05cb0d51733c227b7bd084812a2aeab38cb767047c833f56a141859bebab3222

Analysis

user interaction
yes
max time kernel
118s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MultipleRobloxInstances-V2.2/MultipleRobloxInstances.exe
Size 501KB
Sample260930-ygsbfagg48
SHA256 05cb0d51733c227b7bd084812a2aeab38cb767047c833f56a141859bebab3222
MD5 a53f83fe66bad080544ebe876ca9004d
SHA1 30ede6958b8c4e544bca973e300b5b3538eb874c
SHA512 c1ef35723bc69572ce47a4ff160b86d9e430cce09074550dcb4692afa2d80dd30f9590b83f3d9037055a0e3718beb141ead8434559f467deb541f06eb2172142
SSDEEP 12288:zk8ZmMBkqvPuUvEOLsdZp3rD4IT4YjyBIAZeGbaf:w8ZFGs8mM3PvTEB1oGm
TLSH
T129B4126963BD4511EB7D07FF983142918738ADF3C92EDA8525DC798E26FA38304A0397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_429959386\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_167280828\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_167280828\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1576	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{C25F0A06-922B-4E4F-A570-79B0E38EC1DB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3156	2836	msedge.exe	91
PID 2836 wrote to memory of 1576	2836	msedge.exe	92
PID 2836 wrote to memory of 1520	2836	msedge.exe	93
PID 2836 wrote to memory of 1520	2836	msedge.exe	93
PID 2836 wrote to memory of 1520	2836	msedge.exe	93
PID 2836 wrote to memory of 1296	2836	msedge.exe	94
PID 2836 wrote to memory of 1296	2836	msedge.exe	94
PID 2836 wrote to memory of 3992	2836	msedge.exe	96
PID 2836 wrote to memory of 3228	2836	msedge.exe	97
PID 2836 wrote to memory of 3992	2836	msedge.exe	96
PID 2836 wrote to memory of 3992	2836	msedge.exe	96
PID 2836 wrote to memory of 3228	2836	msedge.exe	97
PID 2836 wrote to memory of 3228	2836	msedge.exe	97
PID 2836 wrote to memory of 1912	2836	msedge.exe	98
PID 2836 wrote to memory of 5772	2836	msedge.exe	99
PID 2836 wrote to memory of 1912	2836	msedge.exe	98
PID 2836 wrote to memory of 1912	2836	msedge.exe	98
PID 2836 wrote to memory of 5772	2836	msedge.exe	99
PID 2836 wrote to memory of 5772	2836	msedge.exe	99
PID 2836 wrote to memory of 692	2836	msedge.exe	101
PID 2836 wrote to memory of 692	2836	msedge.exe	101
PID 2836 wrote to memory of 3860	2836	msedge.exe	102
PID 2836 wrote to memory of 5732	2836	msedge.exe	103
PID 2836 wrote to memory of 3860	2836	msedge.exe	102
PID 2836 wrote to memory of 5732	2836	msedge.exe	103
PID 2836 wrote to memory of 4724	2836	msedge.exe	105
PID 2836 wrote to memory of 3816	2836	msedge.exe	106
PID 2836 wrote to memory of 3816	2836	msedge.exe	106
PID 2836 wrote to memory of 1676	2836	msedge.exe	107
PID 2836 wrote to memory of 1676	2836	msedge.exe	107
PID 2836 wrote to memory of 2384	2836	msedge.exe	108
PID 2836 wrote to memory of 2384	2836	msedge.exe	108
PID 2836 wrote to memory of 6084	2836	msedge.exe	111
PID 2836 wrote to memory of 6084	2836	msedge.exe	111
PID 2836 wrote to memory of 6084	2836	msedge.exe	111
PID 2836 wrote to memory of 1916	2836	msedge.exe	113
PID 2836 wrote to memory of 1916	2836	msedge.exe	113
PID 2836 wrote to memory of 1916	2836	msedge.exe	113
PID 2836 wrote to memory of 4748	2836	msedge.exe	114
PID 2836 wrote to memory of 4748	2836	msedge.exe	114
PID 2836 wrote to memory of 4748	2836	msedge.exe	114
PID 2836 wrote to memory of 4564	2836	msedge.exe	115
PID 2836 wrote to memory of 4564	2836	msedge.exe	115
PID 2836 wrote to memory of 4564	2836	msedge.exe	115
PID 2836 wrote to memory of 4528	2836	msedge.exe	116
PID 2836 wrote to memory of 4528	2836	msedge.exe	116
PID 2836 wrote to memory of 5460	2836	msedge.exe	117
PID 2836 wrote to memory of 5460	2836	msedge.exe	117
PID 2836 wrote to memory of 5460	2836	msedge.exe	117
PID 2836 wrote to memory of 2948	2836	msedge.exe	118
PID 2836 wrote to memory of 1140	2836	msedge.exe	120
PID 2836 wrote to memory of 2840	2836	msedge.exe	121
