hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
98s
max time network
112s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://google.com
Sample260826-dasy6syscy

Score

8^/10

bootkit discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
173	2840	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
5316	Robux Generator.exe
5416	Robux Generator.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
171	raw.githubusercontent.com
172	raw.githubusercontent.com
173	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Robux Generator.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Robux Generator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Robux Generator.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321861329690448"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{410C2B56-99B8-4179-9A3B-D541654B2DFC}	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5416	Robux Generator.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5416	Robux Generator.exe
Token: SeShutdownPrivilege	5416	Robux Generator.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4668	4208	msedge.exe	84
PID 4208 wrote to memory of 2840	4208	msedge.exe	85
PID 4208 wrote to memory of 3328	4208	msedge.exe	86
PID 4208 wrote to memory of 3328	4208	msedge.exe	86
PID 4208 wrote to memory of 3328	4208	msedge.exe	86
PID 4208 wrote to memory of 4184	4208	msedge.exe	88
PID 4208 wrote to memory of 4184	4208	msedge.exe	88
PID 4208 wrote to memory of 4268	4208	msedge.exe	89
PID 4208 wrote to memory of 4268	4208	msedge.exe	89
PID 4208 wrote to memory of 3424	4208	msedge.exe	90
PID 4208 wrote to memory of 4268	4208	msedge.exe	89
PID 4208 wrote to memory of 3424	4208	msedge.exe	90
PID 4208 wrote to memory of 3424	4208	msedge.exe	90
PID 4208 wrote to memory of 4504	4208	msedge.exe	91
PID 4208 wrote to memory of 3808	4208	msedge.exe	92
PID 4208 wrote to memory of 4504	4208	msedge.exe	91
PID 4208 wrote to memory of 4504	4208	msedge.exe	91
PID 4208 wrote to memory of 3808	4208	msedge.exe	92
PID 4208 wrote to memory of 3808	4208	msedge.exe	92
PID 4208 wrote to memory of 3720	4208	msedge.exe	95
PID 4208 wrote to memory of 3720	4208	msedge.exe	95
PID 4208 wrote to memory of 3720	4208	msedge.exe	95
PID 4208 wrote to memory of 2252	4208	msedge.exe	97
PID 4208 wrote to memory of 1140	4208	msedge.exe	98
PID 4208 wrote to memory of 2252	4208	msedge.exe	97
PID 4208 wrote to memory of 1140	4208	msedge.exe	98
PID 4208 wrote to memory of 3004	4208	msedge.exe	100
PID 4208 wrote to memory of 3268	4208	msedge.exe	103
PID 4208 wrote to memory of 3268	4208	msedge.exe	103
PID 4208 wrote to memory of 372	4208	msedge.exe	109
PID 4208 wrote to memory of 372	4208	msedge.exe	109
PID 4208 wrote to memory of 372	4208	msedge.exe	109
PID 4208 wrote to memory of 3716	4208	msedge.exe	110
PID 4208 wrote to memory of 3716	4208	msedge.exe	110
PID 4208 wrote to memory of 3716	4208	msedge.exe	110
PID 4208 wrote to memory of 3424	4208	msedge.exe	113
PID 4208 wrote to memory of 3424	4208	msedge.exe	113
PID 4208 wrote to memory of 3424	4208	msedge.exe	113
PID 4208 wrote to memory of 2300	4208	msedge.exe	114
PID 4208 wrote to memory of 2300	4208	msedge.exe	114
PID 4208 wrote to memory of 2300	4208	msedge.exe	114
PID 4208 wrote to memory of 5588	4208	msedge.exe	116
PID 4208 wrote to memory of 5596	4208	msedge.exe	117
PID 4208 wrote to memory of 5604	4208	msedge.exe	118
