d5e43bccfbda492dca138aac8b52428691caacbbcfbb1b8d4749
MD5 9f0b1dfbd5ddbbf3d98bd2fee7c7be36
SHA1 9806142e89653cc616bbf95c6fc86b882a1f4ed8
SHA512 df7cf7227fbb05ef002605d62c47ed03c7bffc7cae092866219bc00c521afb0ae2e383c344ed855450e4ef1b749ed716d657826a17ac9c6d6e0380debaa6e1ea
SSDEEP 3:LstlNllkll/lfj7l/l:LsX3lEt7h/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 1KB
SHA256 b844f770265fed79fab0949ff288f3af6188ac4a20d4f18677704d6ba16ac452
MD5 cf85b59ca896f32e7bcbc27e07040abd
SHA1 bba315344e0f5985a7313efa6a54393e3ae17538
SHA512 9cdf34ed75fcf36de54b8e89aed8ca6d45ed057cefd44bcf3556661352704348dd8256cee17c06ea73290959b9d7b7c1a04a74cdcff5df95304af043c8e26afe
TLSH
T11231C7B1E5D47733AD855A45B6062A579D2110BAC2118F1472EE0F2C01C7AECE236C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 2KB
SHA256 8d5f07be41a0006c2c5e3c4be3a4fa80d97f8adb74ce2996e0dc7d564b7f3330
MD5 54fed101eb3182bdfd229c78efc53d6b
SHA1 5f0429b890f85aac68fa053639c1667ad9c3d6ba
SHA512 b33b138b6450fb95390e7b4882ec8422da38f421d3858b78a50ffc30cb59a168a3d55a8e4725b30359b0481cd8c5a3cdc15fabe8943e67ffc78b6c58c10add0e
TLSH
T15951BA72B958B7378ED64A54BD493F13DA3651B5D6522F60A6ED0F1C00CB69C2312C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 6a5ecf540699da51d17d109b96210b91ac001bef377b8b7fddda18a97441a582
MD5 df4343e88780cc3a1543e074ff165198
SHA1 391fcc18c22baf234f3c9d9d0c0445771eff7030
SHA512 c0e3a0c5932ba75809a05b678b273b991c77f9189b4532ec7f3efa4852243b9b8c3592f6b0b8e98e00bb6716f8ac9618155b3d6467e201cf26444a8ecd0bb066
TLSH
T13571C672A9A8F6374EE79A04B9852B16B6661177D1953FA4DAEC0F0C01CB3DC2352C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 4KB
SHA256 a419bbf62dca67890142eb6acd27b76bf66fa6c7af6acb69b22a31ed433caac8
MD5 6060cb3770a0e3914516ed087469596d
SHA1 242f1569cf9f6c22ade746ca8bdbc6b83ba0a53c
SHA512 b912c0fba9339065982596a15dd54e1c59b12347f6217419cb1cad6c4e396c19a2f8775f5717aa9bbe43659a7506d5fda2f6cceb424ae6fd5e50de8ebf1bf62a
SSDEEP 96:zuo+F3NkCEdfH9baYD58Frh/cInURoDotoTJbD3BHZX6vjZ0yTS6Ra:z5+F3NbC9NuooDU4txHZzqG
TLSH
T1F191C522A974AA378DE7DA44BA463F03A6655133D1963FA9D9EC0F0C01CB3DD1342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a5cf6.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State~RFe5a5cf6.TMP
Size 1KB
SHA256 39bf5427ac8ca05087381d420c528f694dbf02f92c22cf78412751718bf8a062
MD5 69744490cf1bed2f6cb1067de3c84bd4
SHA1 dd57189cc3d69467afc8304f38302eba038447a4
SHA512 b963f91bf0051ea417ba206aa125a788a532bb3f4f92af3d8010bade6f5b9fb36489971e19765d6a829ab4cff314fc91a2e2793d451cf01e5662480c39a1184c
TLSH
T15B21B7B2D4D87737AD850944B7023A4B5D1010AAC2109F18A1EE0B2C11C7AFDE333C3B
MD5 SHA1 SHA512 TLSH