PID 2836 wrote to memory of 2620	2836	msedge.exe	122
PID 2836 wrote to memory of 1164	2836	msedge.exe	136
PID 2836 wrote to memory of 1164	2836	msedge.exe	136
PID 2836 wrote to memory of 4988	2836	msedge.exe	139
PID 2836 wrote to memory of 4988	2836	msedge.exe	139
PID 2836 wrote to memory of 3060	2836	msedge.exe	146
PID 2836 wrote to memory of 3060	2836	msedge.exe	146
PID 2836 wrote to memory of 2492	2836	msedge.exe	150
PID 2836 wrote to memory of 2492	2836	msedge.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe
"C:\Users\Admin\AppData\Local\Temp\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe"
1⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\NewSync.xht
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2c8,0x2cc,0x7ffe5998c188,0x7ffe5998c194,0x7ffe5998c1a0
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,7067600615870474880,7066272261811145157,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,9013500688949392178,16804538914697383892,262144 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,7675328964961778929,15059892485210085251,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:13
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,12678892214266267547,3817841839479710164,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16474880387904629491,2560047132877784554,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,16052874388801092250,9155776718888551513,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,4596036581708937079,17153379882010961024,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,7805776401292067887,3665620962553988589,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,4219278955215305287,14731061667411080844,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,7910135691546381995,9434976945699985270,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,2796500386145080468,5692846068826012980,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,2796500386145080468,5692846068826012980,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,3587907942718126103,2318110745144838457,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,17936550422987654876,13082093729394386027,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,9337976956719260734,11773397752419629803,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6528,i,3844997502787355606,3737446092640831441,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6876,i,11585710003127816706,630180412447078850,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6860,i,15658354688208375857,10079744699531355978,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7060,i,2014443076755349434,10826808416601812575,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,15249586166149268198,9255230963567977992,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5976,i,4703335897909726436,6652122863118738263,2097152 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,14379337917477008178,15430755194146925725,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,7750432193708957903,16500550492601080099,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,9876153873145819025,7207951512622305048,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1340,i,17506417332385095403,1913435811579387188,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,1834772296077025340,1956560924544927904,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:14
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17332399915241633552,8132004765979689980,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,10912126358923787931,4238403275055591643,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3140,i,14418579637493748831,2684726775455435080,524288 --field-trial-handle=2340,i,7619435849271155757,1453440147867425320,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2784