PID 4208 wrote to memory of 6132	4208	msedge.exe	119
PID 4208 wrote to memory of 6132	4208	msedge.exe	119
PID 4208 wrote to memory of 6140	4208	msedge.exe	120
PID 4208 wrote to memory of 6140	4208	msedge.exe	120
PID 4208 wrote to memory of 6140	4208	msedge.exe	120
PID 4208 wrote to memory of 2196	4208	msedge.exe	121
PID 4208 wrote to memory of 2368	4208	msedge.exe	122
PID 4208 wrote to memory of 2368	4208	msedge.exe	122
PID 4208 wrote to memory of 5316	4208	msedge.exe	123
PID 4208 wrote to memory of 5416	4208	msedge.exe	125
PID 4208 wrote to memory of 5028	4208	msedge.exe	126
PID 4208 wrote to memory of 5028	4208	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff9e16fc188,0x7ff9e16fc194,0x7ff9e16fc1a0
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,15433603646068073700,10864307780137190571,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,7646456694401356890,14238798746697335906,262144 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,12145261991952747785,2992812676067371536,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11279745038737715124,7588432045392112688,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,5387413086951999732,8909552357715865519,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,5838376653849563878,13355996572410146073,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14245334464984019131,8124506469613321717,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3476,i,9695176190402934171,5252071423539204157,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,13182401693661336644,14149744120231343244,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,7897886776645663160,7710306516653603505,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,7646421704330518771,16816804223910795977,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,7646421704330518771,16816804223910795977,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,8292096652040983411,304564804570988019,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4760,i,2634089800194845532,12625874495773892230,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6420,i,7012535927630926096,12233526300577210346,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6532,i,10493843680509133992,16624412254690048213,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4828,i,12479239257977100022,11875257312153929080,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,6816324054223185902,7006887308819652680,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,5840348101046317331,2428650668442856326,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,4609884840474473145,15117688668771816140,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,7819534303907851958,6189208554294582702,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6868,i,4185071847584021071,7410167779904163286,2097152 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,10395093739279015396,13620385542949325638,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,10571953325211932575,11401308953010289696,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:8
  2⤵
  PID:2368
- C:\Users\Admin\Downloads\Robux Generator.exe
  "C:\Users\Admin\Downloads\Robux Generator.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5316
- C:\Users\Admin\Downloads\Robux Generator.exe