Submit Download

7z2602-x64.exe.crdownload

Path C:\Users\Admin\Downloads\7z2602-x64.exe.crdownload
Size 1.6MB
SHA256 6745fa76dc2ea031596d8678f6f6b99c3c1b435b4164a63485adbbc7b8d82ef0
MD5 0617e5373e5e311fcb4bee506e046359
SHA1 b563e139acab81cc7ddf358bec6cee1e6b8b2b17
SHA512 85389eaef377aa9fef3155d2e3375c1fff77fc10e39d9312cab229f202f3aff78f6e807460cf6b04bc2a32f72f7853afbf475cf0dce6232a40c0a6f8ddcbe4da
SSDEEP 49152:L6Cx0Yr+pwKQtSzhTnSwIC4xQlMIUoks8KkE3XB1:L6ChSwbm4wIvxQlPkN76XB1
TLSH
T10D753302D1A0817DCDCBC871D6EC9E23E132B10DDB605E6BD266CCCEBA21A119EDDD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z2602-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\7z2602-x64.exe:Zone.Identifier
Size 978B
SHA256 72d86f21ae86f89dfdfc1ab5f28052427b882f7fe79684d7ad1022d035353d8b
MD5 0296b7441a890c9576e14f7e3b606902
SHA1 146b9b884ad3b0c17ea94963f27f0e802c93bae9
SHA512 183cd254f660bd85d027af4343cc0f259649e2ddd0b4a1c6eb735eab8d446480e29cb2bc9b3b5590d46d133c7bd31826e2f3b499cb70b4f3bd6b5fa79c93a399
TLSH
T1F11154F7C429EB0F1F0BB5A6598E8E8EA037F4DB8A850608519AD08DC1C027951C283F
MD5 SHA1 SHA512 TLSH

Submit Download

Cosmic.7z:Zone.Identifier

Path C:\Users\Admin\Downloads\Cosmic.7z:Zone.Identifier
Size 318B
SHA256 6f22ac274597b4aa558ffb74d2a9f57f58c241c82a892daec5c903958cbe3301
MD5 70407527033dabedfedf7485cc1cdf1d
SHA1 4f6d73e8665ec0977b058fb63c275bdbb4d7e2b6
SHA512 0f72a70e098fd6e88a97a141416969bfb23175f25cf919a52693c5af4656e5377151e4dab9549eeab433c50299ea449bdb63b209e03823a7844dbd147941f806
TLSH
T13FE07DFB4C10C154970D72C032A4EF4C712E5210DDD60914DD0590CCE4C496B8C81503
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 13.0MB
SHA256 d527cd3c5d7506571d5d6902cbf90015f05574a57d611b616052877957bcd659
MD5 d444176101c29a0b4a4edaee7215443a
SHA1 da4a9447fda68deaf9b4c57d2978d894804e2b0b
SHA512 185dbe780fe982009920c8a4050ca8f8ecbe1a87d1221dc8cd3df43c74e86436e7deee59c976ebbebd616656c2e5904aa3a9685d4241b4cf191a3b46f61edaad
SSDEEP 196608:MYBPWIdJg1wdZ/mwSSh48J3b8U16O5uJtmBd:NJXTg1smwS848Vb8BJABd
TLSH
T1F3D69D5AB2B800E8D4BBD178CA565617EBB1B41603709BDF17A046E61F63BE02F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier
Size 171B
SHA256 0e29d77b64c4390fa5538c61a43c1dced109573fba1b726edc66d653e4e99579
MD5 1b4564287aeb9a8e909c3729c9f766b5
SHA1 f177d3d9e8d92a20440c4f03ab3e69f2998f6b56
SHA512 08706c459f683a2d71cfd8598ae5229323b070823d1c7e0dad21452e2be184a1e1aa4057e4ca0ed90bd9030c41ac93a2ab9833201706c42cb66a4b5be18379e8
TLSH
T103C080E2864590E4354013D933EED5EC7707B545454DC7C0D4C4B097564456BB771952
MD5 SHA1 SHA512 TLSH

Submit Download

memory/228-2992-0x00007FF983850000-0x00007FF983851000-memory.dmp

Download

memory/2124-2893-0x00007FF983850000-0x00007FF983851000-memory.dmp

Download