Overview

overview

8

Static

static

1

sample.html

windows11-21h2-x64

8

sample.html

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    902s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/08/2026, 16:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sample.html
  • Size 60KB
  • Sample260810-tmw5cssera
  • SHA256 f4585cfd626bbe1810d00c559729a02cecd5057da74a52f1f200dce00c29e696
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffee486c188,0x7ffee486c194,0x7ffee486c1a0
      2⤵
        PID:1680
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,15476957910043779488,8159359190122287222,524288 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
        2⤵
        • System Time Discovery
        PID:3376
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,2284495348678161015,10715639005632245884,262144 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
        2⤵
          PID:1124
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,12543466872462834169,8695778339751248374,524288 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
          2⤵
            PID:1276
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,4097798007461967737,9440403483498265579,2097152 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
            2⤵
              PID:2964
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,13026023400893448530,10513513355396882045,2097152 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
              2⤵
                PID:4568
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,1242835874755044115,17113046251481041515,2097152 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
                2⤵
                  PID:1588
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,8605793535634088143,975599655998591461,2097152 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
                  2⤵
                    PID:2952
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,15061961881798492163,8337398350766863876,2097152 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
                    2⤵
                      PID:2688
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4272,i,7531066539730174137,12177581728965836399,2097152 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:9
                      2⤵
                        PID:1060
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,283668154244729312,2208171438920596491,524288 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
                        2⤵
                          PID:1272
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,4070957741250674023,5992673243886813484,524288 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
                          2⤵
                            PID:3056
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,17304631448167073125,11819932654695449827,524288 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
                            2⤵
                              PID:3556
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,17304631448167073125,11819932654695449827,524288 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
                              2⤵
                                PID:3500
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,625897182883348097,7735401112947196537,524288 --field-trial-handle=1720,i,4745819659306729516,7815418496926637086,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4996
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1128
                                  3⤵
                                    PID:1564
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                1⤵
                                  PID:1952
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                  1⤵
                                  • Enumerates system info in registry
                                  • Modifies data under HKEY_USERS
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of WriteProcessMemory
                                  PID:1128
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed43fc728,0x7ffed43fc734,0x7ffed43fc740
                                    2⤵
                                      PID:1992
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,12157305512064745218,5526390642720989745,262144 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
                                      2⤵
                                        PID:3068
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,16897434206065348055,11492899829941795489,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:11
                                        2⤵
                                        • System Time Discovery
                                        PID:564
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,13099091180503207961,15248161084745207048,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1848 /prefetch:13
                                        2⤵
                                          PID:4288
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,10948438227429812585,1330717761546786341,2097152 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:1
                                          2⤵
                                            PID:996
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,8884686612767380986,11514247331953252949,2097152 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
                                            2⤵
                                              PID:4976
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,2016650806385484425,16674813249105100543,2097152 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:9
                                              2⤵
                                                PID:4296
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,13208508173231294781,12260963986131578890,2097152 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
                                                2⤵
                                                  PID:2528
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,18157693655039306853,13601013354449948835,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:14
                                                  2⤵
                                                    PID:1908
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,15442768355465597781,1380223333811345690,2097152 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:1
                                                    2⤵
                                                      PID:4620