  "C:\Users\Admin\Downloads\Robux Generator.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,17468053347575701527,3402415489183861374,524288 --field-trial-handle=1976,i,11844497833707150962,9397956302980402613,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:8
  2⤵
  PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5ff05a621df8df05426fbba3639de62cbb6d573187a90f20bc797fdbe4b71bf
MD5 c23168c2b4dd096d77fb57bb53393a90
SHA1 0038662e136abcde2c29c9d3d3c3bf2dbb11d164
SHA512 7ee97c45aa94467885b8aa2145e0879de4ec2397c36198ceede5ec06664080ad500e1a9d62566de09c10902658158cd7d9f529ec85a76fea0c32eb7ae7182b5f
TLSH
T1E0D09B2036CD5443C59133B398455F45165D59681556D242A434514CDAA6044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 30e50a9e67b30496bf36fcdee67d0a13fd4365260aa4c9f514687a6d703a6c6e
MD5 563dd628786b2c71d63483226499eb63
SHA1 faeb775b02398a6b37d9735fa27c0541cd2dff56
SHA512 db7c43ba907cdd269a63bc9689114f6e7f8ebc7870634bebe8e09d3c71b5ddf538489d96d69db5133b05ed87803e61423ae7a15dbc4cfed35a256d52fecae3ec
SSDEEP 96:xYdxz2CJJt7HrFSm+43M3rH+FYYk0AOrArtKYjD1auHo:ep2IJtPj3oT+el9RjRa2o
TLSH
T15BF13948405D04E8CF29CE7B70D805B930B23A37FB439E658915493CFA2A3F1519BE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ef6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ef6c.TMP
Size 3KB
SHA256 852945505e142fcae0cd2c8903b75313454d6c34dffc76e98f3fb05f467270f0
MD5 409ea1d17fd444fdbc485dbc620237bc
SHA1 e4d6d8f9a70eb156f13884cb59fe16d87e02c741
SHA512 f5ba1651fa95a10db39e419ccf91367eed6d8d5ca1cfda4d1ea18c13d0e0d3c5d773d1d4653a1600b886073b7f7540f1bed5ee04fbacafb6d027f04ab9a84103
TLSH
T11C717E08046505FDD7BAC13B70DA02A934714FB57BA3EEA45C249471361FBD661EE28F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fdbd19d72ab17e9357ebeca1fc791455901d5eb54fde40829ae511663ab61644
MD5 69c9fe4fa36510748e0249eb0582e3c3
SHA1 2c1f00c6e3db8307fc4b0fb81f714bf9ac53bc53
SHA512 f4bdb89117e9ca3679b0b241c57e10d87fa108f16f220a35ca5d11a172abc1ca64db8ea302b9ddd29172968e029b9643073caa201861785d345f999180056454
TLSH
T15FD022333608B0FAE6AC3E8590FEEC8FC32700204843EDED10D0B89815318AC0A0F362
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58bb5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58bb5c.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3a0ce9ac237a72521cc234368ac5d676cbe41a184306e43f9fb70acfac587806
MD5 b64f419f3fbd5224cbf8f153e72da227
SHA1 4ae276a72a1d7c17bf80fed55f7c6c2898a33f1e
SHA512 75399697f3995eb912aa0a795394bad4af0d50cf60b4d9fbd0c196077651d6c797e0ddef20d38ce2a52f02a93f768b207bc39aa0002769ca6d58fe39cf54d81a
SSDEEP 192:sxZ46RDkX/f4sE+tXIdpqTPHW6+WNrcc1/Y4LiyNIgrJ:sxZ46+X/f4sE+t4+HbN/F9
TLSH
T1C122A712AB38A97B8CC7D219FB55BF13D6F95432A1D01E48A6FC951C05E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eb2e322055ccb62ecd05e7a6462df4ac4b95377b0d7ef87a05aa1d6182ba4f0a
MD5 14d10e325097219583c514c89e4dd8e2
SHA1 d50f974f193edc8cc1b148b377a9e894e5838a1a
SHA512 6f6b0de4332a71dfc1be55bc25200d6bd5c605247f9d29bb99f62d74dba069ba4246d31db2e9979251cc82d63fc1ea6b2201743ad760a973e2a4c80ab2dc1265
SSDEEP 192:sxZ4hRD0cBzX/f4smpGurdp90HuSgPHW6+WNBRRe+cc1/Y4YGyNIg5e8/sJs:sxZ4hmmzX/f4smpGuHpHbI8/Gl/Qs
TLSH
T19952A6529A24D9778CC7D619FF75BF17E7F5042299814E8CAAFCC91C01DA6ED220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e66ea9fe567173f8c6726f4f020026415a8bb469d2c2a9b59a08f5837e067d56
MD5 f0877768f85b8af80b8ed72ef8efc180
SHA1 da96e2b8de093765bd20664f7fbdc623b50faeff
SHA512 6bea4dcf1cfdc0c9a248ffa5a39b9899d26101bb889b5dd3ac71066d96e56e2f1c0ff5c364fa8c5682471b6ba600a9a3f6988cae27f578b39a35a457e25fbf7e
SSDEEP 192:sxZ46RD0cBzX/f4sm+1urdpT4u8PHW6+WNBRRe+cc1/Y4KiyNIg5eJ:sxZ46mmzX/f4sm+1uHqHbI8/Gk
TLSH
T18432C952AB38A97B8CC7D219FB55BF13E6F5443291D01E48A6FC9A1C05E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 790d9a7337e031c57ad9aefcf49e4e70d3cd91ad50e74997f690b2967603fcd2
MD5 8d67e2c19cf190bf31b11d166242e554
SHA1 806130521eff9f51258b0b676c33c3c410aae945
SHA512 baa06b95af2fbc6a9f7fce0420d1a621112f93499e0dd4dc688ea3bf8ce69174a4a423437c7c589c7c1155ef7fa238b8ee2dabe493ef7bc343bfa614ff7a5747
SSDEEP 192:sxZ4hRD0cBWX/f4smpGurdp90HuSgPHW6+WNBr5OHRe+cc1/Y4ExFyNIg5e8/sJs:sxZ4hmmWX/f4smpGuHpHbO88/bd/Qs
TLSH
T1F06296529A24D9778CC7D519FF75BF17E7F5042298815E8CAAFCC92C01DA6ED220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5ac6840523c4a328147addf12c9aa16ae5c6e6d5acdc8a379a2977fd2e0351d1
MD5 86ac310ff29c1071ce8fe810aef95833
SHA1 028a188684d0389b6be00c055de4366cfdb85f8e
SHA512 84a726e4dd6df6cbb30b84f19dc4c7dd01fb56a243581072c597baf1bebd30c08210f10ce4d0e2d20a3e62b85dc67aea98927b260179572cf2ad03f157e0b0da
SSDEEP 768:A0qPALKWvWep58F1+UoAYDCx9Tuqh0VfUC9xbog/OVqqLlBHu7Prou7q:A0qPALKWvWep5u1jaHqLXO7cuq
TLSH
T149C2E92B644CCB7E4FC00A9DEC5A6F972E9802C7A7588D4047FA954C02D77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d9e66d3fc97ac6e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\4d9e66d3fc97ac6e_0
Size 191KB
SHA256 21abc1f9555f415dd29c6e32eb49af9fbb4f86a700bf8d85ded14e89a20f1016
MD5 e8b60450764f055e697de77eeea2123d
SHA1 4dccb73bb68ba859ab4348f8c80d94444b3cf582
SHA512 92d3c1ed1eab6d9fa393df73465278cd7b5bea62029efc1d5d79345e2bf2dbf5719de7e64dac51f678ae89c77ab3546d83d488d646a35467882d2b529795d1a3
SSDEEP 1536:ko/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:ZSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T19A146B715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b04640c97180d68ff530964bf96b84f9ddb450f982ab9e1d35ac134dc6486925
MD5 ccc82dc4f4c098df7d26ae986aba757f
SHA1 8c599933ac85d08bf5c7052724478bf2a4f0d459
SHA512 e96a62e76c551cdfc151c71911c60924ec7e003d13f52c84894c50f1060314fd9f734eaaff8daf0ae9188d77a7eec488da715788504bd77af159ac92659d0cdc
TLSH
T106A0025507D20C02EA00BEB154A5478023904D1189A18203F0980949DC772A04A56532
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 459f72b2e07446ec91caa3b88d0f68295aac88b9291fa6ae3e8c743fdd89d8fd
MD5 d5969de062ead2e0a6519e2e29ef2a14
SHA1 a6b585209fa92a07bea2fb3665f67f8847ad19bf
SHA512 4423e0aa65f52f6d3bf178062f3e1b4a68693851bb10c8b9001d7ecbf675407d792dc6326c67fed3d9857b1ffc1914eda420cd39caf95d07c224651258ff4a4c
SSDEEP 48:Ko7IVKQ8w/yInYnDn0n4nmnunun+4n+nBnlIPnYn+KOnLWnyn+qnAnuJnZninF5G:Ko7mKQ8qetuKu0N5OKCgyuU
TLSH
T1FA91D221727A06012C7F6908A3D5AB374E4336B77019F66F3BAD08619E6AE101CFD6CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7760898b3de66dce3c1bee1e0bf4c09a1b0c70d1755aec04d2998b9544221df0
MD5 9cdee60e5f440f1e46930a4d35cbee40
SHA1 39b93fbdc90b6b0da6533a0c6653f8ff39e86c83
SHA512 165c9e76b4af923558b800934683c0b921ff2dda48eb782f811f934fac428fd004a4e3c186d7a55a6341f58891d4c4e9735b47d8a40af457160ab9a4b290607f
SSDEEP 192:mONcD6rvoQmiUy7K2DrKhD4XqMB/1jpjzoS+OExj+dU6:mONe6co+6Xq6Ln+XCU6
TLSH
T1D702D935A878AC779EF7AE09F48637135FE4202B9A856B84DAF81A1C01D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 59652d1be576e5d51eff77fa9884b8dab484816f0bc5a8d735a1723defe702df
MD5 7d8024bdcfd49eed9a1992f77ffb04ca
SHA1 8a545b58d5b0ed27e1ff3a78e74bda12d20fbeb3
SHA512 abf3bd4058f1870d722290a02da8aa801804bd61cc78f2cfed16c838930fd3d9afe433205bad42bd2c4851ba25c37337fdda3fd61a98541742a98bae351287fe
SSDEEP 192:jONL6rvbQmiUyx2DrhD4XqMB/1jpjzoS+wXuFgICjjqvnU6:jONL6xtr6Xq6Ln+wXyeUU6
TLSH
T1DA12F932A468EC3B9DE2A545F08736135EA55127DB887FD0D6EC2A1C01EF66C530ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6989509cef38c02e914f0cc13d94776bdf961dd9a6e726f02209afa8d42b5445
MD5 fba589c196f717fedf9bea4ee5007924
SHA1 17cc48519337e812c0748ed7f14a1da7e1caa63a
SHA512 d7ff5fe24a4fa852820528469d636ebf31396c7afc4e694b3afaafa7fadb52a7ce525c529f216790f9ba585ffc49e6f2efa5be5f8d34cd7d69c565a047d74646
SSDEEP 384:PZcIhsNikSFbHov8S2VXq6Ln+wXybU+HBbsUIoy:HhpVSEV1mUgRIl
TLSH
T1D0828D72A878EC779CF6E106F5863A035EB88017D3C82B90D4EC6B1D01DA6A9131ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f44dbcf673b6246044c83ade2dea3db2169ec17104c06ea67269ba1e58473a17
MD5 a9e396f49919612baa9595da19ca43f1
SHA1 1e91b3df56a3832e3d055829ff809491f1139953
SHA512 0e86c0077552fb76481f0cbb7b4e615c960c9cb4dc451a31684633e036228990c262e506ca77786fbbf05143c1dab5fe723459a47a9dec8c1613d933d3f3f682
SSDEEP 384:xZcIhsNiklFblTJVXq6Ln+wXybU+HBbsUIoy:ZhcLV1mUgRIl
TLSH
T139827D72A878EC775CF6D146F58636035EB88027D7C82B90D5EC6B1D01DA2A9131ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1baf8c7c357386e69aa3513d6d12d88dd549634ac8a7dc93a19ec023d982ebb9
MD5 e958ff900de312ea2562284bf6938c07
SHA1 80088272116583f520214706d57ec43818fab7e1
SHA512 11e3e3e4bc1e3595698c2c9199fdc904bfd09852a94e8a4c71e17ecae71adb8761f04f1e4f7e1f2cb7c069c98665028d36b367b52bc7e9855a769d18534406e4
TLSH
T154E00202A71001EFC07D077005D317303EF5806013A306559B1101749CB37007B30FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e9af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e9af.TMP
Size 392B
SHA256 176d5355dc8b62c429b37477bc133a05be297a66cf24e7162f5f8fc4fed4e7c4
MD5 6a42af2e9ef729924df77dfd4edb54a1
SHA1 5382b7ce38badd32ddf6f48fd509be2c963f3f04
SHA512 f5f4eb12e366abbd17e87911fb2aaca9244d92ff7ba156d5112e541d156bc97520e386c2de49e2557454686ce18fd00e1764c85ada0535f383c2aee7b2b3c7b6
TLSH
T190E00202A71001DEC039077001831B302AE58060125206555A2001682C223007B20AC1
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b52bd15da963e18127a27c3154fd63fb5903e17607fbc71ed1ea1734c8e604b1
MD5 6699be1a75cae8ab66cd25bcae8673ae
SHA1 97a210dc31c30e1d7ba6c6f37dc029e97ad9ccdb
SHA512 0e7fbc54e7ac2d58a3f8aee6383628475d945b7e80f8888f68e8511913d75d6f5996db688fbdc7d7ec815704ddf1b8dc720fcbd8fe52eafea176d115c3845537
TLSH
T1AA411858A6EA1148B3B36E56ABF6686E487BBD772F06D45E00110E4F0A77E40CCB1733
MD5 SHA1 SHA512 TLSH

Submit Download

Robux Generator.exe

Path C:\Users\Admin\Downloads\Robux Generator.exe
Size 270KB
SHA256 a0347c6a33215f29d89e1c2878c173bcee744d3300d5acf3b5b5b6165b7904ef
MD5 0c2534437541822bb43acfda3ffba646
SHA1 cb6d19e7dd488c6be79b5d00823ba96eb2a1ad31
SHA512 5f13dcd153323b16f2f5da1f84b6c3d0a115fcb397932a0314f616665bbd8de5027665617abd989dfdd62858c985c3fa9b437ac7fa64c5733f613a27617b1252
SSDEEP 3072:n70fglkzf6GgW5YnfqL6uD/CrHL5t2rcOKMENsHFPJx/EXS:n70fgllyJ6Nycwfp
TLSH
T19244B7D3A8C05575E8220C3950311CE186BB9FB9BE9EF56A6C84F577163F0C23636A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads