7274232782c9a04ada46fbc2344403f7cdcec6624b9ee6e8ef785ba7134f3735

Analysis

user interaction
yes
max time kernel
243s
max time network
245s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 279KB
Sample260913-dppkased36
SHA256 7274232782c9a04ada46fbc2344403f7cdcec6624b9ee6e8ef785ba7134f3735
MD5 80be7ba6ec7d4b9d07c357f6284fffe7
SHA1 8610286772742d2041a8f86e745b17775faac31b
SHA512 c100704f2bbd404ab641a3dc6fdc7a005c62af1c11d23daa76f93924d86942ec678d03fc87c552d0d28b5c5054596bce56d9acc580eba61405ca9fda451199e9
SSDEEP 6144:y7VA9yejldOYLu0qFrfc6WfxFPsy4C4LNqaR5j:V9afvbj
TLSH
T13354E9D363281479393F4ADEC20E32A9B848B186C91F56D6F0FDC27092DC6E11E52B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
191	4212	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
6164	RobloxPlayerInstaller-7BGJKF2WJT.exe
6184	RobloxPlayerInstaller-7BGJKF2WJT.exe
1064	RobloxPlayerInstaller-7BGJKF2WJT.exe
1476	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
2304	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-7BGJKF2WJT.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
102	discord.com
103	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe
2304	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Lobby\Buttons\nine_slice_button.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Moments\Reactions\thumbs-up-small.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\MotorCursor.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\StudioSharedUI\close.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\btn_grey.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\models\UniversalApp\UniversalApp.rbxm	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\PlatformContent\pc\textures\water\normal_14.dds	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\FlatCursor.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\icons\ic-more-catalog.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\avatar\abilities\AbilityManagerActor_DEPRECATED_2026-08-12.rbxm	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\avatar\compositing\CompositRightLegBase.mesh	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\DefaultController\ButtonA.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Emotes\TenFoot\SegmentedCircle.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\models\MaterialManager\smooth_material_model.rbxm	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\StudioSharedUI\scripts.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\icon_friendrequestrecieved-16.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\graphic\starburst_center_classic_kids_dark.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\transformOneDegree.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\particles\explosion_alpha.dds	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\particles\fire_sparks_color.dds	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\icon_star-16.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Slider-Fill-Right-Cap.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Input\AimStrafeButtonPressed.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Moments\Reactions\thumbs-up-xsmall.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\advClosed-hand.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VirtualCursor\cursorArrow.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\RedSpeakerLight\Unmuted0.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\InGameMenu\drop_shadow_favorite.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChatV2\actions_editing_compose.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\fonts\families\Sarpanch.json	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\SelfView\SelfView_icon_mic_enabled.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\ErrorIconSmall.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Settings\Help\XButtonLight.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\MicDark\Unmuted80.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\MaterialCursor.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\DevConsole\Info.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Controls\xboxLSDirectional.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\sounds\oof.ogg	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\StudioSharedUI\radio_selected_disabled_dot_dark.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\fonts\TitilliumWeb-Regular.ttf	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\chat_teamButton.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\dialog_purpose_help.png	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller-7BGJKF2WJT.exe
File created	C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\content\textures\ui\Settings\Radial\Backpack.png	RobloxPlayerInstaller-7BGJKF2WJT.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-7BGJKF2WJT.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-7BGJKF2WJT.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337426901325345"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\apk_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\apk_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{63944006-1B50-4D1E-AECC-80CCAAB11A0F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{A82FEB1E-AC8D-4ECB-94FE-95EC0912F32B}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-93202a13414c4131"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-c5aecda2245e4fae"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\apk_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\apk_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\.apk\ = "apk_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\apk_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-c5aecda2245e4fae"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\.apk	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\apk_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\apk_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-7BGJKF2WJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-c5aecda2245e4fae\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\apk_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-7BGJKF2WJT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-7BGJKF2WJT.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
6876	msedge.exe
6876	msedge.exe
6184	RobloxPlayerInstaller-7BGJKF2WJT.exe
6184	RobloxPlayerInstaller-7BGJKF2WJT.exe
6184	RobloxPlayerInstaller-7BGJKF2WJT.exe
6184	RobloxPlayerInstaller-7BGJKF2WJT.exe
2304	RobloxPlayerBeta.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	firefox.exe
Token: SeDebugPrivilege	1176	firefox.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1176	firefox.exe
1176	firefox.exe
1176	firefox.exe
1176	firefox.exe
1176	firefox.exe
1176	firefox.exe
1176	firefox.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6044	OpenWith.exe
1612	OpenWith.exe
5432	OpenWith.exe
1176	firefox.exe
3616	OpenWith.exe
6128	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 5948	1292	msedge.exe	87
PID 1292 wrote to memory of 4988	1292	msedge.exe	88
PID 1292 wrote to memory of 4212	1292	msedge.exe	89
PID 1292 wrote to memory of 4988	1292	msedge.exe	88
PID 1292 wrote to memory of 4988	1292	msedge.exe	88
PID 1292 wrote to memory of 1120	1292	msedge.exe	91
PID 1292 wrote to memory of 1120	1292	msedge.exe	91
PID 1292 wrote to memory of 3380	1292	msedge.exe	92
PID 1292 wrote to memory of 5408	1292	msedge.exe	93
PID 1292 wrote to memory of 3380	1292	msedge.exe	92
PID 1292 wrote to memory of 3380	1292	msedge.exe	92
PID 1292 wrote to memory of 5408	1292	msedge.exe	93
PID 1292 wrote to memory of 5408	1292	msedge.exe	93
PID 1292 wrote to memory of 3952	1292	msedge.exe	94
PID 1292 wrote to memory of 4260	1292	msedge.exe	95
PID 1292 wrote to memory of 3952	1292	msedge.exe	94
PID 1292 wrote to memory of 3952	1292	msedge.exe	94
PID 1292 wrote to memory of 4260	1292	msedge.exe	95
PID 1292 wrote to memory of 4260	1292	msedge.exe	95
PID 1292 wrote to memory of 5080	1292	msedge.exe	97
PID 1292 wrote to memory of 3320	1292	msedge.exe	98
PID 1292 wrote to memory of 5080	1292	msedge.exe	97
PID 1292 wrote to memory of 3320	1292	msedge.exe	98
PID 1292 wrote to memory of 2620	1292	msedge.exe	100
PID 1292 wrote to memory of 2136	1292	msedge.exe	104
PID 1292 wrote to memory of 2136	1292	msedge.exe	104
PID 1292 wrote to memory of 2136	1292	msedge.exe	104
PID 1292 wrote to memory of 2384	1292	msedge.exe	105
PID 1292 wrote to memory of 2208	1292	msedge.exe	106
PID 1292 wrote to memory of 1224	1292	msedge.exe	107
PID 1292 wrote to memory of 5344	1292	msedge.exe	108
