f3c6e3cae5c790bd87050cfe95f4e6df5c1d75cd9cda745d94ef88f953a11884

Analysis

user interaction
yes
max time kernel
44s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxStudioInstaller.exe
Size 9.7MB
Sample260925-tp8aeass5j
SHA256 f3c6e3cae5c790bd87050cfe95f4e6df5c1d75cd9cda745d94ef88f953a11884
MD5 1af32d57481feea13059c4a5e4a88ad4
SHA1 5cb4ecb9f5455a037a47c97ca88e246e91029f9d
SHA512 80a79ff4071a16d2b9d8fda93eedaa198b5682f9e27e005c384fabd12491041b03c0adf6f1fd4a0e0bc890f7e7c5870ad534176591195891f7d08fb28ad8c849
SSDEEP 196608:QjpoO6empKfLco4G97msxy3Sd23X+dccBfHYlUBUTSMn:Q2eQKL7msxzd23X+dZBfHYdL
TLSH
T1EAA6AF22B900C032E9C200B2D6BDAFFA997D99341B7954D3A7D41DB959305D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioInstaller.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\BuiltInPlugins\Optimized_Embedded_Signature\ManageCollaborators.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\fonts\SourceSansPro-Semibold.ttf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaChat\icons\ic-createchat1-24x24.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\avatar\compositing\CompositLeftArmBase.mesh	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\avatar\heads\headP.mesh	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\d3dcompiler_47.dll	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\configs\DateTimeLocaleConfigs\ko-kr.json	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\qt_translations\qtdeclarative_ja.qm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioFonts\NotoSansCJK-Thin.ttc	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\BuiltInStandalonePlugins\Optimized_Embedded_Signature\Gen3d.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\qt_translations\qtbase_fr.qm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\BuiltInStandalonePlugins\Optimized_Embedded_Signature\AttenuationCurveEditor.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_move_2.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\icons\ic-arrow-right.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_3.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\InGameMenu\gradient.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioFonts\SourceSansPro-LightIt.ttf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_1x.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\fonts\families\HighwayGothic.json	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\graphic\Auth\gradient_bg.jpg	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\avatar\defaultDynamicHead.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\BuiltInStandalonePlugins\Optimized_Embedded_Signature\FindReplaceAll.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_3.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\graphic\itemcardbkg_dark.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\avatar\heads\headF.mesh	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\fonts\HWYGOTH.ttf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\sky\bn.dds	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\dropdown\gr-tip-up.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\graphic\album_art_fallback_blue.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\fonts\families\JosefinSans.json	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\avatar\compositing\CompositLeftLegBase.mesh	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\BuiltInPlugins\Optimized_Embedded_Signature\ViewSelector.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\configs\GameControllerConfigs\gamecontrollerdb_new.txt	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\api_docs\tr-tr.json	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\libfbxsdk.dll	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\configs\DataModelPatchConfig\DataModelPatchConfig.json	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\models\Thumbnails\MakeupCameras.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\models\Thumbnails\MakeupEnvironmentST1.rbxl	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\qt_translations\qtquickcontrols_zh_CN.qm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\category\ic-top [email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Network.dll	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\fonts\Oswald-Regular.ttf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\fonts\families\AccanthisADFStd.json	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\content\sky\cloudAdvection.dds	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\dropdown\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaChat\9-slice\search.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaChatV2\ic-add-friends.png	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaDiscussions\[email protected]	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\BuiltInStandalonePlugins\Optimized_Embedded_Signature\StartPage.rbxm	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\QtitanOffice2016Style.dll	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioFonts\BuilderSans-Medium.otf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioFonts\BuilderSans-SemiBold.otf	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\StudioFonts\FiraMonoLICENSE	RobloxStudioInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxStudioInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxStudioInstaller.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxStudioInstaller.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2360	msedge.exe
4768	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioInstaller.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5240	RobloxStudioInstaller.exe
5240	RobloxStudioInstaller.exe
5240	RobloxStudioInstaller.exe
5240	RobloxStudioInstaller.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5240	RobloxStudioInstaller.exe
5580	msedge.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 5580	3896	msedge.exe	98
PID 5580 wrote to memory of 3840	5580	msedge.exe	99
PID 5580 wrote to memory of 2360	5580	msedge.exe	100
PID 5580 wrote to memory of 2244	5580	msedge.exe	101
PID 5580 wrote to memory of 2308	5580	msedge.exe	102
PID 5580 wrote to memory of 2244	5580	msedge.exe	101
PID 5580 wrote to memory of 2244	5580	msedge.exe	101
PID 5580 wrote to memory of 2308	5580	msedge.exe	102
PID 5580 wrote to memory of 740	5580	msedge.exe	103
PID 5580 wrote to memory of 740	5580	msedge.exe	103
PID 5580 wrote to memory of 3900	5580	msedge.exe	104
PID 5580 wrote to memory of 740	5580	msedge.exe	103
PID 5580 wrote to memory of 3900	5580	msedge.exe	104
PID 5580 wrote to memory of 3900	5580	msedge.exe	104
PID 5580 wrote to memory of 1648	5580	msedge.exe	106
PID 5580 wrote to memory of 1648	5580	msedge.exe	106
PID 5580 wrote to memory of 1648	5580	msedge.exe	106
PID 5580 wrote to memory of 1868	5580	msedge.exe	108
PID 5580 wrote to memory of 2952	5580	msedge.exe	109
PID 5580 wrote to memory of 1868	5580	msedge.exe	108
PID 5580 wrote to memory of 2952	5580	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5240
- C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxStudioBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch
  2⤵
  PID:1816
- - C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxCrashHandler.exe
    "C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 1816 --attachment=attachment_0.740.19.7400931_20260925T161634Z_Studio_C3B4B_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.740.19.7400931_20260925T161634Z_Studio_C3B4B_last.log --attachment=attachment_log_0.740.19.7400931_20260925T161634Z_Studio_C3B4B_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.740.19.7400931_20260925T161634Z_Studio_C3B4B_csg3.log --attachment=attachment_log_0.740.19.7400931_20260925T161634Z_Studio_C3B4B_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.740.19.7400931_20260925T161634Z_Studio_C3B4B_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.740.19.7400931 --annotation=Format=minidump --annotation=HardwareModel= --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=07c234fd1c25eade6b6d878706568f9f7e5b22e3 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.740.19.7400931 --annotation=UniqueId=6300272409146307983 --annotation=UploadAttachmentKiloByteLimit=10240 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.740.19.7400931 --annotation=host_arch=x86_64 --initial-client-data=0x434,0x438,0x43c,0x40c,0x454,0x7ff659d57688,0x7ff659d576a0,0x7ff659d576b8
    3⤵
    PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\EnterOptimize.mhtml
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\EnterOptimize.mhtml
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffa2b67c188,0x7ffa2b67c194,0x7ffa2b67c1a0
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,8945066983707888941,5513796354461972512,524288 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,14562535411391938638,6327086866491063363,262144 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,10779861515679138575,2224866634040563162,524288 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,10918208353221776413,1716962229073505934,2097152 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,1599918342224321008,10395238960842303674,2097152 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4804,i,5278698767441459414,18217267052038645417,2097152 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3308,i,9484373746334318250,17519297980390173380,524288 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,9413063906867706483,10391582726963445689,524288 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5620,i,5355137381572395650,13242271269099202967,2097152 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6040,i,14116463504475029277,1085683217136075958,2097152 --field-trial-handle=2640,i,12013091309929641104,8853772384011190151,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa2b67c188,0x7ffa2b67c194,0x7ffa2b67c1a0
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1379565693670846657,1008499961024616249,524288 --field-trial-handle=2316,i,4616834540237916658,14476085777819384832,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:3
      4⤵
      System Time Discovery
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,10474334823846669939,12530069905328630450,262144 --field-trial-handle=2316,i,4616834540237916658,14476085777819384832,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,2606536431306587680,7434909749832781847,524288 --field-trial-handle=2316,i,4616834540237916658,14476085777819384832,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,8401300420502703990,9880431279876104598,524288 --field-trial-handle=2316,i,4616834540237916658,14476085777819384832,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,8401300420502703990,9880431279876104598,524288 --field-trial-handle=2316,i,4616834540237916658,14476085777819384832,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
      4⤵
      PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x4b8
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Qt5Core.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Core.dll
Size 5.8MB
SHA256 949fcef46755e5e26798ca082c18ca97146bf485971895d8813652be3b16b217
MD5 5979d6d629dbe9bb074bf2c771f22499
SHA1 a28a748f5fd712fdad425dbb6f1f53c4b97bab6e
SHA512 5c296a8eb3f48ca741bef70e44aa6103edeaf903637c83fd9695e5be4465188a0aa5d5d2c4b707cd5233c0a19782e2857b11aca1ef33e408ff0b2e1cb739fd15
SSDEEP 98304:Zp4b13+8FH9aoHVJsv6tWKFdu9CwjiC6ExqfUCAgw:Zp4b13+8FH8EJsv6tWKFdu9CwjEExqfi
TLSH
T1E7568C8776AB0254D0B7C23CCA97811BE672B8018B218BCF126CA7495EB77F1693F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Gui.dll
Size 6.5MB
SHA256 a1a0ac060c81e821ad406ced6f1aa2f98f8aea3dbfbd4891a47892e2069f255c
MD5 b8a2735292a7d9d69bc4a09da80a5f00
SHA1 0d3691aaa492bb5b8a1f25e00d5179894f2973f5
SHA512 4103ee4ac9ff72bb766a4dd5bc1b2e3de0ab101de3b19c787856685301a9829c20f75785ea4243bf62ff5e33dae07df6c47cabf84cfc69bb84d8ea9277b7349e
SSDEEP 49152:GxTskH658roWctQZMvBFlAdOqymGH7tTZDsY3hotW6pgCnuoyiugWam/5zmKxwJR:aTs4oNyKVlaWGuraUeJrZxcZ
TLSH
T1AE662986725A6252C977E27E8B4F452EE1F3785283428BC748159B480F737EA1B7FE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Network.dll
Size 1.0MB
SHA256 6fe790484be9ec527b123568b104472651e4da03f3c23af71dbaf22af24ae947
MD5 dcf774c4da98b2142e2db51b5a86b510
SHA1 e1481f0af6accafcedc683d69ac6ea47a18dc782
SHA512 2b6094586c95c9701aa5172a40423e585cf74e15bb41735180ebce1ed42479c14e8a51fb73b51cfd8e7283800eb679fc1b8016f25107e4670ff11279e08312e3
SSDEEP 12288:3KmUigw+uCeCrGwtfA8v7Q5EGiVnBOzXvEfZxgzwyU1DC9:3Km5guCeCrdtf/vMKG20YHgzwN1DC9
TLSH
T1E4355B57B36103A5D46AC1B9CA8B8616F272700187279BDF5629DF693F337E1263E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Widgets.dll
Size 5.3MB
SHA256 c67dad83dae1648f38dbf04d82203fd3795900f292b24f5df06b63eb54957367
MD5 e0f661dbc795f2794a392250819a803e
SHA1 01b41f59675e50074fc16267e5265659ad43e199
SHA512 1ebec23d6439152f6b00b87002c0df67dcda52b255a9f1a44a4629423c6ecf581a0b78e6aa6c3f5b5bf7846b3af0c3f5319d07142ab69e2f268972a77ca33fd6
SSDEEP 49152:MHiz1l7ZWKSwEaNjsSvVFrta9oxH57t/5yE6fkpQEVE5llmbx/qUqjfQdwXtmLu8:Nw2ELwHkWSUbdwXtmLuxY7pCQ6E
TLSH
T135466A5BB3A54195C56BD238CF8B8613E6B2700447228BCF256A8F592F337E12E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\Qt5Xml.dll
Size 204KB
SHA256 0c60cdd1f00a1f28a56600258f7584795c24ae571fe7981cb0a8714a7730392d
MD5 5a283d1709c6dae688f071ca0c092b48
SHA1 57fa6cf1fece16ac0cf29323ff8ee5cc49044952
SHA512 410fb85952a9dc98f80b3ecf87dc4d9fa22ce4eb27983dc1b10919130e9d2ddeed64e199f72de69edd4ea9060aaab6f4092cb1241b911043ad3ffacf02386197
SSDEEP 3072:n1pI5DweOktRkjiHRv6XG1/tGACswdqB2dLKskgCjHT5Dn9S7Y4OlK:n/IZweXWoRv6XG1/tdDB2dYz19S7
TLSH
T1EE243A4777254596E42BC238CE1B890BE6B3B8501762DBDF81558B792F33BD2B83E250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanBase.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\QtitanBase.dll
Size 1.1MB
SHA256 6648c8b957438f2347650faf24db6cb357670a3f17785bc1a01c833992e9c04b
MD5 c7be913e6e60f367b872d6df72a3e33f
SHA1 c925c99442a7a2d2b21e6d9b17827395d0e0f609
SHA512 f27ac5b83eb94275765326f1e37eac23aadc7e2cf496e430f84c79cebb13a56783eba7efbda33bd17dc0af37aab64d79c09e5646d82baacaa4128a35e1883f4a
SSDEEP 24576:8zfUc8wqLxv+otWr8wY6S8dtuTbwQusPvsM+S:Scc6xvNdwVu/lvsM+S
TLSH
T11D45AE4B33964356D16BC278C69B8114F477341197438AEF9A1BFE2D1E332E1383BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanDocking.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\QtitanDocking.dll
Size 615KB
SHA256 8c2d9a85cd59d745a30a8f751711d24f52d6040b74b0dd4b616140f7dbcf9d9a
MD5 92f76dbf7be4d37f870705a4896cea14
SHA1 52d358d954c7aab62f215686adf0588f37c8e4dc
SHA512 e0803c52ebf69907e75ce0100cbfee195f9ebeb0febaa58e22133968ba8508fdbe7f4c8212672d75c5e91c3fb9934a4e0004b9345f58c223e5c510c549f5aefb
SSDEEP 6144:Bgrl+UK4SXZcUKzbw19sweH9f0vLmBIX75ZTi3Ilx2W9tfF1a+tpqouMIBKhgl3d:BOwUPR72SHlkLqamF+Pqki
TLSH
T1C4D44A4B726903D2E067D138CA67C526E5B37851436246EFA616CA2D2F33FE13A3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtitanOffice2016Style.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\QtitanOffice2016Style.dll
Size 217KB
SHA256 b0de38e2af6816a15346256d7fdac98cef86aec0793bc6453fa9b7f4ec4bf3f4
MD5 bce9cabf64d242fe45ab70ddaf618e15
SHA1 39baed9cb9ee7f4a10d7404de78d47a192fc5fea
SHA512 025fc1a711a110bd30939f9f818fdf9bf5ddc2c66f963c3bb0135f164243e698dc35e7d65bb0da9fae8d8e0a2d0f3be959d00e989f2cfe006e5cab718fe11a69
SSDEEP 6144:HlwWygSAAqMV0LZPHIZCfY4Ra9B06WnZwfwP8o9+3n/CXyLSPE:FwWygS/eJX
TLSH
T1F124F70BB2960796E467D278C68F0125F6B7705483028AFF052BDE7A1F33395BD3A985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\WebView2Loader.dll
Size 162KB
SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
MD5 e2f9d2ef3446e70b50de50f577c6939e
SHA1 48e7721704249cebd1267280459b7b36ce99e177
SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
TLSH
T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd-win-prof.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\dd-win-prof.dll
Size 3.8MB
SHA256 1e5998697cbad5d9800428bec8afd88285f7411fc05de9cb9453e776b01ee6f3
MD5 a0e645c21b4e8e8499f6e4af644dfe2b
SHA1 22c8205d8e5f40cb1688243df10ddf1c813a184b
SHA512 05a9f2dee061499527b615cb34614aff0eb150be3ed567614b9facb28cda328088b485a524e7402303c00c8b35da50cefac14b97b5d93d34f61b059cec3d4ced
SSDEEP 49152:LMbMlAt7HkrfnNhiM46GB8vGM535GN2j8dlZCEbIw0zUy+z/N0yooA9YIU6ieyV+:LXN0B8HoCzkxooA9n+
TLSH
T1D9066C02BF86996AC09DC874C34B4B638B2274CB0B35B6AF42D541253F6EBB15F6D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfbxsdk.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\libfbxsdk.dll
Size 9.7MB
SHA256 1ca21010e6872b44c0627dcc244b9b26c5879a97617e7b7c0b304939eade1f35
MD5 51d82c0e8ad65126413ed39246b5cf46
SHA1 f73c0b2248ee11f8fde172e04c64b40452051521
SHA512 c60362c4a67bd11ee330d36ecb1a58d7619989072b48b652f9411884797852fca4805ea1aab77546b1d7fc3c158beb30dc6aef0f7dbfb99322affdc8dfec014f
SSDEEP 98304:4Zrqd/tYrwiI8gpR241UnQQjHNA256IJymNfJjWfELI1u0/QHnq:4ZrGewiI3pRf1UXNAUiF
TLSH
T103A67C8B227642E9D1BBD13DC9974903E6F2304117369EDB02964A6E1F237E0AD3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\msvcp140_1.dll
Size 34KB
SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
MD5 d433b3e8aec25afb1c65cccd97ddc7b1
SHA1 ffebb57d0bf8cdae0449302a691920cc22ed4a72
SHA512 b1d48de56a595ddd6fed36574f0d6f20fb21d047ef7a6e93a487d660bcb1090e45c6aed43a99bda9897c1ef524bd8032b33e35a48c796d3f467caad33f5dcff9
SSDEEP 384:FKzh5dQS8DzxhK4KWcS5gWIZ1gr4iSt+eMifX7R9zUkJCWEIHRN7/PFbR9z181q:FAQRDzxg4FMgU9nF9zUet/b9z/
TLSH
T13FF26DC5FA688443D866483082DAEE47BC3DB7D25F6092DB1392F25C0D937C5EA35A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files (x86)\Roblox\Versions\version-c792f79abddd41bd\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc826aaa75d7da810bfdc30a1671df54c18887a7ddc779d5b9f03835587852b4
MD5 77e198de5db1473b46a54bf11e90ef65
SHA1 d40423f0ddb590b81cb9016394df150361acaffc
SHA512 208c9def9ae2c86b2de012eeb71379c0f243edb53a958e991a05233405a4a20955e43cd9ddeb6944b19a1811ed512d3123f7d75ab4ca5b9a71dca6edca139ba2
TLSH
T1ADD08028B57C7BE4F03D353D0224414C31CD5AB156067545925417554FD155315D48E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 552e1ad08d2eeabe9dbca240d65ad5393ba188a48b3cacbe04a213640cb6f11b
MD5 e268c6cedbb49744b1163b1b0c17ae77
SHA1 3ad33dcc18691a21a1e221051336fbf7ce7e0329
SHA512 33d4cb2dc7604f0a3f0052238cdd208ab359c0665537249420d827d8c7693bd712f556457deb1b771ad1ca023ed8c010b8671b73473edce23f89704974be02c9
TLSH
T140F028B9C821FC3B18FD4B7961980B46FB50232B2B81984B3B3E910C8FB053B468592C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ed2a3b305ef74096ce3a5b5f0ba662ba02b01e345e3858d3307475cff3ed5a58
MD5 c3329ddafd18998b94988b5299c0f7d9
SHA1 bb3cae8b62a0a8e21eafd3aecee7da488f2646a1
SHA512 9df4ac6442d925a86d00385a0470e9d3e42b498f11dfea008f7f93dfafa52236f6688daf3310080278f8be27d68bd36cd95d5a09f90a15ce10b8f08f5e269d57
SSDEEP 768:eiV38fQp+mdOaxXce0e46d/IOFPmzse4:eiV3iPaxh0e4g/nNmwe4
TLSH
T17913B53DF6819E95FED2447E489B4AFD633CD86DDFC0E0234228F526436931A5ADE841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 8d3be0e6e3297c114fb1dadf71520d138dc6396c43c345f42a509b88618108ce
MD5 f7dadf7aa95bc135da545dabd01960d0
SHA1 e8ac4a25a4ccc39c2fa3e3453461d7ba2cc70458
SHA512 2de9c4e8abaf7a83851db49544fa23e4eb5576746e747026bf46f7ffae287ea29279fb61dc1508d3a1045af53c0d0d421726ac552a65cf1aa2ebbd001fddad77
SSDEEP 3072:F8CTVL/lL/U+xUhZL/ZL/cL/9kckTcDmsIUGaa3dc6FHYKyajD:qAVL/lL/iL/ZL/cL/9kAmRaq1aS
TLSH
T1EAB4E7F30A52A00ADF6C02F693163E3DD277460D6DD1E9E6D1781C812A39F7366B9AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d4dbde27f1d70d0d70b86873f2c13fe58ca7396515fe3b076f16a96eccd4379c
MD5 a6343c43042c528d1e9fcde504538a32
SHA1 4ac5f37cfaa97673c9d7e9c9bd96f182363c1e67
SHA512 a097222fc22f41cacc45e3c3dd1ea70adfcb0292d6e2f5dcf246d9c292f114e89c95548a39a1670279438853f2e77ccde452f36c3c5280186422ec9a6447af11
SSDEEP 6144:q9W1fmmL5VfdLLMglcUImmDtb1Gq88p6Vw9KORQHMr:qfmL5VfqglXiuVYnRkM
TLSH
T132256BEEC7682C82DF6B87B0B0E0D9077E702182B65DD0D39944C5D897D6B8576E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 ccdb2e04f26b1549fe8b83f40e85669766a94eccc5b849347ca5615728ed9b72
MD5 391f717d748f405ac9d5b73c5e77347a
SHA1 ee04f747147d6f83b5dd9d396af650560737ad8c
SHA512 a16ffeff902ddbed025c8ebab2df9edbbbbe5681bcfba722c019053fbcb42c06c03a947a80018c820cc33b4025ebde741ef61db7bcbdf4858f63bf3fd346f1a9
SSDEEP 24576:REresmD22j7pG5MVKPUg6YqTISGn/R3t9u3diMUs:irDmDPMyVeUjTISQ9u3Lv
TLSH
T183864AEDCA7858C3CD679A30B4F0E9477C7413C3F5A5C1E68888C584026B7C5BBAE669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c569698bb7741a5557ac06c2e4af7d5f864360f1ccbac8e2ea39358e7f2e4ee2
MD5 dd3c43ed3a677f34acca70091ff1c6ef
SHA1 b219e72bceb78ea2d3b6c94d8315d22973c5e3d0
SHA512 2c9eb18cf37bccbdd4739436fd09624b1018a37b7125c68efc26367fb07720aa33b87a6d60615d057bb7193e786cda3f89152670a04845303c6dfa9e55294008
SSDEEP 96:gmSRcfdLCFoyXEA1SeHnqQGlP/TWt/4/frTnHEkyAfMWtyi1qX:7SGVuFhEESsnqBlXT+/4/TzHE/odtyd
TLSH
T1F1B13B57865D4468FFBC79B062E598EE353D142F9FA3AD838093E9FA9B7339411C8104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59a445.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a445.TMP
Size 3KB
SHA256 e696afbe010caa785da17944432d3bab86cee2ccef7feee1637304db90e3cf04
MD5 d9b8a3ce717a16a2488213cc87fd9460
SHA1 7721032dfa2e0419e4c5ea61150d0fd2a9dadc7f
SHA512 0ee989ba05d0516532df9516f9b7b5e050b58466e268862e1539032662b2ee6be8c34d6e81257b4a0eb2f408a869d304920083f1e1e97c1da8de97fdcf179be1
TLSH
T12B51C861D7544874FFDCA570A2E4A8BB353C4942DFE3BE8384E6FCBAE89A3146200204
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 0af00b08e25e5dc86343b86bd60848ef1026a427d9b12ef84e5a6a61def661d5
MD5 942de2f3861c38a622952f8c0fbeb79e
SHA1 0ae14530d8ea3241a7f4ab6ab2e1ba6c9c60deca
SHA512 374ba88d9654af55386c49ce12636525c9976676b47268bc0e4b217b00af10291df136d9690e2fdb473eb55c4fd5deb9cff02a519cb50a76b196141716024282
TLSH
T1F8E0260C44CAC129959868D3837C7729C3D03ADBF38C3E0A170ED888A143342A38E285
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 f435e535d04066481c13b2a1976c44a293f8b1086f7da21aa4515f701784ec63
MD5 485f4685d0882b4e6a27eee06aed201e
SHA1 3b69e04783031ddb695ff870ae521c8addd5b886
SHA512 d9adbd6a1e889262f2a749e0183837245421499fd1b9e7f978e986d8aae53f57f54812338b630109ac526bb702b2ee509cde883d9a7ff87a2ca474ee44a8e787
SSDEEP 48:uzBmw6QU1Pzp+IAwLyUafzBtO2/PoP/IpZDbz7VTB501xWBQHlFYbcSCIApz:6BCxnAPpB4P/a/NTBO1NH89tAl
TLSH
T10A92E8631B70BC13EB505EBE392A293D8E3FD2899FA6DC903860646149B556190398FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 aea1260e48349679634b7c8b688edee1b19956ad755f74b65a38c46dc2f83745
MD5 fd53a585fc3b76f292ec298990bb2cf1
SHA1 f258794545d59598783fa5150bbac80e0d7b474d
SHA512 b460869469f91f7ac14b585931ef882567d4ffb54403cdf0cd89799bc2176f06aa8e62f0ae42878f777763f47513af1768fec48d4c8fd706d3b191bd7e076cec
SSDEEP 192:nKAAf+G83uy3Ct7XBBK0oAMH7DXspU3iD:nZA/83uICtTBB1zw7DXspU3iD
TLSH
T18D142F1E5F352712CDBD917669E744A35D6CF03B8B1226DA6C6114B0CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 912B
SHA256 431d3c7c5e430014a417ae428a401784310cf2aa41512fbaf0a88e0a3cb3f54f
MD5 3601864e851ee199545e96f1783bb8ca
SHA1 2d7237675a37e45fbf47bf23890fda5a9cbab962
SHA512 b8ab40989890d93045fb5903cde4eef13c30f5648469b95f567235f7bb5b9b0657fcc9cf632811fd4e18ae8658418fce1291c575e89ae438b52fe2f561dd93b3
TLSH
T15311ABB3150EA414EA42CDF01225FDC8D3AF606E2CD1CFE6C0595D0A1ED50B931628C1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 ab20ac66622a9380d8ccaa1b284901298abfa633eaa85e9c5fa40d69cc98f4d4
MD5 857945a63b59ca9e9788e6bb0475d973
SHA1 c201eb1ca565912f882509e369f1d62e445d3a54
SHA512 ed24d9dbd0be52362bb6ec3d403131cac800a246b6e8d31adca6ef18fd1842f0d96da786611eddca2fd4585e07af22fde37a82325c2a978a04c19c0b8c20f8ba
TLSH
T1CBE0DF6456DDC12A67C8A4CBC239BB18D3B03697EB8E6F021B05A885F10A005A38A2C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 c4e538fa8c76baa9230288c0a087e792c7ba66254e4b9ba25bc1b28cf469369e
MD5 c9d9f3f61bcae5b682ffd0d51d136a8d
SHA1 274b60df05c75671291e72b1b060390707a9a5ec
SHA512 d6b8338aa98eba38b752541cf1a731dc8e31b9c3aaa60418fada4fb58cfbc19215c3752e7ed1d0bab7ea217832dbdf3936a6c6d70d3cdbaecabdd7cc61bc2e34
SSDEEP 384:iMvmBCaHjFeMSBQGFejSp0TuloBSzCzn6lXFx62M6G:iroGjFeMS2GFejSpguloBSem1FEqG
TLSH
T10FD23C1F2E723101C3C762B28DF7CD93F96408335163E8AB20B659B24DFA557BA13596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 449a5d38de3f9e9919cc3154b917b9e17cd09e7de1a9aaba8e52cf11218f0dfe
MD5 82623cdc44a82015e5331a8aa016b230
SHA1 cab1680f5f25a4a85fb594c0cac1739fc1b04ec7
SHA512 62c2fa92d0fc0bd43fbd3def1c26b66b894dfd654a001f38f3338db0ce23efd62fa1ef85f881614099722fcb4c7ceb6227bdbb790b570ece82d19d5988915fa9
TLSH
T1CB51BFF7C3E8862DC91156F0AA187E2BCE1D0955832C3D5AC4E4AF1B93F2471E141A9E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 172aee6310bd592e95c2630175878db300666bfbafed4d979840def37f13aa76
MD5 e733f4c8727da4b5fe0318e3791ad70f
SHA1 42bba3cf91dff95894288c21afcb7828612ec4f8
SHA512 152b17f90368f0a4c79513a1ea100477fb50a0ec66f0d94498542fcd5f3c05437e3e232cccd7eb4d7f5fbfa6f5e965018f290f50a153d6b99e4aa4edef0ac2c0
SSDEEP 384:sxZjvmzF/fEsoWv1OPkbLlHbNo/tS4kJtJkxofrl:sLvmzF/fwY1NbhHbItS4uffZ
TLSH
T11272D75A6924957B8CC7D619FF357F62D3F9102398914E8CAAFCCA1C14EB6ED220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 12bed180f2b0597e56d28b9928f59d1d94b9035cec8434248833c68bcc824c2d
MD5 ee70de9705d1b6335df8f4a9406f646c
SHA1 286da764045732c3093f736faf930e4a1ebe0b3a
SHA512 469474553f02bbbe1630359c6b3e0b5125b05d777c708648759e9c910e7e76965222bfb4fc760b82615f6e5df288163348def6c13a003d93126fe10990948e09
SSDEEP 384:sxZjvmzF/fEs+Wv1OPkbLlHbNo/tS4bJtJkxofrl:sLvmzF/fWY1NbhHbItS4PffZ
TLSH
T13772D85A6924957B8CC7D619FF357F62D3F9102398914E8CAAFCCA1C14EB6ED220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 408284b8f7ee80221fc60c19147f4136e13e1d9913e23ed956c530f87cb2b9cc
MD5 858f14e72a62e99a80c2bbfbd97aaf8f
SHA1 4948597848318b560151e04edd9f4951f9b224ec
SHA512 8d178ec81c570decac9b804398420a8dc668caf37bd1f216bbc1d743fc951584613a92f104a68782e960a79b7233e7d3a7d77aff373116e09f75c50da58be4ea
SSDEEP 192:sxZjRt3F/fEsgaQZLj48fiAKodp4CLZHW6+WNB9S/Yox2S4+RIgjtJVJ:sxZj7F/fEsZOPv7LbHb2/uS4YjtJ/
TLSH
T16842D8596D28693B8CC7D619FB15BF52E3F95033A4950E48AAFC8B1C14EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 73dbcfd317a442f710e356e9784c3a3293aa7e025f2244dd0feef1b9c0ef7f14
MD5 12c5259a5cc9d36c3614ce83efdd9684
SHA1 f53d2ffc8f5aa9e15aaf03a44198c9ac31d1dbdb
SHA512 07aa7f90b2d07f993e6213278420c1a16c151cefdbe725816890e5af774ea080c03e5b5af309d4a6a041af9bb867a2d339a638f68d7438c0ccf2759469b5118c
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVa1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jab1qpLd4jjoY
TLSH
T1D7E2F97B780CCF7E4FC04A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 2429cb14be3b45d7ec6e222bdb3ec9afba1320cbc819659e0d8fb828ee3358fc
MD5 e91568f3480327649a0569cedec17804
SHA1 e22b2eeaf5706e8117f5bcdda740a858e8f42e82
SHA512 6f0642a3dbcc307a6e64f70cd34098d95c24a146110fba40a89578c057219321185a74c82fde3dc0fbdfdf5c9d80701900319bab1ca06243facfbcd9db310150
TLSH
T14FE0262405C8C2BD61DA30C34638DB18C3E476A7D3EC3F062F41E984B147545F2DA682
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8f51635c139bf8c1a4f042230dc7305e6a2ca6b4eec78b127b05dbe30b55e3b8
MD5 88062d27f2f0ea05f0123317390d5a90
SHA1 2359df3e507ab9574bc787cda3a86ac1d0bc87a2
SHA512 d58da5b2707e60b4ed914fff61b2cf51d536eea171598822a8496826f01ea7b5b88db6b923d232f2ad2b5c228eafb143fe33efe4647c559ad4e8769feaed5e2c
TLSH
T1A3B0120DB7006B26C48F4CB613F4EB416740E201005444A7C90CAF100F4B7DD2F038C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 ab8c23c3b12cee8c3c05bf9f89a3002330a405b9c51b42cbb0adc34b67fd9541
MD5 e433748c30e83b94eb0e00272fe18472
SHA1 2c71f68d60b3b99e4fe73371d249c941504ad680
SHA512 b0ca04a5f8d3fa92ea6c1a45a160d4af620198473fc1f1ef7052bde96013815039225b717a72cd9f2dcdba92b23b894204807425c91e26988b910acde75265b5
TLSH
T1B1E0D82427CDC26A62D920C74238F74AC3A27A93D7FD2F212B09A444B20F141B347641
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 8af18f49a5e8231ec4e91fbaeacaaa0c736b7ed59313d648a1c4e29f97355dd9
MD5 f736c3214df88af90aba77fbfd9dd186
SHA1 9dc20d821cf237662df4768fe1c0af95c37ea1f2
SHA512 fb2474542892b9f67f389a0926a3072223a6c0af681634083db14581e2f969de4d2f17ae73deba116fa83f358dc505d8f83d49277e9a64ba2453ef29771b9f77
TLSH
T137E0DF7487C8C23961D874C34278EF29E3E07A97D7883F4257085484A143581B3AA181
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 407a65a68063c56686778f29435a43ec0c3d2544213631baafba01e64dda6352
MD5 c8d3e58f8b1fb3ee954d072dccce3c5a
SHA1 9d06f9397f72b719e5f6d58b5afdc217d2bb5d5b
SHA512 b49c9e22b4798574696c65e24bbb11cd84b54eef33038cb0e1997693f5adc4d8820c066503e84363310ecd4436d15102fab8dcb874b8694833e2dab1d97ea817
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdg2:ST/2dXOJhJlpfnpp3tNXVrN3+tf+ng
TLSH
T1EBB2131571BB421039FE391891B58B6E064271B33119E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8d494cb1a82711ffd9c0950d8b1c15b7259d79976b04c4c6ea5d8a339af3ba69
MD5 935220b0ef1e11b2c0fae95e9e5d4277
SHA1 38e6cc8be2e84a7549651f0b9dfe1e0576095a2c
SHA512 4aa38542875f0c0b0112aa18645a16e6491fe8f0f89ef3df3d81675d99b5ebf803535a1a766654c55284315b552b02fef8b075b2cacb79cfde9a2e751ae500fe
SSDEEP 192:P+xARa4+fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxbfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T12C24740A7B747001EDE6D9721CB080771E3C716ECF22A6915DB654698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 4a3b42925a2f05bbecc0c5572333bfbe857cc06bd65ea02703fafe1b224ff9e8
MD5 3a2ef10dec6662d718373784fe93afb2
SHA1 58965a2be61db6fe9c9b1429922507029b1b7953
SHA512 bc642ff0dd3465fc1daaed3907fc172dd0261c7759d04cda7105144fad497f035fa2f83fd43cbf0cdf0ced6464b2aefa311a7e4f40784282ff33107fc7eda045
SSDEEP 96:F89+EgJvgxZAcQgOXEDZeDWXWY1lD3seC/AWVlli0wQHWWVt0CqJnSqJvmiqJasJ:8gR4OE8Aslli0wQ2sCxJnBJvaJa2D
TLSH
T135222D686A0A5733E50D4DB712BE8B6193DA808242F727AD7161045D1DDB737CBC82FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f344e9a05fe4c19eedb6702a653534140b0de4cd9a4cec8e6de6502517e23a77
MD5 c3f71398a55deb949f5b48f561fe8792
SHA1 ebb624d39ebce57485e16397f37de393e1593859
SHA512 fa9d5367ce12d6c31ea70dd0fce342fe89e15f306b0b5f3fb9d15813b12426a794559c4f7f45185213f420be3a8dcc99220a6581ae98a4a0a857e54d69bf4224
TLSH
T143E02618A8CAC1AEA19830C7013857ACC3843BD3FB8C3E0E1F01C488E446101B3AE282
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 cb428d52d7ab7fbc036b5dd3f73c3dfe0f31d262e18dd69f1e6cd939bf126f03
MD5 05c98d1ded543278b0a58a2c2cecbc5d
SHA1 289aaddd762c2e85d7135211570e741bb08f996d
SHA512 81b26ea230e13cd7d2ca9dc022c7ceda9837e49de314154cb4422ae8143ebd1938e5fad8e4e4f1ac6bedaad74ced48ba61dfcd19026b5f4cf9013755966147c4
TLSH
T170215A55F320C208E18E867DA16BAB351338E9168FFCED1F847820252D76E150E8B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 414c607d23498feaa5029af8b6d5de52979abdacf9d6a2a91f917e9637e4509d
MD5 78e1341b0f14dce18d1590efb7b67e0f
SHA1 5c3ae3bbfeb86d403c9c221f468834c7f7537cd6
SHA512 44edfb28bc263ab74472c9d081c8783a5f2ae7585dbed42aca2f1b794df6e6fda99ecbac8bc9785a77a4c3af29007bdc0cc61e4cccddb1afa6a6dca46ab55240
TLSH
T1A4E0DF14A9C9C1BF91D960CB1178AF49C3953B93EB8C2F0A1F05884CA946182B38E282
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 db7e262459554b3d372bb0b3d7cdd11e98b197428a365f90fb643e9fa2bfb9ef
MD5 eaf06ab4043151f861b050f7d611f6ed
SHA1 e2111073d71bdb32f41974a978d1e77bbd98765f
SHA512 8879540b277aa395cbb6fa7d16c32f9ff3578273776841e3fe27f9a292ab71fde7b5cc03f4bded22ed91c2de9ec02075863250f72dcd566fc023352faf4f474c
SSDEEP 3:MsEllllkEthXllkl2zEfl1D0l:/M/xT02zE0l
TLSH
T1F04404447FD14C07DD005030C051C7D41370D4100531574374D144335CC77400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a05ba6047eebb4fac9423c03e446c6d00ba463bad982e27143e90e15450e1eef
MD5 34351b072c1bcc13b15f96fec1192de3
SHA1 87c8af214ec3779cb2a40c033ec8fa98d4b096fb
SHA512 597d1d9822156a6bc55c887f9e1a3c0265dad359d8e73a34d838840bb43be95f6a3665e83f4ed62c5468fa48d1438397c5c99c9883eaef5774eee74ca4b65a3b
SSDEEP 768:+FeBcwgRWQQxBC5TmD9YiUnSALkOr+hpNv:fB4WbKhRIOahpNv
TLSH
T1C8D22775D895DDE7A8E6DAC5A74AE602AEE40133858C8A8CD5F87D3D309F4F80707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 c71357b832aed8d411e8dcac8a19da5a9b1663eeba8779c68333e670f76a756c
MD5 0051004b97f31a280ef32239571625ff
SHA1 68b7bf9ddaf7f7e24779ffda0e96171f48b4b5f1
SHA512 72ad5f145e1129368a1c5b7cdb9f9c4d93db160e2eb25929f3fbfed73ff986ca9f4e65b22be1ce7a8fdf73af858d30fdf8efe3899cb69e2459e674ad062c8e65
SSDEEP 768:+FeBcwgRW7QxBC5TmD9YiUnSALkOr+hpNv:fB4WwKhRIOahpNv
TLSH
T12ED22775D895DDE7A8E6DAC5A74AE602AEE40133858C8A8CD5F87D3D309F4F80707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9ea8a4bf6ea29fa095996fd45715e86d2050e4865c6eba2f07a5711f24673fb0
MD5 ff74c7f961ca90065e9d7896677087a2
SHA1 a2400c5418c2a01c1ec8a2ea73d6607552817f2d
SHA512 829885f04e31cc97da4ec5e01c9018cb369b60884eef5ebebe550cbb978e8e2a7cc0de8bb834d86fa43ebe52ec21c9548220cc687da35c3f7c510233a2abc59a
SSDEEP 384:naiFiZcI63sN28TUNTUlIm2aKMi34w2fiBCC2TmDGFJ7O6R2FeoivgL/7Iz4ou:RFQ63vwgcQnBC5TmDGFJ7TRXIx
TLSH
T1DFC24A36EC98D9ABEDF74FDAA74A7A03DEE40163958C8AC0D9D81D1D10935ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e91830c2b5e2d59a7b51e9bc806bf12403b04579a3ca46b3611817fbacbdc22e
MD5 a8d8aaa8c36bc4ec2c4658021dcda270
SHA1 c2d2610011669b40b5ebd11537db194fb9bc8037
SHA512 9da641930652774a4246be0b3d4d41faa3aa35fbe3402aa7af0f886b00ef77c20078d4302bf86b27566f336d6b8d6332acc1bf958b49ce1613eadb9e4a2cfaab
SSDEEP 384:nTiFiZcItR3sNd8TUNTUlI403TSKMPAQ2w2fiBCC2TmD9uHippsgL/7IzQo4:+FQ/3cwgRWWQxBC5TmD9mippNv
TLSH
T1E6B23976DCA4DABBECE74FD5A74A3A03DEE44263998C9AC4D5D81D1D00971ED030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 a30eebdf5ca3204019a690dad64ef42f58a9cbdeda6bad178a5cf6dc013c7e59
MD5 97c5aa4f8adda6fa0896ccfd51f98b79
SHA1 a496a86e8b4bdeace50f03ba5964f3bff26995fe
SHA512 0ff93274803b421f4ffe9ff91960be6cc7640c3815ddfdc0bc7b5f02c944b0f744ae15610632e831b9b7088b76c39b9c9720f955a085b49b054d6b6f54997abe
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3is0mQQtudRezcQAJmdRx:TL85UOl0afDdWec9sJXD3fsuZB5fc
TLSH
T1B592DF23BD252063E89B4B3AB98348D10DFD13AF89A7B8049ED04D6109B1AC1A6941FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0a868bdd753aaec5497f5df81d0104a5a45dac30a21c6dd749bb774be009f436
MD5 88b99a3c2a4b474cd165cd59fac9cb27
SHA1 5cef660637c7e7792ae8dec02758b567ad922fe3
SHA512 336d2171f10e237ba6466a2da08ae6bd17f9a52d6cde15488b792884afe23a6efcb0f62e3defbdb613f3030d5af4086bda86413b91b1be11a504667b7c2053a8
SSDEEP 3:MsEllllkEthXllkl2zEfltf8/l:/M/xT02zN
TLSH
T1064404047FC00545D50010304071D3541370D450051157C33DD34433DCC77510C40001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cbbf422f9c4a056ca6e2843d443a01b27adcd46c0aa12103a51b7938e91ffa8f
MD5 a8044a9cce825f2124dbde39b92cdef2
SHA1 ee87aee9a19fb21e6eff957324cad64b08edb887
SHA512 423da490e699ab300fbc0143f5246229dab3243c8e29f5cdaa8cea8b6e4df9ce6f4789a669199fae7ebb2287e79761abcfdc1988e64e0dc52568f48937d95c64
TLSH
T144412D5CAAEA1148F3B76E579BF6A86D487BB9772E07D05D10110D4F0B23A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 7e65a8b3b3aea81a03a085ad74daad4be85240efe3d04e760efaa7f081329d12
MD5 c2c5791c813d9be8de148218f8ef4523
SHA1 5fc2a0cc9f773e467c13dd2ab8e764e5ca673904
SHA512 58ee328b78c9ded94a597b62380d8e4f610b9dee3922e30b8779ed2a6b1aceae9dcffbbf030f9e1f3e5ba11d5edb5a11b87dfeafa76a8ea17402ba460a8d79a9
TLSH
T19F512D58A6F91148B373BE55ABF6646D587FBC772B07945E00120E4F4A22A01D8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

881570a3facaaa66cd14055aac0a4405

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-studio\881570a3facaaa66cd14055aac0a4405
Size 12.9MB
SHA256 413377ac013260e8fc5fffcbf3aefb7935586522f83f199fd749757156175b0d
MD5 881570a3facaaa66cd14055aac0a4405
SHA1 2d7d589dcd3471b672470a9dd69477ec6558d4d7
SHA512 b1fce8b4e6fd497ce699b8c9fbbd361d02a4b1814cd3c86602e180efb9283687d908731286adaed58192f7db19a2b9782beaa08e22d6dc3e6aad5ccee0a75029
SSDEEP 196608:4t8a+iMtMV1j3zwwvBauZXdBQ0FBuIzrL52zn4I5bvIV:4t8X6VWwvg4XdvFVQz4I5b6
TLSH
T16FD69D6AB2B800E8D4BBD178C6565617EBB1741603709BDF1BA04AB61F63BE05F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1816-496-0x00007FF64C400000-0x00007FF64D400000-memory.dmp

Download

memory/1816-649-0x0000023630FD0000-0x00000236313D0000-memory.dmp

Download

memory/1816-495-0x00007FFA18DC0000-0x00007FFA1930D000-memory.dmp

Download

memory/1816-708-0x0000023630FD0000-0x00000236313D0000-memory.dmp

Download

memory/1816-718-0x0000023630FD0000-0x00000236313D0000-memory.dmp

Download

memory/1816-716-0x0000023630FD0000-0x00000236313D0000-memory.dmp

Download

memory/1816-714-0x0000023630FD0000-0x00000236313D0000-memory.dmp

Download

memory/1816-712-0x0000023630FD0000-0x00000236313D0000-memory.dmp

Download

memory/1816-710-0x0000023630FD0000-0x00000236313D0000-memory.dmp

Download

memory/3848-738-0x000001E691910000-0x000001E692910000-memory.dmp

Download