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4800,i,16129625036229885844,16166488436746375541,2097152 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:1
                                                      2⤵
                                                        PID:1432
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3336,i,3118603461714655844,788068192102681920,2097152 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
                                                        2⤵
                                                          PID:4200
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3620,i,8934599899704192552,3470732070950572174,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3632 /prefetch:14
                                                          2⤵
                                                            PID:2760
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,16908174621037582365,17681432216329873631,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3628 /prefetch:14
                                                            2⤵
                                                              PID:4044
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,1516895290164449746,4538732040113659053,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3640 /prefetch:14
                                                              2⤵
                                                                PID:2456
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,7535358491096745981,7754589890820090142,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:12
                                                                2⤵
                                                                  PID:1732
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,4679335921379157085,8305543004136462090,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6120 /prefetch:14
                                                                  2⤵
                                                                  • Modifies registry class
                                                                  PID:4196
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4780,i,10320993141545301640,7961513636986923268,2097152 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3704 /prefetch:1
                                                                  2⤵
                                                                    PID:3452
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4900,i,7409574208242922337,9515453801428472158,262144 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3624 /prefetch:10
                                                                    2⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4100
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4408,i,572945103549086108,11998151705645087196,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5220 /prefetch:14
                                                                    2⤵
                                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                    • NTFS ADS
                                                                    PID:924
                                                                  • C:\Users\Admin\Downloads\RobloxPlayerInstaller-CPG8CGRKVC.exe
                                                                    "C:\Users\Admin\Downloads\RobloxPlayerInstaller-CPG8CGRKVC.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Drops file in Program Files directory
                                                                    • Enumerates system info in registry
                                                                    • Modifies Internet Explorer settings
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1044
                                                                    • C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
                                                                      "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -personalizedToken CPG8CGRKVC --deeplink https://www.roblox.com/games/4924922222/Brookhaven-RP --webBtid 1786378330357012 --downloadSource web_game_join --authenticationTicket mJwC423Kq3t668XP027XS6WThuG4oyhAquKeLArH2GLXr8-0VYroKS1pb7ppHefgf4ErgUaOujVioX-QznSHX8cBbvQiMS-TlZM5vAC0cRMIKeoHkxK5CYLhx6umqnSDKhDAJqhwCAFUTTH2rbH1XuPWUW8EKStnbNuM1buGq3n-ZrJSX_RGhlVLCGUv8pwqwWvT8YoemJCQ5_g9Qdlklxj-CaNBfmXLpZs0oVXYYcYKTEwO1QU_tZKnJLQeqPauxi8wAAP0XGi7o79_jskeRknggqXkpUdbg6CUKBDmJMpznecann2KVL19QQcemEtaxqb0uJMkiEMozxId0KUTLGthFzFCmMkmIZ5GpIecJC5Wf6qkTaQd2Y3l_XHRmtKGtXYI9SsJFPMRAJuMRIG0Mtt0jncBbzdQ2zcpwZqVsXqxT9XddlmRL0hSjdJ8u15el3EgWmsNSLEDoz90XiDufedhE7m5kGqJU--fhbn1mP_YBot4BuLl1YS-Ql415gQ18YP8XQ3BIpP3nMbq9EWvN1ovCszxyr03SyMHzLBOtiM -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1044
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3972
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,7546477001730037732,3296340673153692543,524288 --field-trial-handle=1960,i,8509168974015104506,5185352938401465232,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:14
                                                                    2⤵
                                                                      PID:960
                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                    1⤵
                                                                      PID:1732
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                      1⤵
                                                                        PID:4612
                                                                      • C:\Windows\system32\sihost.exe
                                                                        sihost.exe
                                                                        1⤵
                                                                          PID:1704
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                            2⤵
                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                            • Enumerates connected drives
                                                                            • Checks SCSI registry key(s)
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of SendNotifyMessage
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1388
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3780
                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                          1⤵
                                                                          • Enumerates system info in registry
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3752

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v16

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              RobloxStudioInstaller.exe
                                                                              • Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
                                                                              • Size 9.7MB
                                                                              • SHA256 eea5136d2e39678414ffacd6b0cd17d827b94ca5e09e9468a07da262ccbf226b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              RobloxPlayerBeta.dll
                                                                              • Path C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.dll
                                                                              • Size 22.1MB
                                                                              • SHA256 6ee5053665a3d722337d0e14becbb614b603b19d952538e3eb9ba6b76cef2ee8
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              BrowsingTopicsState
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                              • Size 414B
                                                                              • SHA256 f2776188556eb221446deeb1f5fa0daf5aedfdb4445e51c3d81c9b6d9c164d3e
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              f_00010a
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00010a
                                                                              • Size 51KB
                                                                              • SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              temp-index
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                              • Size 2KB
                                                                              • SHA256 397bdebdf27524701a48eebbed6ba918ce2069a927a6ed82adc0b233809be55a
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              the-real-index
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                              • Size 4KB
                                                                              • SHA256 12bbc9f4dc209673e6cf0b2932712e62b0476b3587d00e6953ea7b2f7218ed9e
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              000004.log
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000004.log
                                                                              • Size 100KB
                                                                              • SHA256 bdc7351bfe1f719e0e4cd5e0556ad3505013d09fb175da7a481725ddbb701fe6
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              000005.ldb
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
                                                                              • Size 1KB
                                                                              • SHA256 dc3530bfe54343283c68a0c7e3eba93c7213652d8bed5e55615f4398dd818cae
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              CURRENT
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
                                                                              • Size 16B
                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              LOG
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
                                                                              • Size 669B
                                                                              • SHA256 eb02ea5d199e90bbeabc00dea810e7e77e829c436bc29cad8cfd2848b6bd0d6b
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              MANIFEST-000001
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                              • Size 100B
                                                                              • SHA256 7d830ca884f68a50b9c0df7ed54adbc5189579bf2494ada85929dc2c1f9c5166
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              MANIFEST-000001
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                              • Size 23B
                                                                              • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                              • Size 2KB
                                                                              • SHA256 cf6f56632d8baec0116c3c0211693978311588cfad0c079c814544c9a3444858
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                              • Size 8KB
                                                                              • SHA256 a1a14474ca130bec9d06fee41d4bedf85a17eb9a44aa3832bb1168c1c1459718
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                              • Size 9KB
                                                                              • SHA256 3748b0684ebb2eaaf306ba9e9c35b723cc5e9eae81657239674efefe5b80e317
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                              • Size 5KB
                                                                              • SHA256 e73566d645cc478223bf1c99924d982ec8aab5a1de47c92ee82b26ba54fa7e00
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              TransportSecurity
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                              • Size 4KB
                                                                              • SHA256 dbb54b73aa2ee496f98f99a3ebc05828d0df4970fcce4876527f22ae77d6c7ef
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 559806e3beabdea2aa08de09f307c0684205f4f8dc521282d76938d85c052691
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 12KB
                                                                              • SHA256 d81bbdf702ae2f8f6770dcfd6e8bf0b22bd98c4847ca5bf9744a878e878cac50
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 4687357b441e1d07af3b5ae11f97b11bfd3881163a087bfd6046a48c3518816a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 b5e9aa9a21f0589edc5aec637d7405e94bec0e3176c78ed143540630d3138dd6
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 1ce4b84ed49d4ba079ed0c313d7cca9628f8ac0c6cbefe83d1fb755b7b652349
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 b9c93d72559fd5db61238c56fcd79fe45d2fc30a23253cff43875527c24b45df
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 94117ffe68479b0d4a8d677cf2054367ee2e8f5912b1d03e8cab284c03ab2eff
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 1bc8bd8c98b8d9f0f9dd807aa96f8385972bad36baa692e993daf76dafde8893
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Secure Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                              • Size 17KB
                                                                              • SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              the-real-index
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                              • Size 120B
                                                                              • SHA256 0f5776bb17ee0c7b3b9f639685a3216dba8d71eb2160572846f271b462c57f3a
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              the-real-index~RFe58c80e.TMP
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c80e.TMP
                                                                              • Size 96B
                                                                              • SHA256 ff3e79fc89d7c7b3023096566a162ac3bb4d91e67d61463396b42a0135ee258d
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 236KB
                                                                              • SHA256 5324195fa902e1216e494a8a1d0023a26ce0c82d4c118030cf88cb392f8b7494
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 235KB
                                                                              • SHA256 543f985103d893ffd376f81dda201802510afb5d675b6b38955bef1e15d3af85
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 236KB
                                                                              • SHA256 9c8e3018f76c8d894ef2cf4d2f25e03fe1c1a535345c86a0481d50fff5fe6b9b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 115KB
                                                                              • SHA256 2e69e2097b2efe64515bff086506d304948eee9a010478dd5437b5fcedbc010c
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 235KB
                                                                              • SHA256 7bef8083a7115cce431d746615aa3d4bd0bd02dd56618e635f09ebed267e6131
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              blocklist
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                              • Size 105KB
                                                                              • SHA256 0f6e8797ec44866b70bb772777fccc9be92e480a6a74d7167030771d5c750125
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              settings.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                              • Size 280B
                                                                              • SHA256 857bab2335a4b224194b39d52f3f99f79d132e2f92be9ee918b3196cc99f64bc
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              settings.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                              • Size 280B
                                                                              • SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              settings.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                              • Size 280B
                                                                              • SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              01ebea98-7d94-48af-9edf-8436754d3cd3.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01ebea98-7d94-48af-9edf-8436754d3cd3.tmp
                                                                              • Size 6B
                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              the-real-index
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                              • Size 3KB
                                                                              • SHA256 c44a84e67b55d005945af69c21284337205959a5e3fbe005f6ad980b218054d6
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              the-real-index~RFe5864b0.TMP
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5864b0.TMP
                                                                              • Size 3KB
                                                                              • SHA256 b92d0e52563639a2ecc7c8247f41cc368afa3e7657561b478d24f4003fc86a4c
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              data_1
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                              • Size 264KB
                                                                              • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              SiteList-Enterprise.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                              • Size 2B
                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Edge Profile.ico
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                              • Size 70KB
                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                              • Size 2KB
                                                                              • SHA256 c2a26ad5e3ce213724a85670e1cfc8a31d7ab7140608e307136044be4109839f
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                              • Size 111B
                                                                              • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              SCT Auditing Pending Reports
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                              • Size 2B
                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 12KB
                                                                              • SHA256 12a52f78267054e7bff2ee9dd19408f7da44cb3ee8e7738213756f188e4914bb
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 401983ab4375638a19d785c6810267215a280f39d3b24c529173adf6bdbe6376
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Secure Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                              • Size 31KB
                                                                              • SHA256 b731fe093cc7eed7f35335a5a0600fc3d672bb2fdc36facbc1f9c4180f6225d7
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              sync_diagnostic.log
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                              • Size 4KB
                                                                              • SHA256 97d804520e5cad8ef4f3b79001fc62c59990a49ae62be215802c549aa8d6f86c
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 16KB
                                                                              • SHA256 ff0b4554e735d846a014edf9bdb54c6cd379c742c3459b95aa36fb34789a429e
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 21KB
                                                                              • SHA256 656f2062e9e220c799bcb63762c70a89ceff02997c24ba93115f3cfc16d6c03d
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 8KB
                                                                              • SHA256 20aac60db102570b87c7cbc58e5310c3dc6910a182e5ce9d2a1b99323bf40346
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 8KB
                                                                              • SHA256 2dd05f1c97840bd0ee70b94b9605ad77b0b54a652493e763d1949bba7fd62707
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              AppCache134308521872579111.txt
                                                                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134308521872579111.txt
                                                                              • Size 84KB
                                                                              • SHA256 e19fb8300550a9f20c4fd8bc2c5e3fbb217e0c8b10ef28f73709c1ec3229441c
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              default.dic
                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                              • Size 2B
                                                                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Roblox Player.lnk
                                                                              • Path C:\Users\Admin\Desktop\Roblox Player.lnk
                                                                              • Size 1KB
                                                                              • SHA256 2f78a0c4f179665415dc0d263991f6279fc9ef1cd1d90dbf9407ea88d18d2e1a
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              Roblox Studio.lnk
                                                                              • Path C:\Users\Admin\Desktop\Roblox Studio.lnk
                                                                              • Size 1KB
                                                                              • SHA256 8d99df2bbfcd95d29733ffdf578bf8fc84e6476f19b43ffcaa58f55804c00ef8
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              RobloxPlayerInstaller-CPG8CGRKVC.exe
                                                                              • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-CPG8CGRKVC.exe
                                                                              • Size 13.0MB
                                                                              • SHA256 d527cd3c5d7506571d5d6902cbf90015f05574a57d611b616052877957bcd659
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              RobloxPlayerInstaller-CPG8CGRKVC.exe:Zone.Identifier
                                                                              • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-CPG8CGRKVC.exe:Zone.Identifier
                                                                              • Size 91B
                                                                              • SHA256 d05f01dac742119e918d53a3104f02530b8516d4eaf539b3ae13aec1b4a4da5a
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              memory/3752-2011-0x000001FDBABA0000-0x000001FDBABC0000-memory.dmp
                                                                              Download

                                                                              memory/3752-2013-0x000001FDB9F90000-0x000001FDB9FB0000-memory.dmp
                                                                              Download

                                                                              memory/3752-2091-0x000001FDBBEE0000-0x000001FDBBFE0000-memory.dmp
                                                                              Download

                                                                              memory/3752-1980-0x000001FD86700000-0x000001FD86800000-memory.dmp
                                                                              Download