PID 1292 wrote to memory of 5344	1292	msedge.exe	108
PID 1292 wrote to memory of 5344	1292	msedge.exe	108
PID 1292 wrote to memory of 2744	1292	msedge.exe	109
PID 1292 wrote to memory of 4500	1292	msedge.exe	110
PID 1292 wrote to memory of 4500	1292	msedge.exe	110
PID 1292 wrote to memory of 2360	1292	msedge.exe	111
PID 1292 wrote to memory of 2360	1292	msedge.exe	111
PID 1292 wrote to memory of 3448	1292	msedge.exe	112
PID 1292 wrote to memory of 3448	1292	msedge.exe	112
PID 1292 wrote to memory of 3448	1292	msedge.exe	112
PID 1292 wrote to memory of 1228	1292	msedge.exe	113
PID 1292 wrote to memory of 1228	1292	msedge.exe	113
PID 1292 wrote to memory of 4952	1292	msedge.exe	115
PID 1612 wrote to memory of 1488	1612	OpenWith.exe	119
PID 1488 wrote to memory of 1176	1488	firefox.exe	120
PID 1488 wrote to memory of 1176	1488	firefox.exe	120
PID 1176 wrote to memory of 2812	1176	firefox.exe	121
PID 1176 wrote to memory of 2812	1176	firefox.exe	121
PID 1176 wrote to memory of 2812	1176	firefox.exe	121
PID 1176 wrote to memory of 1268	1176	firefox.exe	122
PID 1176 wrote to memory of 1268	1176	firefox.exe	122
PID 1176 wrote to memory of 1268	1176	firefox.exe	122
PID 1176 wrote to memory of 1268	1176	firefox.exe	122
PID 1176 wrote to memory of 2116	1176	firefox.exe	124
PID 1176 wrote to memory of 2116	1176	firefox.exe	124
PID 1176 wrote to memory of 2116	1176	firefox.exe	124
PID 1176 wrote to memory of 2116	1176	firefox.exe	124
PID 1176 wrote to memory of 4908	1176	firefox.exe	125
PID 1176 wrote to memory of 4908	1176	firefox.exe	125
PID 1176 wrote to memory of 4908	1176	firefox.exe	125
PID 1176 wrote to memory of 4004	1176	firefox.exe	126
PID 1176 wrote to memory of 4004	1176	firefox.exe	126
PID 1176 wrote to memory of 4004	1176	firefox.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffec671c188,0x7ffec671c194,0x7ffec671c1a0
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6643441353027776710,4800143541745073358,262144 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,8640046733546702552,7774393953829505612,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,1317224815165839118,3021399458048204629,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,4012657679505700201,13587649271900331220,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,11173082555090108763,5826910706454632421,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,5568282088249527605,5724939969260467285,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,16674096094465631355,700432498524399873,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:9
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,9661876820032167088,5620729008871381529,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15381945465145613207,10564962673631530472,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10207094413527182057,1527633915703194045,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10207094413527182057,1527633915703194045,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5044,i,14680893988929753672,3359009518678150135,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,9771390701797947357,11092969466393288217,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14499455069091142865,10739876222031985452,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14380083774701892851,11056781597286240110,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5496,i,13738048878183949304,12349167321676714265,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,8644012139518187988,8025011362296086566,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,9139669058515399327,16103529514926562906,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:12
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,15349210860930066560,15230833540580324249,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6780,i,7621857322951882744,8548753411884348482,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,13457719612481892185,8875062298485103655,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,8987143323974619758,16551412653205496522,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,2811543051111656560,6593823447668931284,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6912,i,5060061532816964226,17999389661816225982,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5367966779879277523,7284784053751389797,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
  2⤵
  PID:6520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8072,i,11205846125624370048,874406026629654935,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8056,i,4270904135022724543,14907262686913631858,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8312,i,6369787076715897135,15773921037887365852,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8152,i,14543015860459598881,7616232316896727247,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8464 /prefetch:1
  2⤵
  PID:6276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8104,i,15916001622219684359,7416842077058618841,262144 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=3484,i,18301866823989738006,10006060360839781385,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8684,i,1852781931714672833,7781749096498156812,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8776,i,17890747418685696782,16334483359732352959,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:14
  2⤵
  PID:1752
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-7BGJKF2WJT.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-7BGJKF2WJT.exe"
  2⤵
  - Executes dropped EXE
  PID:6164
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-7BGJKF2WJT.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-7BGJKF2WJT.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6184
- - C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe" -personalizedToken 7BGJKF2WJT --deeplink https://www.roblox.com/ --webBtid 1789269199791014 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6184
    3⤵
    - Executes dropped EXE
    PID:1476
- - C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe" -personalizedToken 7BGJKF2WJT --deeplink https://www.roblox.com/ --webBtid 1789269199791014 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6184
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2304
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-7BGJKF2WJT.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-7BGJKF2WJT.exe"
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,6214145194641399371,114792326150856423,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9040,i,2973245831547378743,11826924170300488554,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:14
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8008,i,9944389095180719998,8891876468181076212,524288 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:14
  2⤵
  PID:7116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8628,i,9171322151944449815,15025824690964212092,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5432,i,10717495359615571908,10342781874691294240,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8932 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8900,i,16897709146669783869,1131504278020546312,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5440,i,4176404651168971500,13293802759886516207,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9172,i,6393942050165717268,3338931124812813130,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8508,i,6225657544059870518,12906903216893059221,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=9252 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6520,i,15792932763017191355,14893678588667859265,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8584,i,13591130209020617169,16224890986054010881,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:1
  2⤵
  PID:6400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8908,i,13538860477885051978,8968457572693325300,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:6284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9252,i,408322381683033708,13169372148376244459,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9496,i,17922496324024068230,10076465865745802990,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7760,i,974988466982858437,14145647052298950992,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8152,i,8927726352750633670,2020706040864166637,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9104,i,11293407133492889867,12149523330766520891,2097152 --field-trial-handle=2364,i,2211756794372500911,8412956833746168267,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:1
  2⤵
  PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Delta-Executor-v2.737.apk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Delta-Executor-v2.737.apk
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {5f039de3-d545-4b03-b6e5-1736acffd8a6} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {3a10fe28-3812-4ad4-b7df-ea3904a56536} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 27274 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {9edb96da-f032-4202-b178-45176c463e63} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27274 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {8f5c77e6-ca1a-42b1-9cda-2c4ce62593cf} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3008 -prefsLen 25213 -prefMapHandle 3128 -prefMapSize 270279 -jsInitHandle 2948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2628 -initialChannelId {6d4a992d-6bcc-4b80-959d-46496b63509e} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4544 -prefsLen 25213 -prefMapHandle 4548 -prefMapSize 270279 -jsInitHandle 4552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4520 -initialChannelId {909ba8e9-732b-4551-a3e6-85e93cb3464b} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:2036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4748 -prefsLen 25213 -prefMapHandle 4752 -prefMapSize 270279 -jsInitHandle 4760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4768 -initialChannelId {3ecb8f74-dbc2-4de4-951f-59019548a311} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4996 -prefsLen 34822 -prefMapHandle 5000 -prefMapSize 270279 -jsInitHandle 5004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5028 -initialChannelId {c21b07be-143b-4c39-9d63-4aeda05dcbc1} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5700 -prefsLen 34929 -prefMapHandle 5704 -prefMapSize 270279 -ipcHandle 5736 -initialChannelId {4d873675-230e-4f0f-8695-080a459611f6} -parentPid 1176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
      4⤵
      Checks processor information in registry
      PID:6768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6128
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Delta-Executor-v2.737.apk
  2⤵
  - Modifies registry class
  PID:6572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 14e3e506d5cccc03eeb3ae006f2d55611fb0af64ac8d176dd23d8a3966099b74
MD5 955fc4e7e130c59a820d08497c2140e3
SHA1 cdb7dec908c21bb2f36868df8f2e6b90b1902e6d
SHA512 1c0cde12f81564f720ba563be3f6ecb320da4bf4e36b67afe9e20512e0cdc8af5e23a8154a3c3616ea193cc78467d04d9fab35f068b49c745f66fb73f9f23dfd
SSDEEP 196608:WEItDe7ZgAgDLs5gk173msx1rO4jBI0pGU8xZ0P04KR:WiqAZ3msxhO2BIYGFg84M
TLSH
T1F7A6BE22BE00C032E8D200F2A6BD9FBA993C59341B7954D3A7D45DB95A305D33B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.dll
Size 20.3MB
SHA256 6417d71533072b12043a9a0ae4084fc7f04754ea34914003aeb8ba4cfebba0ed
MD5 aa4d548826d9aa8ec371c0a3abb689b9
SHA1 a447ca0417be6cb27115eacc82881389f6e21137
SHA512 4d849b6e4d7974119b4572ae3e94c3ce1a499f4dd4d94598c02ca1a4b4018aa5b713f217cff72f7620e73a57ff96fb2cae67b5fff1ba180f0e8566c504bbc376
SSDEEP 196608:ZX1oy0IyVwmwHV7GRt94O1QojO2LIkyGKgz5Rs:FFVmSV7G6O1y2blz5Rs
TLSH
T1F027BF0EB4D206E8C5B15070E15F63D3E672308C0BA96EF746D902213A73B9DA659F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9196cea3278c1730cf45a9a4a919859882aa4b4e1d5e44bc4892bb2ff23666a6
MD5 511d0a9f327a4cea861a93bb5565b4e1
SHA1 f631631285f1d09281496b8d96b75bcbf0170386
SHA512 9206530124a843ec1d48a15b0a9aa78d8c9a7ea5c2c920e3f8647622f9ecc11d54c0267099f8da7b9f1d04992b4055ef5cd13452dfa5934845d6ab8b948f9505
TLSH
T17FE026D404C8E27EE380A4C743B85B0C82A2378ED2DC7E7A5740C9CC7002440B7A6AD0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 205KB
SHA256 830b05cb01981499b74601ab0ab2cebacd5fd494cc1500e38a0ed0580e6d21ca
MD5 951b7799d79d75c8142b3a1d4ab15eb7
SHA1 d06b45235944357bbc8fcdccf4bedad3988e36f2
SHA512 061a639b5e2823dcebea02ea9ebc42f1f2ab3f170e78ef4985615c41cc4dc070d143de012efb34f4339244067ff341c9c38a729c737f15a14702f8bb32e3d483
SSDEEP 6144:5VCbp44rywLwFOGSSpGBH2vYr7uZfdRRpTO:Gbp44zL3GSSpGFHMdRO
TLSH
T117242370A0F7928E9A5E5383688B60225FFC72F7975DE87D22828487C447BF16BF4194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 20KB
SHA256 073cfdd0d65b4ce8e0cf9a874ae392de6cc13aa37150b6cb290b88ff525ad46f
MD5 4148df191c64db9f6b8de32e53209ea8
SHA1 75fd99785e483e09a9f06ff31b2246a319c1c7d9
SHA512 161c9a09b72881460a23421644c3b59fdd6c1c9ebb547477d19641695c6966cab4ebc7f1507922c2c8e7e4e8326c91d407870bfb43f48ee6e2831e23c8073de8
SSDEEP 384:ZQKuyo4LjyvrJ04nkQfuEpUdWkeR0nBIWciNewq8S:Zluy6vrJ04nkQfbSBIWcfwqn
TLSH
T16892BF0B9CD6CFC2A51E53BE3B829AD69B8E7105144BF2DA85761DCEAC6F1410C0E13A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 18KB
SHA256 2be51ce75587f62be1ed44b17bbd1475daa757d1f0a7ba4293c39a0583787b7b
MD5 d152f9cbae18e03fe798938d8d5da8a1
SHA1 2e33d4cb75aef6524e5cd7bc1d51c6d7346f6af0
SHA512 2b94de2e6217865cc8f5bb034d11e52ca199966ce4adbcf29fc2a64b63a9ccc6f12638ba11295cfa805619d4445f9d1ff084197fa64c15e6ac5f7774d0939a72
SSDEEP 384:Dpx/g0tvaxrIREaCvk1yVgw/Xn+zI+8wW+NWTeanuK5p7:Nx/irIgvgy9+cwYRJ
TLSH
T19E82E1942F5A4C9D1C064D7B0ECC7EAD06BA5C60CCC56A3E4E48B2F825DEA205478CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 44KB
SHA256 69b4c4b62ac979510bf2d789141bb12973fb9707801d19deaa8a1770446059ec
MD5 cd873b7677d33f1bb42c256060b5fca9
SHA1 47b30b43db92005b448ab505a1eba2877cee9dcb
SHA512 f3b5b682f45fa59a06b072f47f9782998814ea307517f29960e60b071ce2a37549d1c007985ead6a4a7abace016dc3de5da7c48de399a3a7e128d24eb0ff2574
SSDEEP 768:1Qd6GGOE0H7dUeKP+ZZAPP7aUBLBG0KuyFG/cfZ8afyxJ0w0B3uBIGvWU:1QxGOXzKw2X2MEur/EZJsE+B7X
TLSH
T12C130253C29392E4D631C34028308375F7F9C5F824B2F5C60B4A61F52E56C7B9A59B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6a720dc3db91306e5f3b46f83f85a7a4132a8848e91bf191264eaf192efad4d8
MD5 c4d0c0440956e975beb846ddc82ac7ad
SHA1 7e077a7890e55ced394710183a0d79b41c58f53b
SHA512 8c9009ffb7a65c16690afb490eed44b30b9fd3e16a1358e436352be576ad784ab1102da3ece7c4ce70392b095649eff21e42b51a669b305f97ebe867ed4d8b79
TLSH
T13171978E5A604022FF7830FE95D5BEE37E34A5C746873E1236D7DAB5986736C1C54108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 07ab2e90ac2541c2d16607d0d7838259f63edfadf5056e7cb2df487272d5cc73
MD5 2711acbf7b6d29345bd7ebdde505d3b7
SHA1 d3300a4dfd53727116c856402784f586bd61a0fd
SHA512 d27a182bfcf4aa37a783ca30bcbb7191ec32096315fcdd5478fa514d8b1cda4085dd59e744b835fc7b6fd8f891794144d43849394a7a716374d4bff125fe2082
TLSH
T10961968E2AA04022FF7830FE89D1BEE37E34A5C755873E1236D7DAB5586736C1C54108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 c856169c663c4d6fc6b2a2203bf8b1ae17d2c71c76b22edf4e9ca574b561ebdb
MD5 496eccdb0adc9c91a8076041f4172d4f
SHA1 59881571707deee214815a962d8663650dcc15c3
SHA512 3a86ff01b6b45630dac98ff453268d995afd201396430b386f8e0f6ef73c6e7c9a38d778a0dcc6223e341861779f9bb7b6d7119e9c447e1e648c53c1635c9e8d
SSDEEP 96:d8v5Azb1+vp5iRNHfTqn8SliUtJbJeBjMRBkk+E1ey4KJSz7mF5ffWYBs4WPubnt:rsSO88JmEBuETSgWb43B
TLSH
T1880290F989E09018FFE5E5BB54DE6D977E3394D310A7AF872981D93096073EB0CA2904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59eeac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59eeac.TMP
Size 3KB
SHA256 5c48986821ab2c9a6594a6e37069ef84460710c3c1f30d1f1d5940579c733aef
MD5 a44c0209fe282154a4db3e8ff023257e
SHA1 47fa4948f26222df3d3709fea3e8e6b9704d8c7b
SHA512 0b207f25619ac938b5ce6abce04f0c771af360fbd34526fcd298b924d8b5aad171d0b61a07ef15fc75dc02a7b4e718f53271e040b6cc240d3bfa6a12281ec710
TLSH
T1CF61748E2AA04012FF7830FE89D0BEE77A34A5C756873E1236D7DAB5586736C1C54108
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 383B
SHA256 cb32f94ddfc75ad6f140ec910a68b5478a1ba70406c9bf74c58c228ab4706916
MD5 104c38865c909b4bbe558e4ee18adf74
SHA1 08723d0cae81db08e65e12903364299f69ace18d
SHA512 b825db087b4f29b96b8499ffc245b3fac52ba0131560437ae6944b9d3cf6e55cee0cb2543be1ac1712fa39c927c1b27132a7703b532d3fd2ad5e2c150c676bcc
TLSH
T1F9E092B848CDC25FF254209781B4BF0EA2E3379A968CEE811BCCD9D9B045541B669990
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 40888ef5ca1de4dddc380b71908bb15c1fbaaa8492d1890b7f87bd4b53f528ac
MD5 3cb4b7e8235afc3ae81245bc1f6f670b
SHA1 235ef4c3ccfd6cdcb155383d48643dae211e8580
SHA512 fb08951983d09a502b0147e3c255757468623fba67652aa506591dc84020df16f1f0522775abce591f6189cb29b665ef197e193375dfb8af76446ffcf5060689
SSDEEP 96:DgOLsnEvRFaVIuNGf6Pz7Gwpy8aZuNaLSmc:D7LsnEvRFaVDQf6PXGAy8aZcaLSmc
TLSH
T158C189F7C2E4872ED91256F0A7142E17CE2E096543683C16C8E9AF5F93E18B1E24654E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 4c6723de6c3280e9a0af6fa1088b1946746c9e993a61ddec8392412e1f0c3ac5
MD5 4c05198a1f436b910fb751d0cd4157a4
SHA1 6cc61f38c62775d366b34be2c8d8c56342692f8a
SHA512 627d4b45abe409706592a19d784d9c7b3297ab0eebfe72b1580d177818dca4064a14100b84ecf651cc84831ec779d2a1eb63f2a75fac02bfb8f6817e5fdd6f96
SSDEEP 384:D7LsnE5YykWAsXCCEvEl+aGB0aVDQf6PNy8aZcaOm1kxWzGhfu04HjUG2d8IuVzO:BO
TLSH
T1EC627BF7C3E5862DD91256F0AB146E1BCE1D0925436C3C26C5D4AF5BA3F28B1E241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 19692bee7012b66401ef48cfd739fa9bf1a6df70d9503de7960dd25f674fa369
MD5 53c6d7c671f76ae1a4ae3ad3efefa11f
SHA1 97eb1550a3d2b673c6ff7ec3dbc564949fd0432d
SHA512 85e9e12c430b5ffd87d31b66e038b1a56e1324b23f5f4242b6c8bfceed5c97d2c157be4ab0a27ab37df52cf6c0233079cc83096afa8653c75cc828798547c7c0
SSDEEP 192:D7LsnEvRYykWAsXj+CBaVDQf6PNy8aZcaLSm1kjq7fixWc7zUvTHGhHfTkdGy8H6:D7LsnE5YykWAsXCCBaVDQf6PNy8aZca/
TLSH
T1B232CDF7C3E5822DD91256F09B146E1BCE2D0965436C3C1AC4E4AF5FA3F24B1E241A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6ef8df60c3019e1032cbb9f322e573fe4a923a4128014701c111f420c6f2a5d1
MD5 fcaf91bb069195e0230d276618a05736
SHA1 577f8e122e6c3edc396b03376f8f4ed866763c9a
SHA512 b99964aef499a3563b03e324e0391d5d3a8380a6d70ab4d89459b5af7066826fc38c3bc70018a8ea231affccb93b78843875d6c6f63bf7000bdf6aba54f225b4
TLSH
T1EFD0226B5641F0BDA5EE7E86506AEC8ED72720240A83EEE860E0689D293946C0A17244
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 0401f822f6f6c7f916a8af6991a5ad46f029a2744246f8c7af2341dee4d58d3d
MD5 9c13e173ab72f16b5864a71466a1222f
SHA1 b747f6ce3e69bdbb6a394dff4fbb5b9c860039db
SHA512 227cb344732efc2d786a853bc7e40f81b22409053848c3e14f7576982476d4a78308f15a80cc869d4d8747b18bd6a7292fe83eb0cde61004fb21ed50e38d8456
TLSH
T1F6D023571141B07595DD7D929069ED4EC72720240543DDD814D0599C153957C0617240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b2d20ef2a04819c205c1955b73b4ff6e81d454ee0c1c130ff084b0d291a1389e
MD5 1a93ed478cad3c46a6b9292a30d88339
SHA1 f1d9b27617c085626e5ee57f31ca37ec63ef6030
SHA512 c831e520357ed548b3eb79c3fcfeeb266e5a66d9327781478adc564086e1c6ef7a73781f55451c77a6ad5d8a77ce2bf2bec87262244934a57f89bed9d8f45418
TLSH
T121D022672251F0BAA6EE3E82546AEC8FC32720240902EEF924E0989C193D46C0917340
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 55dba6b86600fad039524503f456b3493010b6c78f222a65dbeb5ffaf414b7f0
MD5 04f3d63d404c7ebd9c4a39234955360d
SHA1 cf65b905789343454926126217a5127773e2dd8c
SHA512 30703261cd7f5e4995a21f4790d012838597077700c39a697cd058322a886a50ba18588b9423fd5a8d72e35ae1bee26110013b0014034068f273f00beb7758f6
SSDEEP 192:sxRSRfbV/f8sXdzoA8p4l/g6+WNIYFIwGEIgIJ:sxRSFV/f8sXQw/5Ios
TLSH
T14B229715AD28A97B8CC7D21DFB66BF53D2F91032A1D51E48AAFC961C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8354260e27a31762ec3911ac41111e0a96f85545d10e64eaa0de1a128cf24066
MD5 b8a5545de408dfa48f7611df558ab10d
SHA1 720c15f56884da9b5a4ed1edf4816192d2f8b8ec
SHA512 1777b60e33de5d6796a41e37d2567eb10d515c833791da382e1f163a249f8003d098b8bfea2cf2e21f3e3f29a20f056f01f60f36a536882fecec558c5ee9b868
SSDEEP 192:sxRXRfbV/f8sbdzoA8p4l/g6+WNIYFTbwGEIgDJJ:sxRXFV/f8sbQw/5IVP
TLSH
T130329815AD28A97B8CC7D21DFB56BF53D2F91032A1D51F48AAFC961C04E76DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d37ec7b6478c1e579608650db01d80457657825718b25226ebe1a408e91b90cd
MD5 f320396e739ed591f49a46c40891da7d
SHA1 b7c8f5ceb21c72d1796144f318f34a1cb3698b9b
SHA512 500096f19843f23cd8e909106ae40f1d92b4bce60c09a101d4e4874d8af96575984b5f0efd61a985894290dda3191d961b69bee508608966c7e803d6be896075
SSDEEP 192:sxRXRfOV/f8sbfzoA8peJD/g6+WNIYFTbwGEIgDJJ:sxRXoV/f8sb2c/5IVP
TLSH
T16332A855A928A97B8CCBD20DFB55BF53E2F91032A1D61F48AAFC861C04E76DD130790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7a3deb7da6af6707de0930d0c109feddc732cf81779b44f66c9140f3bc70c3fa
MD5 63d7da8842cea5b2f827ecedf4c2d9db
SHA1 849adc023e05a03642f5cf8273e401c28f3c51ec
SHA512 68c22b6fd83b03161094c5d885ca4038039e7d3a525183f3662a8adf7a9a714023a7595dbbb89cc44dcc512355622433da323edb0771c328f08bf67b6363276b
SSDEEP 192:sxRXRfGPV/f8sbfX1HoA8pXZJD/g6+WNPFy/YF+XwGEIgDJJ:sxRX8PV/f8sbMn/5M/IP
TLSH
T1D642B816A928697B9CC7D21DFB55BF53E2F91032A1961F48A6FC8A1C04E76DE130380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fe0ccfd5e44238770c042a7d4bf381d2578b0d2706ad688f375747b16c5687a4
MD5 30970008fab090a8fc2f362449325948
SHA1 94b37cb81780be72bb72b221a62d897c106bb024
SHA512 eb9c6e25c3260f7dc176b8ea105a18f86d1db429bfc8acecc0e7ecc9a52a7898dd84e92748081f3fd1177290c8a073acb90ee00f42cf6b4ab31b77d58c246439
SSDEEP 192:sxRxRfbV/f8shdzoA8p4l/g6+WNIYFIwGEIgD3J:sxRxFV/f8shQw/5IoV
TLSH
T1A4329815AD38A97B8CCBD21DFB56BF53D2F91032A1D51E48AAFC961C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 5c2d29f6ddd4a38ef73b9e298cddae7dc49be9ae94c2033dae9d06425515fcdf
MD5 7ec91d45f712624d136fa4411af8dcd8
SHA1 b1040f2d1f19b053ac275efa86684645623b133f
SHA512 1de89b9c4fd0cb1753660d69e19e8317217860291aa9cd7bad741fb2acce42ddd5bc57091e295de75c7be74ee55d82e71b662e7374fb50fe492d6d7e4d3eef1b
SSDEEP 192:sxRQQUnaRfHcBWV/f8sbq0nbVoVoA8p8HEX8xBjQ/g6+WNpazFyHMCjpOpYFZdwQ:sxRWna5mWV/f8sbq0ZdN/5/JEp94Xl
TLSH
T14682B9526524997B8CD7D519FE25BF63E2F9103298925E4CAAFCC91C04EB6EE2303C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1e080f5dab86f8ec6d403da6e5fdf2116df7f9e1d03640b03a1258361fb41f0b
MD5 e1690338b5d9034a31be1eb179a23523
SHA1 9b155bae8f44c3e2149607d7f2cfc043d506e72b
SHA512 4372da14a4c1da20dd39c6f3d95ce7a7b9da68666e96250f45b26213295ceb7f1c6421e46a7b7743bcec509e39553c22f413bb86421d00437b1bc3574d4815b5
SSDEEP 192:sxRARfHcBWV/f8sb6d5bh8VoA8pXEb8deQ/g6+WNpjFyHPH4/YF0XwGEIgDJKVxl:sxRA5mWV/f8sb6xRZ/5mf4/CcVxl
TLSH
T1E872C9566924997B4CC7D559FE35BF13E2F9103298921E4CAAFCC91C04EB6EE2213C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 a07acae31d320b76325fc063b2e43aebae5c289334e94b191451169c69fc609e
MD5 0bb0f38d2fee5d2460171481ff743ddf
SHA1 1fc25f742c2b238bc2e6a0662ca3c3ada752f5cd
SHA512 0470f09c4a17be54107dc9a915a53c28d6f0b7ce1514d00cbc65be06f4831eec3b4284e0d90547ebaa9f57314ad4a63fc8fad3cf7fefb92b3b8d2d8f879c28c6
SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRn6ro+Pn:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0V5
TLSH
T1E6B2DA2F640CCB7E4FD04A9DAC196EDB6DAC02C796588D4047FE994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\237562b4-82a5-4e60-91dd-473c0c636f10\index-dir\the-real-index
Size 768B
SHA256 bfb16b9741aeb72f3e27c4264836ef8d4737b05cbc546484436cd633638a4ecb
MD5 537be567f9667771b5c7442399820d4d
SHA1 754fd25b4dd4bbd7079cc438ce99651fb36f3cdb
SHA512 ff252ef8368be516427dad28bf758ffe2e1f842f5d3f025225faa5fcfffbeb3dfd479a97ba1d618b76c7397f139518e8d66722ef90a99c1d881e9394e4eaa72a
TLSH
T1F701E1CF0D530E16ED510171643CB944967931CC5340BE4FF1EE957B9CE2754B980A64
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\237562b4-82a5-4e60-91dd-473c0c636f10\index-dir\the-real-index
Size 3KB
SHA256 810d17369e013c58d5010f3ab2768f169b7931c86e98459d7c05fa46ce7be0ab
MD5 615315da0ff288df4034504f57e1cda7
SHA1 79fab0caada4b52a054281fa0e8417c4ccc0901c
SHA512 b19412e3ee268b6bcbdf0545880f135ffb199c91270a8c93f10c62b4719728874328d3145ec3564df9f2ed5858b0c04fdfb22e85b3959d073e1fa5fe4a9b83cb
TLSH
T15E51C94E0D575F6ADDE8527124B51490337835CC13682D0FA5FE8139F8C3B246CD9B64
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b3d15.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\237562b4-82a5-4e60-91dd-473c0c636f10\index-dir\the-real-index~RFe5b3d15.TMP
Size 768B
SHA256 6931b59718c95cacf8bd89260cd460fb069202963eb9a9a85d4b3eb594ea1f0a
MD5 66d52337763d70826b9d5cdfbb641486
SHA1 d3e437951185bef30772cf973c8dfd1d1af1fea3
SHA512 81c853036a7da52d058489cba167cf469430bd08b1f5b9903ec232895bc9a67bac88cbc1acaa987e6b39c2836aaa0a4278509677740eff8b78deab5dd12d6a56
TLSH
T1B20120CA01625F82FC0001B19A3CB584213A51085348A70FE3E6A46BDC90788BD83EA8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\348dbc9f-d3c1-4dd1-a131-4ee784c04a82\index-dir\the-real-index
Size 72B
SHA256 51a873830c663b01ed45d23dbb714805fe13e07ee56ef72875c3eabbe79e88c4
MD5 9b36e5363047247eb57c0fb7784a6491
SHA1 baba5e8196ba03a5eeb15545ce7629b8e4b0ef03
SHA512 2ca4650125ca214a26778908d2a35fe183bf1f0b381133bb08e2dc535e240ae66516dd179111c3244b05e9c7e82f5d7686adb3cd8086761a66d67575c89b5f62
TLSH
T199A0027852F52009C09A07B1158BC28B3215896801221B465B95E87DFEB135E6A82446
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1d9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\348dbc9f-d3c1-4dd1-a131-4ee784c04a82\index-dir\the-real-index~RFe5d1d9d.TMP
Size 48B
SHA256 1c0c97e0007bafbc1df4778f5e28a582f2d98baa4d294bb9e393e33f410fae42
MD5 565ccc00825238f7d32a110f108bdf28
SHA1 535429b87b83ad78507718de3e74839a52cccd3d
SHA512 f2d43ca457614be542bc5866de9e7e4e07a16574e6bf4efc640997b86a586d4e263e9c680a0cd760a84a43491eb64450f07f814f2bf13749c5d6474d97940e9c
MD5 SHA1 SHA512

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3956b439-152d-429a-bc85-741dbbfef2a9\623cd082b6202da0_0
Size 82KB
SHA256 b20e47c18e48bcb77bce5f3975d8529053648bf3aabc5a118bf57930591774db
MD5 ba3625f411d60b02c2093fc0d210b798
SHA1 c616db67b8621e780342f393350335fb4661f7e6
SHA512 23536cd50f2a41bbea8bb2f113cf83cff34cf61e5fedd0410381a3ddcbbf726daaba38b03ccaa6849aed1ded3bc6a9f02a51baf2fd7606ac0892ab8a33ef4167
SSDEEP 1536:XOhL1++HqsJs0wihp2VMGznX7HVyOAcU9dP2CsXMoTrzk8+FDWqHPwqYzGi/A:+L+nKMVMGzX71yO4Z2dnj5/A
TLSH
T175833BA7B262703587AC11D594566B01F21B178A1844C8FCF07DB5963B28ECB63F7BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3956b439-152d-429a-bc85-741dbbfef2a9\index-dir\temp-index
Size 72B
SHA256 e37bfd4e4eae1d798b7f8cd1d88efb3c699e131c4fab28b57bf76df57ed21862
MD5 fa83ebf8137218c74cbb5a5a0018cbf6
SHA1 67d4dbacf6328cbcad71590baae1777a1204aec1
SHA512 4e52be768a1fab56709928da2e4dee5ab28a9ada187a89a766aaa85e23ed6faa920c9c99b97f81bacdd140e63c4584fc6420daad5ce237d4ed1adad042d53d54
TLSH
T1F5A002261A825201C5027AB1259E21B1E321DE100601135742A75048CCB69568D4980D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3956b439-152d-429a-bc85-741dbbfef2a9\index-dir\the-real-index
Size 72B
SHA256 1e548f5b339e938ffeb2b680a72f083f9383fadfa4a655bf80519a2aad9af983
MD5 5f50ed672f796fbc9aea51392b1172ab
SHA1 819deab85e7bcc2ef0cde683c82bf01ab4550480
SHA512 3520704556b9adb3c8e689352300211ae19954b3ee4ffad7ae44d7135e3df5c15fa033242b40c9cc47b74f8278f4ec8830de207facbf6636563e080b7e7e6d06
TLSH
T136A0021A0383000ED212D5F115D202721302EC1691005307A0E15085DC509904F7200C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3956b439-152d-429a-bc85-741dbbfef2a9\index-dir\the-real-index
Size 72B
SHA256 f7c16390b036e700adf0d3ca94e9637afc8ed94e8428e50b0236b8e0fa6b272b
MD5 57fc5badd803460a7e3e10d34dc44b9a
SHA1 7675e7930a8d9959ce349683e642da0246b4d258
SHA512 14078ba5de9576371ece290546b16179c277db7d5d0ffbd1542a18eb2fb77c9d43f29f7529c5f570ca90b301b2903e3c2f58929054033552337d0797e7ee59f7
TLSH
T125A002240A820042D003E6B025E77161635ADD501306134752D3A485CC77A499DC261D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\641234fc-a434-49c0-b596-3bc8ac2b525d\index-dir\the-real-index
Size 96B
SHA256 277adaa01582c3e66b2d44587cc4955b1f61e44b88796e84bb688ab8b2adff8b
MD5 82be1590c1508b6a08e5765f09760b2f
SHA1 dd20b4f46a9727ec48c7699cd47e4feaf15c187d
SHA512 9e566fc818f2349c609fe7cb1a7aeaa5e60ac301e07d949a530da7f1e0b53eb332d3cf7b097d850722b67838a38647842901422fa6cb8bfaa24f6d2f5a586288
TLSH
T1E3B0121963410003C04342B010C6905922A18810924323127091603BA9042828D36404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1d7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\641234fc-a434-49c0-b596-3bc8ac2b525d\index-dir\the-real-index~RFe5d1d7d.TMP
Size 48B
SHA256 fa1a3b2b9e51279fe59662e66a6357b63786296079b017f57117d70450b5860a
MD5 ddc7d5179e84d3782062c1db058be10a
SHA1 3a57a68c7fb5fa65282425fa959f4b1070cb1376
SHA512 62be22b218f689e3b4e528383404041ce9317c2111019111770ffb2086b995d848628d9a9bc0bfd6cbd0d4737dc1c8adb24e2ffbf1d4e969e24540f9afb04a3e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ede05c84-5afd-492d-8829-6e25c1ae876a\index-dir\the-real-index
Size 72B
SHA256 b0c194a1caea52a0ac425e56087198c4a60af30f1675eb899eaa755c0aff0c50
MD5 fe5ebfa9d4f0c9395e59c57695603c63
SHA1 0fe4a2d768c93f5ee51e837eb30cb4ae07e6d821
SHA512 cd1f100131098a0817cca9825a48f52aebbb82dd899b7226257ebded36b3175a0a8cbd2ff1e7c4fd3fea7bab65ec997d39f53e08eaecc8a7d04e7d36de050734
TLSH
T1C8A0023061D44041D0404EB2674987622316DD1B2306431B9096A466FCA116D4D27250
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 7dbc35d8f7c73b5373a7730cc96bc69f4379f26a929db7d316ebd9418a8a8d6d
MD5 92ab499c39c50107d10143091810d79b
SHA1 27afadd3f6d0c5858a4b5b702bfa34d2c51edf1e
SHA512 536272ea4537de4816d332aa6d82b3e264515e027e50bbc0feabedaf9d0971aa084b3326378fe18361dbec211c7015261d869b0c5e47dc659256188ed2a5747c
TLSH
T1A1F028B73EF72824FCBED3EA243144A001197D48CD44BD0F1427A68B90B372120A9C72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 ea39eda8682129d5fb7281af8b0a389a397fbe765e2a8f5d74039da2ac4941e1
MD5 813c751735b5c332b1589d6d1a0ee542
SHA1 c1fd3ca7b401c649a0e0b9c4ec60b03caa082004
SHA512 c46161b0ab3bbac4fd924dd2929a25470c019c4a6a023d75118e1b113c17d6569afbbda76e5d7f9304e8efff81f4727a3f242176e470c581c0180119cbe738ee
TLSH
T135F0C8B72EF61424FDBED3E6243145A402597D48CD54BD0F1427A69B50B772124A5C72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 2195d07d5a44087b10c59dab54b1c32f8e68304313e83e8005f9aad9d4888d20
MD5 45bb37ca36b063367ee25ff52fb939df
SHA1 871f9198cc086cc475f0fb78e78732e6d061883d
SHA512 a8ad14fe17aadc110a95c4a8ba0d821184bf28e7c189795f4954998fafb2741f77d2e8145c9e20bbc78ba6c973b897cb7a981c2ba344ccd93bb2d24c8b478057
TLSH
T1CEF02EBB2EF72418FD7FD7F6243185A000593D48CD44BE0F141BA28B507375164A5D62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ad4d7021a2404021455f1608813fb5992df9b378b07dc211af4ce3b00570f164
MD5 64a02584b3ecc87d8683129f24d7c71e
SHA1 64e0ea8598835be2e77a1ace412d3c8f8b303980
SHA512 03d34dc167225cbafce2dbc9c5ca33eeb84963f652f02a4f883a6b92db57ddc21345bc605533528054971f8da2173ff191262d8c4cb560cbc9789ef337bf4a1e
TLSH
T157E0D8BB29A62424ED6BD7D62831C59001457948CE457E4E142A928B50A275124A5C66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5a88f1153d581d15ecea9b8e3931501c706d285428ee85787428bfeeb2768f5e
MD5 9104794025637629d653f460b71b1446
SHA1 51a5fb8241fa34c280d7912784138ac9cad4d2d5
SHA512 d8f61a4ab859ba75e51002e21edbdd8fdc63859aec49e4ab84bb8e13b79a87ec5a34ba79103fb7837edf7aff4eff78b112180897ec2a0430b47c78db612c2c47
TLSH
T114A00233BA57C09DC0808274E1651AC46212B8DA27463612C0ECD154C86114447D2158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b9288.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b9288.TMP
Size 48B
SHA256 86236adbb916d898f3fe99e8bf37d6c7a4a29ddbcff0ba689c8b44f712c5e70e
MD5 f89d0d7e89c4a75328ab1c56c200128f
SHA1 d1c25a42c7ef887dcaba9310ad34ed78f47a47b0
SHA512 edc632938b4024f690991c69c9ebe3040370b4b53fd4c99422b354ccb1bc80c9cf2f9b482623da265d60fcd8509f939434a84caf09a319b51f547fa12ef5972f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

9b1629cb-455b-49b7-b46a-3002915b96d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9b1629cb-455b-49b7-b46a-3002915b96d6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 42107301ba9f3c3eefb2924be754426e9aaf002446a3578575b5cc3e08699ae1
MD5 74e6a9be254ab19defff5bad6f3c48fd
SHA1 e1a178af6b250e106a1677ad448ebbbf994c0438
SHA512 8d01d034d2cafa6ae8f554c16f8439756f77cf67e4da51d220d6f3f527585ca4925a77985bc01688f563a108b7435e1e1463c5b5665b7e09c5c3a3343ee325e3
SSDEEP 768:YG3WNf9cE0qzLyEMbxyJugQVTJ7vvmeXwMgQh4:YG3y3pLyEmxyJJq17v+MgQh4
TLSH
T1E8F2AE319975CCB39CF78381B745B683AEF442A355CA1A9488CD5F0E058F7AD130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 35b04f4843203c3a6071f76e5b7bd0599a83089b75c8866b482421ab9c9db9ed
MD5 3f293a0e07fbbdf9dd4de47106b0c576
SHA1 739acebcb90d9fc64e064be11ee14ccc8b604a7a
SHA512 8246f1de2374c1d3200adcfb396c37aaa26b564ee782bf05c33ec09b30fbbcc3ba28c6ee689489441cad5e16341e6d423358c3686910b89a9a29d93c7229b3ee
SSDEEP 768:oFqa3BwgINf9cE0qzxyEMbxyJugQVTJ7vvmeXwMgQh4:na3E3pxyEmxyJJq17v+MgQh4
TLSH
T15E135BF248D38876D8AE8783A77D6D429EBCC163B4855A54B7C8590DCD8B2BFC307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3bef591881828eeea3d7eba65e4e2ed57e77156c2b10a82386d0d00d9b57d6e2
MD5 c9f2b1efc0b31da138324c83ecd10a9e
SHA1 479c07bdd15304d7f87955f877a31f2821541e74
SHA512 2dcec8dd434ff5d861a2703d29db6cf81593e848ec0c73034a07b71bfb42fe5c7162f9689d592df6bf8e6dee88e6c7b15dfac460e0e621f1e90b9bd20cb5edec
SSDEEP 768:oFHa36wgrNf9cE0qz+yEMbxyJugQVTJ7vvmeXwMgQh4:Ia3m3p+yEmxyJJq17v+MgQh4
TLSH
T14A135BF248D38876D8AE8783A77D6D429EBCC163B4855A54B7C8590DCD8B2BFC307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8cb54566713fb08647e41960327c1b8f25c8aac4f0be031ef4fe6a18fa04d6de
MD5 c84eaa2cab5eaf0c44104216a22addce
SHA1 052bde3adf380f4609339e270d64c973654dc561
SHA512 d86200d0b19f97c43ada1ca28d770ea9cef5662df12136740ed723bcdbd73b3904694d84477b7bca120d735490f1da57f03c565945bbc1786598f9b4d11e1a1a
SSDEEP 768:Ys3SNf9cE0qzLyEMbxyJugQVTJ7vvmeXwMgQh4:Ys323pLyEmxyJJq17v+MgQh4
TLSH
T1F0F2BF319975CCB39CF78381B745B687AEF442A355CA1A94D8CD6F0E058F6AD130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 62ce25232217e81d2c21ab75d1f4350085e3c6a07f4089da765e19cd14647e5a
MD5 8be4eadf47f5ac66c1a155a1bfce0589
SHA1 274551332b93043df4bd20d180a13d0c735ee788
SHA512 f2c866b3150192bcaf946c1a179f9a424ea6f99b43e691e55971bdc2546e3853bb5dcffe8524fc5ae7843e20f0724e09c6b3ff9b78651da82ca025efcd46012c
SSDEEP 768:oFQy3Bwg5Nf9cE0qznyEMbxyJugQVTJ7vvmeXwMgQh4:Ly3N3pnyEmxyJJq17v+MgQh4
TLSH
T1A3136BF248D38876D8AE8783A77D6D429EBCC163B4855A54B7C8590DCD8B2BFC307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0c8bb524fe64200ae7762ba8dcd22912826bfb1fe251e73daeba530045c63fdb
MD5 83fbff1116f369f538a6476ac384600c
SHA1 e7da29952549318d97b64b43af5bf2af60a2d092
SHA512 723a0095071c79a24958240fd9995b9a010e69e8be53048e4e6daf493dffdc93f8308cc7e610f270b30505a17b1553467ceb52fe349da5190d91157499a00650
SSDEEP 768:oFwA36wgrNf9cE0qz+yEMbxyJugQVTJ7vvmeXwMgQh4:RA3m3p+yEmxyJJq17v+MgQh4
TLSH
T1A8135BF248D38876D8AE8783A77D6D429EBCC163B4855A54B7C8590DCD8B2BFC307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 db750f208c6a8c442119af1b1505841865a27a856780de18f437b08bc53f7a58
MD5 342f5709fac2e88881ed332af536d0b1
SHA1 77b0ba6697886a9fe43b00e70c2a4102ad44ae56
SHA512 061800987594d13b3954e144f3d7cd71b0db12f896fc7cc186c34d952a2f8cd5bdb3b2069de759582817d418fb3570f6c731ce2b7ee456fc46cb36c6429d70fa
SSDEEP 768:oFj736wg/hf9cE0qzXyEMbxyJugQVTJ7vvmeXwMgQh4:+7363pXyEmxyJJq17v+MgQh4
TLSH
T142135BF248D38876D8AE8783A77D6E429EBCC163B4855954B7C8590DCD8B2BFC307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 64bb1a589d4da0f34e6ecec0216fa6530c52b840c61407910013f0af52a40913
MD5 dfd9923f96302bcc8782bd42be39cef6
SHA1 7ec0df44b7a3430edb42f94f4d0fbb4257a1a676
SHA512 2746dc4a56038e1d2e5040c255caae3c93e3d3c3de21511a380a07b74d4b821561b9019ef940756f9222e5b30fcfd0bb69bc14ae8b665baacdae34d0156e8f38
SSDEEP 768:p/UxvxjgC+k3ICf9cE0IyEMbxyJugQVTJ7vvmevPSHtBk:cZj3+k3v3nyEmxyJJq17vhSbk
TLSH
T14203CF35ACA59C7388F792847649E387EFF502B384C62BA485DD6F0E168B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1175881d85a9265ed3983e0e1c62c6d9fb5f73c68c1a5835239133aa4a5fd7df
MD5 3c7349f137063c3afff597fdc8f06fd3
SHA1 7cfbdfb61820da2c83784ed2a140f47ad240fb6d
SHA512 5a9a0be9d9b579939ac6ac8d751f26fc84ca5d9ae40447dccd4860c843bb03dded80865fefa524b0b4fc62b697dc3b7fe8d1055881150d5433523b22845f85d4
TLSH
T160E04812930040EBC03C033100C30F2026F2803413FB074B6E3002B82C623002E34ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 542992d9000b2ade2c3bd8f6fdd8be8798ff34a9de2d349b4733431ee9e08648
MD5 cad22a21342aeccef3ff704b731c87d5
SHA1 539162a172755b1659bae8d9bec09ab18cc90de5
SHA512 ff4c389b2f91f118cf3a6d01d3e472334c4deca69e4e210b6f5a2803a9026417636827e8c0c720de4dce582847768283ab2e72298fe285d7bcf2cf89bde1bf86
TLSH
T1DCE00162971040EBC03C033100C30F202AF3813413FB064B6E3002A82C223002E34AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bc41ab46e216046d4a9ec514742d30009640600bd4caf0bb7c564caa93af625e
MD5 448fab0c4be4df8f39ca4d45e229dfc1
SHA1 57f15630ad9b2f69b7d11d9267fe9a3e8f4e1c28
SHA512 86f9da7f65be91743cc32fdf66b276dad4f4aa9a35e4b2833745a2a57c2d5b98ce7684a29cde3c4ffdf7dd86d3c41cb436eda71e0473649d240e60c6de9e3bc3
TLSH
T167E002429610417BD02C033000C716793AF5801003B702466D2002A82C233002D34F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e2686a6dc7d3913906e2b454af21c5ab1cd6aaded1f14362978d537895afa6c4
MD5 ce3a331209df9eabb865a61818d41ef2
SHA1 14d3cb3ec87f6548bbb41f18d81b1782d7ca4a3d
SHA512 4a5c5a1bf5dcc1d5d4c7509b96e1156d9c97b7bab9a495a0c9e19ea0a824acb8ffc435ffbf0b1b22fc2a9f94dd640e7ec3c89c6f32a34bde693a6a26fc88b2cc
TLSH
T12BE00142961041AFD03C033000C716793AE6802003B702466D2002A82C233002E24BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e77ddb07ce848d4061226bb06f8822f00d8197186b31e315ca1838b95fb2dd7
MD5 84859861563deeacc1f17e5ea62d162d
SHA1 66197fd45803befeb63cd9804b3181403a7c00ef
SHA512 d004a92ba2a2fb99ecf4fd0ccccb3277aea0dbd2dbd661ca8fbf57d2049d2ed87c6fb64340242450760021eb0b6227fa24e70a8cc7535e969963f00b3c284b9b
TLSH
T1B5E00466A75585AFE43C037400C31F752AF6813567BB065AAE3106A86CA73006E24AD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a2d9e7cf667682c2cdf2c39af35e9414079045f82a828115431bca5cc46e832c
MD5 ae9be738724d2d342a0bc922a7fd429f
SHA1 5262da048164111152a9fe565c31519cff07f3d8
SHA512 3b7eb0f0e53d3f27b91a10387f1318ba0ca27a5f28cfd6ff19618b7c2a25dccf2232d68311f185e38a2b8a62319e53bb2bab4714c081908a01bfd915ef195457
TLSH
T10FE00962975041EFE43C037400C71B792AF6803413B7064BAE3102A82CB33003F34ED4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1059ad7da14f95314dd6e9c5789f8ebdb88eacf81245480c6e1dc1d22fec3375
MD5 5b2a1e604f4535667de26f386be76bbb
SHA1 0765edc1066521b8c3e58b83853289c727cb50dd
SHA512 a01a071ff8e35d7ea48488735212ff847c7d064722ffa5d759bec7d2a27388598249ea442eed73ab71b86ddcf162ccc17f0857a635491ee3117c84275c96552f
TLSH
T1F7E00962961041EFE43C037400C71A792AE6802013B7064A6E3102A82C633002E34BD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b4e5b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b4e5b.TMP
Size 392B
SHA256 5371e6f74a8f3b07240b62b83bcf225f97cfd5f687c9bc0fee2f1eb6cd84719b
MD5 ca625ad1479494b7bf3a76ba1a629bfe
SHA1 993d9e2c2421bd4eb1f0e6461160f343073c7986
SHA512 c34da5919f6a076f796a17b82a435a4700d723a10206eb783e408f2381530a371d65fe669ca9b9472fca27407e222b9d88d1151c9484eeab34fcbbe48117df9a
MD5 SHA1 SHA512

Submit Download

ad4fbce9-65ce-4a35-bde6-9ad4881cd937.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ad4fbce9-65ce-4a35-bde6-9ad4881cd937.tmp
Size 392B
SHA256 faaa021cbbfeac22895165acd26899fe95ddd51cc50d3a7cb2b68b58cc567029
MD5 cff0eae1638776e7dfcd8880a6a401f8
SHA1 71a9f4241a4d933d1dac53da8702ec103421ca63
SHA512 366120272f051153329525775a6d80522158c34c238a28f55e43658752d91ae784329d724e45dc368813da3c6d5acc5f9b893e73c1cbf16b38b45298d5976c91
TLSH
T188E00162971441EBD03C037140C31F222AE2813112FB064BAE2042A83C163207E36AC0
MD5 SHA1 SHA512 TLSH

Submit Download

85823ca3-522a-46ae-b023-43144245ed01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\85823ca3-522a-46ae-b023-43144245ed01.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 c75e6ba33405e1df4fb3b1075d17ac1744b1afcb75fa8c1d80411f1aa20fc85f
MD5 190ce5d73b3afcc3fe8c8393f72eed06
SHA1 7c254b57fcd4d9bf54ec6e136054e537c7d5bec1
SHA512 1fa95b9c7f9908c2aeffe33e16295e4874262b9d22dac5bfe603b53e7c4a25c984256481fcf426d1fc19b90ece46b821e717dac8aff4130b49f5f595bdada3f2
SSDEEP 3072:j3laYoMrZecZ7EfP0PXqRUyApsCJMOUukZPQJO+v5H:pa6Zpm3SXaUyApTF4QJBBH
TLSH
T192B3AEFADFA3893D69FFD02D9A82843EFD262404B3A72409CD53171462C6BB4667864C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 146B
SHA256 2ca0c974c01db0ce1d53fdf49a5b4d25dd5f33b1855781b768eb797ed2b02cb3
MD5 34d45b1d7c6230c4d9aa5490f8471d62
SHA1 1e04ac2c7c57e5c600d8bbce5c11106df019983f
SHA512 bd64e4c938cd152fb5b98b087de99be3d5d5473fe85c5382b59cdcaa3e967ce7a780645c8517ec485618e832e9a5438624a408bca8b811f7d6a4a0b7ee9b0059
TLSH
T1DFC04C4913E8047A574709DFC0524F32911B045230C80A6088E2555E582DBC74983BC1
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 196B
SHA256 9045ba8ce041ac35faadc03316609c9c5978e370ab89def91465b1fae984edd8
MD5 05c39072a4ad568474595c8684e21ce6
SHA1 e82171374d7fbdc4033b4491d14844551ceca12d
SHA512 ffa4e8c88e150007e3815f04c8ddb18f658cc46f34f602ad25a622c7ed435411d05c2bcfdf7d943b27bb0f6e38db6d823cb10c75f53dbafb5df9188cbb91fab5
TLSH
T1C8D0024913F8047A574B49DFC1524F33911B045230CD16708CF2599E593DBC74987BC1
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 90B
SHA256 e08fd4fc0c7698e3c6134db649143b065306cfd5ca3705f2d222ac1cb6cb5a6c
MD5 571ec07b0484c2f838e79e5dc0ed0d50
SHA1 8c880d56a2ed123b559aef1eb01d0a767b732634
SHA512 735a019915fc132659d4d99a5333168aae471a9b29fccaa3525ddca501830d2898f7dc81db310cc0de38dc40eb70ff48cc98ceaa113e283dfd1d485673a352eb
TLSH
T1FFB0025C13C5041E1647026FC7A34FA35107545174D5775044D754CE455D1C34D83BC3
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 259B
SHA256 1e2e1613ee3829abc25b6c2269df651ab66000d74250237b0ed8d8baddc21d26
MD5 ef88e2afb59d65ff6e2697aee931df1b
SHA1 332a6e945328d0eed511f5e884a18e2563da5da8
SHA512 eee65a9fff56ebf705bf1ef0196f0e8cb8360d820280e0971825648db45fc13652da3d761de42c234d7b8da4f8ca31b5f226f3d4257c5d64574087498a10a34f
TLSH
T180D02BDC97C5002A1BC7039FD1D70B51255754627082061044EB98CD481E0A79F832C3
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 306B
SHA256 a04f115c89489e7846603b15ac81b7bd17450ac249c45e19ea91b557d252a9d4
MD5 673b03c810515f08663eec4ccc70dc4b
SHA1 355708f0060e91c5be22dd6fe7a0cb14b2c054da
SHA512 7c8c100975b07d4dabd22f6529d4dd62529857970ff6cd669a2a50ec789d78b3c02b018a342d4efb590823dfdc3743887dc60c2beb2ce555a94c21426064fc7d
TLSH
T167E0C2DCA7C9402B2BCB039FD2DB1B62255B947270860A5148EB98CD482E1A7DE873C3
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 d8f8336d095aae5a9dbb1f14fb6e2fb6a53e6796d627fb2c97944bb3fb15c3da
MD5 adbaf55c6b3547a953499eaf3fbf742c
SHA1 81534efa808b407bdca5f68423cd0c2bd8a6e1da
SHA512 129284ed66ec0c50be1e607f862d0c69fb3b08241280f8508d8f3c7d030dfd59b99b5320fb240ccd292312acd94e6a8af8b4c48abbcb8159e584fec8a54d3a89
TLSH
T1DAA0025B501C5B52C46527646198506FAD614A4025B9E8A96D9A8B84683001AEE78913
MD5 SHA1 SHA512 TLSH

Submit Download

FO1D92E77GWWDBULQXHO.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FO1D92E77GWWDBULQXHO.temp
Size 10KB
SHA256 8ad37523625bf36033c9bf454a28444c56c1be01bd1cc3acce81569e3cece647
MD5 4f6f38da9e0c34ef8001dbc8ade58375
SHA1 24c0c795f02bcc84840a5c399dc6ebde1fb54bf0
SHA512 30673504cbb12baca85b08246ef1535b59a9c157fe3a6394165167746ca32ba6ed82468e0552681fa6a991254c33b5e33c75ce1d6a2fbf7a0b9c404e9cbeac2b
SSDEEP 96:UwYW6HEJWqwetHwWte2DkxJY1c6HEJUuCfQHJY1c6HEJVuC4+Y1c6HEJruC31zY5:ikVtVeifkCPbkfPgk5PAkBIP9
TLSH
T1E82200105FE59B9AF2F6AA739573A301BF76BC058A188E0D1194490A0C32F04ADBDF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 f823cab0cd723add908d7a09294fb93e9e8c88819f50ed5e495f38ad487f48a8
MD5 5364e4e8a7808359fc07bf9cf463d857
SHA1 73fd07266a7b576bd4b5781d866fe7dd6d36585e
SHA512 f2150d03b288b0084225874a37bd4be18eb7a43056db8ff2f416362fde042bfdf45bdd5eda1e75304245f4eb1cd293dc54685dc1cb57014f134993da4b1d7c61
SSDEEP 192:GLDkyPxLskfVDVXeGLskVtVeiFL+k5PpLpkBIP9:Gkypt9hOGtHVPF75x2eF
TLSH
T10C22F2105FE59B9AF2F7A973A573A310AF76BC059A188E0E1194840A0C32F04AD6DF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 90b0d547751d9ab86152a975d7831458260975c8f0017b93e88c19b7aa11b5f4
MD5 70de944bb92e89996283f9fe4c9792e0
SHA1 4eac1d07699e8afd23b6d2e9f86c9cae0a89f823
SHA512 b4b6de8a2fdb4cb37324570916598d18dea058c48cee0d5303da64e82d3b3510fae1a0a2d95dabb2d4ec37d884b691528ed81d82a74c2f55dd99558a2ea4ca70
SSDEEP 96:OwY1c6HEJgWlVcDwZkWlVcqeOwY1c6HEJWqwetHwWte2DkjJY1c6HEJUuCfQK+Y1:skfVDVXeskVtVeiVkCPVk5PikBIP9
TLSH
T1932202105FE59B5AF2F799736573A311AF76BC059A188E0D0194840A0C33F04AEADF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0f4530e571171a08e1faa6a41d80a0818d4d0f95868b4906aec14f9bd7d1e587
MD5 2ffbf24f929f469c39a3828dc9c4906a
SHA1 1bd3b1f36d843b9b14935837a59247722f0e0369
SHA512 9864423e955cc2ee1a50f70073178ada3bb74317968530ef60da0db11fad50a319f16ff479add7de42ba2bdbf89481a9b871d35111c75ad6efcdcef85f5cd47e
SSDEEP 192:IOv5zbo7GZMoyjRc81d66JoztdzgCl6mc0d:zbo6ZMoyjVd66Joz/zgC1j
TLSH
T19BE10024EA29863FD444127BDCA22F410F39359B984E3F1931DC61182D5B2DE3B9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b89c7d3d68c013b4ad535199e3b08e49593cb3c5a0b1cbd322dd18a0fad522ae
MD5 284b8b3a3b4941fa3355dd30d66e1922
SHA1 4474e66d5e44e663765b20578bfd6c63f72f8427
SHA512 7be3fe54d3f552b366a4bd35e3da8a9f4059f9c0165d637df99e8c34e713d00f1fead20cb76eb312a2760ca49fd2b7b3635d115bb61f263d9b62d6a48399b748
TLSH
T19A214C5C39F84E6E59C7E69CB481018E53928E07048B1C470E52EF8DCE85AE9326F53D
MD5 SHA1 SHA512 TLSH

Submit Download

477897de-ec9e-4f7e-ae06-633bf7cc5948

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\477897de-ec9e-4f7e-ae06-633bf7cc5948
Size 235B
SHA256 f84fb15a7d776ad9697d8e8f3b18ff0f1af1353a079664db6ddf76b1a3779144
MD5 82bc5720d088a63e75706f89d192468a
SHA1 d10e48b59b108f75940657d7770cc6482cf7b378
SHA512 8e01c7191b8e82c9a532ed3f0ce4c47906fc9f47b4021e3df34d698df8c0187826a5a989b58574030a5f54262d8e8ecabdc495aa1c4f996ff711c3bdd36485d3
TLSH
T137D0A7C514987BAD88145F17F0E169D670988C3364B4A820DB9159799BFDDC88252917
MD5 SHA1 SHA512 TLSH

Submit Download

499e86fb-2bf3-49dd-b566-676996a3dc19

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\499e86fb-2bf3-49dd-b566-676996a3dc19
Size 235B
SHA256 f3a2838a3a2b8417ef9fc1f91ca4587878d8bd563990aa9cc74f9e205e2a2ce3
MD5 99f5e6ae8a80ec5e9c38b823878d803b
SHA1 8609f6edacbc74b68907bc10cef439a8218f246d
SHA512 41bc0a59cd34190dec26332a499c451ac5101a0c85eecadb633daf228e5293367e33603ea34f4e37ff0ef8089bf171f7ebfd779edb143e6d05b13874271ea659
TLSH
T1D2D097C41498332D88000F07B0A0FCD330858C3314B49820D6900634AAFCEC8125292B
MD5 SHA1 SHA512 TLSH

Submit Download

9a9c9441-0edd-4482-ab95-66f663d3e077

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\9a9c9441-0edd-4482-ab95-66f663d3e077
Size 886B
SHA256 64dbf14db928755d8dcd93a9c29e37b381bb62e2a39e385f59d5e96fea3f8176
MD5 6e2014a6aa5451db6d4f13c1981641d7
SHA1 015f9ccf70de922b40fab1d1408321f5e6750775
SHA512 561860758fcfd58bd7ef69cf6be688320bd87225a2256f3484fcce06bbbb3cdeeb50a6fc4f4292fac596f083bc035439319667723828f74b6e0b6cb92d9d1a87
TLSH
T1451104519735B5B3D868D29B94907B438BD47123C0CD49183DD1DB180DAE51EB777707
MD5 SHA1 SHA512 TLSH

Submit Download

acbc2d52-109c-400c-9632-58689a3816f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\acbc2d52-109c-400c-9632-58689a3816f2
Size 883B
SHA256 ef36b09bec93171c12b5819778750caf9511cbcf928df87354752a0df4a8506c
MD5 cc5df3b1d2ce174b9dc0d67d7f147528
SHA1 b69106ee00e4364941043c71f64b6ab4ecae959f
SHA512 9ab80352bb60c9cb8253eb0476978aa81be795373067e7f5efaa9e26d0a8adb5c19bd83ffb2fce5bddb75eeafdea29167313e95a209a6818f6baecae0cb4a6ac
TLSH
T16A110055A735BAB3DC6CE24FC8517B038BE86623C0CD88047CE1DA080C6EA1DA77760B
MD5 SHA1 SHA512 TLSH

Submit Download

bf4c7ac3-c80e-4f70-8046-3b24694e90f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\bf4c7ac3-c80e-4f70-8046-3b24694e90f1
Size 2KB
SHA256 f734e9b38c823e49988db660cb9f1d75f186e66cdcee30cff1e60fd10747169d
MD5 f82c14788309824863cdd67b260e993e
SHA1 90aef07e34aacb54f6652ade52c76588bce360bd
SHA512 2aaa10218ab3b8e01fa0afc67ae544085a528cbb6feb5d9f98095a66e660e87125d844be615fab3832d34cddabaa67263a7d246ee5eca69d608ffd545e0fe228
TLSH
T1AE41212C75788D7BECCBF15D9482338E5B248A0340C618835D51EF0CCDDA69D637A42B
MD5 SHA1 SHA512 TLSH

Submit Download

caf818de-e4a9-4940-909e-0c8e9c103b8d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\caf818de-e4a9-4940-909e-0c8e9c103b8d
Size 16KB
SHA256 d757b36018c69122cd43d23193b7262d961421deb2018b59cb17adf9b31a4c13
MD5 1166f0508723c9bc4a3a124a26adf3d3
SHA1 5dfc6390c7b671d366adeae5a6b57bb45589ee91
SHA512 5ed3404523c48b4aa6098bb2fe4f19f7302203f31488e026a3c86ed53eed42b9362e4a7fa2ed1214433d0644bc317647bf9bdd97fb3d06310f45723906be6cfb
SSDEEP 192:2N1ArE8dgp5W1jQBy41yvCP1ZIBlIbYJIO2cricvEp1R4QdUGoRrDi4F1DtHVbKF:2/AoBp6QA49PoBcGimiA9HVbK5R9916y
TLSH
T12772DB562860457AC291E36998FCBFC7E1F624CF4C419FCE9BE4BD0819DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\prefs.js
Size 6KB
SHA256 deb5b0ece023bb4058e1e59292bbf3794a73d70cdf5e80a6c9409ad7f9a9a56a
MD5 bd9b916f198e3b89c767d12b5d716dfa
SHA1 d16b788819eff72125bba83189fcebb15fa4d4b8
SHA512 78176ed5e404e9cd465c18ed56850a45977dc1bb89416dbc2c17b798758e82c0cb5c4f36d01c1980a3dcb96a2a7361e5b2baaa5f05252becf4fb6dd3f42a5769
SSDEEP 96:xHMUTU2qGqmvfu9H1zSiYSSledv9jzn2rHtQqMBw88u8L4cncQ1CKQ:2RRIfu9HHYSSDTtaBw88zMb
TLSH
T120E12E789548CB7F64B6776C6C6888315AB2023BBBBF28C750B95484054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\prefs.js
Size 6KB
SHA256 f3edceaaa5228856ae0f9426a585d9ef71ff5cdd74e898de519f3fa675b584e5
MD5 2a35b46f34e5d53655baa06dca104530
SHA1 1bc542959c24efa4f4046bdbf5b96b08643276ad
SHA512 3957d4da7f19d515cac0256cb22be2c3997937e5ca01e4f458a9c383d9585d6b530e2dbda304317e0453b703b58d2665d1c7ead1ae9b079c7adb57017216632a
SSDEEP 96:xHMUTU2qGqmvfurZW1zSGSSledv9jbeWn2rHtQqMBw88u8L4cncQ1CKQ:2RRIfu9WHSSBNTtaBw88zMb
TLSH
T146E13F789518CF6F74B6776C6C6888716AB2013BBBBF28C750B55484050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller-7BGJKF2WJT.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-7BGJKF2WJT.exe
Size 12.9MB
SHA256 0c46c7041e530a39483f7b2c956811aad71e2c9c3f2c76d1a826867e2e50946b
MD5 8b59097de0f1a00833610261abc9d25c
SHA1 f695b490b69f7feb6cf752be2a5384315646584f
SHA512 0be5618cc568d9808defc3b732222f509f5f6a09ea9b5f0d353946281fe1a1c6a7c829f480425c61f649279a8a67ab62669e873a4fce613bd0b4424c91ea9e03
SSDEEP 196608:9saZFAPLVTWdfAKCF797jAA1Wlm645lEqfR2dE:2IuVTvKCFBjAoWlmE5E
TLSH
T130D69D6AB2B800E8D4BBD178C6565617EBB1741603709BDF1AA086F61F63BE01F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download