C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe
"C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe"
1⤵
PID:4108

C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe
"C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe"
1⤵
PID:776

C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe
"C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe"
1⤵
PID:848

C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe
"C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe"
1⤵
PID:620

C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe
"C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe"
1⤵
PID:5936

C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe
"C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe"
1⤵
PID:1476

C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe
"C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2\MultipleRobloxInstances.exe"
1⤵
PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 44KB
SHA256 34a6a0b4c6521f99ec398ce7663437ea2cbb0d86b4d1322f65ae2b45a53007b2
MD5 f069cb36af3b6c360161ec41ba4e24ba
SHA1 98c3aba0d33b9daeeda530528c6d8a2debcc1067
SHA512 0ea2853fe3ff003193dd3aac8d7e895b91513dbe13e126a540462207ac18c215eb753ed77eded3a948ab5f0adac084270bccce77abf77ff99d5a375a5f607043
SSDEEP 768:DkwV7Apz1QrSXVvr4Qc/8Dc08rHPTynh06oYE7BsMlu1U/zWbw+FaBfTPr1feVrF:DHVsz1Q+Fvr439HPTgx5E7B41U7V+FKU
TLSH
T1F923021F23F52C97C23D1E603BF184E0BD64287CB49163E0A11B50196EB49C7EAB89BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 28b0784b94ed79ae2a68f764b03a11f109d764b32baa6073e685d1b60ff14f72
MD5 53839723e685e7bc73b634ce28952fba
SHA1 21c10cb6a267870a58e2a23951d3ea6789099f8f
SHA512 896487861824f99df0adfb9448ea0986407529dd129cf3b4ebf8409f11ca48ef9e574fc6e9e4a8b48923b208d87c12fad87295fe2b231adb19168731c69e48d2
SSDEEP 192:AorkWp/4eJJk3YPMxO+tv+oYt8ExqWmdvPT:I+emXFxDmdj
TLSH
T135E1A4CB50923A04F7A6E5B04DDCAC4735316942000BED5D2168EFF23DB2B29BCB719A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a2481.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2481.TMP
Size 3KB
SHA256 4b0c59381fab7ca4f12f36096fa36c462e4a5b0b51e816b226807840e620091e
MD5 504f47dc0c0b401dc6ac58f70e7f0dc9
SHA1 1d0627b636cd5640750083b4b9c679f90c6a3ee4
SHA512 ff5efb6856c78c87fc79a6fff85de091b2f84b72c92c8796a80c8c4eeb603c142c2c99fba413748ac0c34332f116543ba0947c3c2a0f4de791300c64b28acd4d
TLSH
T13C51820E41C15B18F79B01B18DCCDC8B3635AD811443EDAE32A8FD76586276EF8042CE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ca6e4c9-36ad-4f4e-8cc8-85e96041a8e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ca6e4c9-36ad-4f4e-8cc8-85e96041a8e1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9cd7ff5b9047ddd6b70ab6e498aea10b4aecdfcbe99adcdfd62f75c6cad8e2a1
MD5 714130c8575dbd073f8a07418ba8b8bf
SHA1 2bc13471c40c2f07784c1d734123a7886b6d48ca
SHA512 253a35b9744b3b44176a902973b75f5a7ba5b9f4e8d0cfec29b6f0c8afdc1083e8fefbcb510ad3cb4e3f0b1f66b198e6ea6e13c802b60fc3017c5bd31744f8ca
SSDEEP 96:DyOqaSIrDDZmBVVPh7zoYjRzEBmrm/mnrvm+mD2GmO+mgwQ:DxqLIrDDZmBVVPh7EYjRzgmrm/mrvm+j
TLSH
T1B7C1A0F387E5866DC91255F0EA18BE1BCE2C0954931C3D5AC4E4AE1BD3E2871E181B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 ef61739a85a0c0ad8d4030da0cb01fdcf4a590b4c227f5c96091449c99b3d7e9
MD5 5a19b4313959fd2fd4fca11fd92bb29b
SHA1 ecd8a8182f86d03ded58d5c1de6eb677a7511f39
SHA512 203135a1ac391c8126ce309ed8890474fd576e2d678cdbfa5afa69787c3f61b242114fc1ab0d4002138a53624dfab4453fba3f4cfe2aed3495b9753abed60950
TLSH
T190D022632B0EB0B6A9ACAEA5917EACCFC36710615882DAD518D298A8053186C098F142
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 07b9bbfe218f66d3ed5690240679b8e5ba4250cd118b15014f0d278d46ac8b7a
MD5 944ddb503a16cec8e886bb747fa51bff
SHA1 3471b013fdf6a22e79bc98dd966816b41754c662
SHA512 06f0f081f0972689e6dc6a50c4c64cd26af50ca58ec4ecc51c8971d504f3f6ae037a9ec9c894a12e39314c662c9867d47ca0af75c8d7f2ef6bf88bcb6af44195
SSDEEP 384:sxRPORmzVE/fGss32jeC/5AQV/8Ohx0ss:sLORmzVE/f2Ix/5AQp8Oj8
TLSH
T15C52C756A924E87B8CC7D608BE397F12D6F9543398911E5CAAFCC51C04EB5ED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f603cd80fb2171e1968fbf60f5770714ec303df580c4f1ae140c346fec68e3f6
MD5 3a7f157e6b77a21999a9a940f0bbd090
SHA1 12ac9dfff28ac73eb95f96f1e6698ed888c44203
SHA512 c18ba3184cee5ff7cbd6d61b76f9cda3827ae3cd39f1db22ee7af83d955eb63506c4680df8d1034e87e0aeb5bb3b14087de9e70a25cd33eb1a5ced878ec1efc4
SSDEEP 384:sxRGORmWVE/fGsM32keA/5AQV/8OhH0ss:saORmWVE/faXp/5AQp8Oh8
TLSH
T11C62D756A924E87B8CC7D619BE357F13D6F9103298911E8CEAFCC51C05EA2ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 da135702d81eae1fb3cfd42fd18059872ee432737a06c6705cf43d1f64f9b2a8
MD5 74d183c84bca3f635b7f937c0ba4692e
SHA1 4da01f2036b5428f76f711847647ab3e2c4f4504
SHA512 d703bc338b57d44090fef6f733a6263ddaf13753429f50fcbab0a2ca083ac054836216a259a7e7e6ed65f75f43169a698f68efbc7e30424b7cb129b3a31efd2a
SSDEEP 384:sxRGORmWVE/fGs432keA/5AQV/8khJ0ss:saORmWVE/fKXp/5AQp8k38
TLSH
T1EE62C756A924E87B8CC7D619BE357F12D6F9502398911F8CAAFCC51C05EB6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 dc0114c9796acab646c21fd90bf5ebc2188c59ef3a5e3f1ea420524cab982a2c
MD5 831fed82c853a55d69ed18b5e0bba2f8
SHA1 5db5cd0f4befdeb62522b63cc50a8d54a7116d2b
SHA512 fac9ae5c240a1b7d8bdcf1c486aaecb6d7a3fb0ebd7426e00e730fa77277f5ae29ad1725814c0f588ade281ccac513813a3d6f07ad608deb9f9efdceb473d4b9
SSDEEP 768:dmGxZF7pLuLb1sWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OVx1IUGeJromL0m+:dmGxZTEb1sWgmMfk6u1jaC1IVeih
TLSH
T1FFD2DA7B780CCB7F4F804ADDAD197A9B6DA802CB9698CD8447F9841C03C67EB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7cc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7cc3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 23f1f620721a4174f9e4ceb1ffe3acbb0af48a7953ade635b1c08df63d78ce1a
MD5 7da76035253e2878f1b0f300fac3b0a4
SHA1 1a61fcea020fd6d05c176db97584dba7a0e9efe8
SHA512 e691128a41c57b948f0fc220c7b7e0b79903502a57360f6d64cb0e5e1cd39cce5232b7b4e5e48605667ab94fedf1dc6312df97ab457942b90f38e6377f17cab3
SSDEEP 768:d63igw4KnJSxDc9bsMSJz/Fn/V4YGHVJk:d63eYVQbs7JTH4YU/k
TLSH
T18EF2BFB59C609CF3CCEAA2807A977B436FF84593D4891E88D5D99E0D05872ED270783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a0a6bdb8d2878453d0fdfb6e71320fd5a3d50a0d36391a57b31f1e0c1e64dc23
MD5 d286a884070ef7aa0cc74d3698eaa9c7
SHA1 bbb41967048858f669b8e305e57230a855b2ab1a
SHA512 fb9427321fe7c60c0a01551a1fa83a51ca65285bbfd3eb1fb28d94dedde903d1353ca7e336f85aa1d5183e703a62421203e9303a1d050224d167804d291fde4a
SSDEEP 768:z/UxvxjgC+U3z9KnJbxDc9bsMSJz/FnnvSHXPyK/:GZj3+U3wJVQbs7JTxSb/
TLSH
T19403C03AEC5058A7CDF767803A4AB657AFF84953C5C52AA849DD6E0D07C73AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1e99962c702821fc5e0845c01a4315f57e487cf7a7754bbe0c1de089d1556cec
MD5 7a25844bb9237cd027489dbc44a74e3d
SHA1 7902539626223be9413dd12a34d2da600b321661
SHA512 812cc570144b6a00785c87ae20b1a36d8ebbb1809c5f85c3e2b64ff1060b75d78c5d9f06d92dde5846f63371bf39ffae4df5d704fcdc1c0ad389a14eb223163e
SSDEEP 384:nqZcIwR38NLgu9+c16u199fw7DJSzdvLcN9YkWwJJhoMSboCzfnFLj/V6Zh6DKh8:Ik3yr/KnJSxDc9bsMSJz/Fn/V4YGHVJk
TLSH
T13AF2BFB59C609CA3CCE6A2807A977B436FF84593D4891E88D5D9AE0D05832ED270782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 acbc1e503ef5b77f77d924fc053b898e899823c0173f2d15b8a06f41376967e0
MD5 bca1c165266cd3f98d7c99578fc202de
SHA1 0326f570849bca13587deb25fb44ffa55ac28ebc
SHA512 9c9e09c1ac3a31ae783f4e7bee87a40aab8b08c2b89dd1c58603a7abf5c99ceec935f7a454cb2e686a1c8af02da647defc6d87cc7b0a43e9a73af8597959ef3e
SSDEEP 768:KFV63mwg2Kw/0nJZxDc9bsMSJz/Fn/V4YGHVJk:+63EDVQbs7JTH4YU/k
TLSH
T1871349F598D399B7D8AE9783677D6E429AFCC093B4885884B7C55D0CCC821BFD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 74ac6f53d5c2f02500f771bd79b309d612bbf5b158a18f12351841302b51f5ef
MD5 94fdb695e0cf2b641ba33e7507b133d2
SHA1 afcc622fd460480c72551a7a1e31b5ddaf0528b4
SHA512 783978ba19a1fb06de274055fe5023a6c81215aac4d0426b5454a168ea88cc199be76da43c4f04d1f1ca5744fcdade99c8a742335d9f22d331d07b2b9a93f646
SSDEEP 768:u63jgw4KnJSxDc9bsMSJz/Fn/V4YGHVJk:u63lYVQbs7JTH4YU/k
TLSH
T176F2BFB59C609CB3CCEAA2807A977B436FF84593D4891E88D5D99F0D05832ED270783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4a35ab9a311fa07b6f0003f99abb0952a4925f206f9433464a7c0f9e354c9aed
MD5 8114207cf43f071adccb6d2865aac55f
SHA1 6bbfbdb493ffb5cb06b1f5222371a799a22189d2
SHA512 139eca88ce5313be9fce040ddffb7a4e6351dfdfbdb3cb02738513513c06b567df273171b0646ebe39a96b0d7034969386762872e9ef4351a31ea26b6bcb588a
TLSH
T172E00203901000E1C018033401431F801ED3406156A102549730019D6C723003D64A40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59d4ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59d4ea.TMP
Size 392B
SHA256 b0e11bf50ff4caa0197bb3a1dfcdc7ad80426d88e35839eb7ac45c6dfa7b872d
MD5 5f8dc4bd283bb5d746cd77665db9024a
SHA1 dcbfa936547baa001d687289d2f765a9cea3b140
SHA512 cc2e8584001c4d1316ff02aa0f29a02aa356d0be20707871b33de7c237ad072498291452b2b980e7b8aeae3023662b67d75a95ee1e286675af92ecfaf6e93bc4
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

4b602188-39fd-475b-9abd-6e73e238bd97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4b602188-39fd-475b-9abd-6e73e238bd97.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2836_2113635420\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MultipleRobloxInstances-V2.2.7z.crdownload

Path C:\Users\Admin\Downloads\MultipleRobloxInstances-V2.2.7z.crdownload
Size 607KB
SHA256 3a8b9046245b5a09adba04042972a06e85c39f1a4d209dd51a6ec6f9838d4aee
MD5 c5a2b2b25fa87a02d7b7fe5c6ccc05e6
SHA1 b530aacd74032a3e0d813f92585d61a755d7146e
SHA512 3c6b9230b51cc208f52e021778f93d7b95f2f233faaa24e1a182a76e752ad4b37130aac2b4987a0243b14b9befca6a87a58297efbca7daae832eeaae8acf687a
SSDEEP 12288:/zkOHEONtvEOLWdZp3reynpktYPioeIAZZGbaWEoNmWpc2WX:/zkCEOL8mW3aypvPDe1nGncWe2Q
TLSH
T139D42336C287CF07E3EB57D3AD02729613C9C8BBB627499A8A7927C7047C4689DB14D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads