5d3543abd635628552357db2559d4448e57288852b826cf430ffe3a1463ca316

Analysis

user interaction
yes
max time kernel
132s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/10/2026, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox manager assist.exe
Size 10.6MB
Sample261027-hjp14aa17w
SHA256 5d3543abd635628552357db2559d4448e57288852b826cf430ffe3a1463ca316
MD5 fdcaaf792c9083074efeca0359d1026c
SHA1 0a2bfbae4fde225e44f598378b25691f0d02ae59
SHA512 64b86de2fe3c365574a4020156e03a2c29f06520fd129e52c231d1e2821a7dec61207e06c2f96d5bdc6f1f1a0b5d6021787e4bb0dd73fc8b63c1b7b72c7eba4e
SSDEEP 196608:fDbJlRYe1J2Bfga9Y6ZDIykMpJzcZAFoHasHCUzFhDGD7bO7caSGcd2uNbRrC8A7:fDt7YaJWgoDsMQZA4CUzDiDu7Qd2cVr0
TLSH
T114B62317F24E633EE47996365972AA10553FBA20641B8CA386EC3E4CCE790611D7EF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
2728	Roblox manager assist.tmp
576	63bdcfac001ad18626d4adad4ef7e863.exe
2848	gamesi.exe
948	gamesi.exe
4620	gamesi.exe
224	gamesi.exe
3584	gamesi.exe

Loads dropped DLL 7 IoCs

pid	Process
2848	gamesi.exe
948	gamesi.exe
948	gamesi.exe
4620	gamesi.exe
224	gamesi.exe
3584	gamesi.exe
3584	gamesi.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gamesi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gamesi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gamesi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Roblox manager assist.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Roblox manager assist.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gamesi.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox manager assist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox manager assist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63bdcfac001ad18626d4adad4ef7e863.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/memory/1104-0-0x0000000000BD0000-0x0000000000CC1000-memory.dmp	innosetup
behavioral3/memory/1104-7-0x0000000000BD0000-0x0000000000CC1000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2757962786-3770611029-2102435697-1000\{899700AD-0F45-41F3-AE01-2A638FE513D3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2728	Roblox manager assist.tmp
2728	Roblox manager assist.tmp
4620	gamesi.exe
4620	gamesi.exe
224	gamesi.exe
224	gamesi.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	576	63bdcfac001ad18626d4adad4ef7e863.exe
Token: 35	576	63bdcfac001ad18626d4adad4ef7e863.exe
Token: SeSecurityPrivilege	576	63bdcfac001ad18626d4adad4ef7e863.exe
Token: SeSecurityPrivilege	576	63bdcfac001ad18626d4adad4ef7e863.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2728	Roblox manager assist.tmp
2848	gamesi.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5516	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2728	1104	Roblox manager assist.exe	81
PID 2728 wrote to memory of 576	2728	Roblox manager assist.tmp	83
PID 2728 wrote to memory of 2848	2728	Roblox manager assist.tmp	86
PID 2848 wrote to memory of 948	2848	gamesi.exe	87
PID 2848 wrote to memory of 948	2848	gamesi.exe	87
PID 2848 wrote to memory of 4620	2848	gamesi.exe	88
PID 2848 wrote to memory of 224	2848	gamesi.exe	89
PID 2848 wrote to memory of 3584	2848	gamesi.exe	91
PID 2848 wrote to memory of 3584	2848	gamesi.exe	91
PID 3364 wrote to memory of 3728	3364	msedge.exe	95
PID 3364 wrote to memory of 4488	3364	msedge.exe	96
PID 3364 wrote to memory of 4984	3364	msedge.exe	97
PID 3364 wrote to memory of 4984	3364	msedge.exe	97
PID 3364 wrote to memory of 4984	3364	msedge.exe	97
PID 3364 wrote to memory of 1492	3364	msedge.exe	98
PID 3364 wrote to memory of 1492	3364	msedge.exe	98
PID 3364 wrote to memory of 3204	3364	msedge.exe	100
PID 3364 wrote to memory of 3888	3364	msedge.exe	101
PID 3364 wrote to memory of 3204	3364	msedge.exe	100
PID 3364 wrote to memory of 3204	3364	msedge.exe	100
PID 3364 wrote to memory of 3888	3364	msedge.exe	101
PID 3364 wrote to memory of 3888	3364	msedge.exe	101
PID 3364 wrote to memory of 1244	3364	msedge.exe	103
PID 3364 wrote to memory of 1912	3364	msedge.exe	104
PID 3364 wrote to memory of 3236	3364	msedge.exe	105
PID 3364 wrote to memory of 4160	3364	msedge.exe	106
PID 3364 wrote to memory of 1244	3364	msedge.exe	103
PID 3364 wrote to memory of 1244	3364	msedge.exe	103
PID 3364 wrote to memory of 1912	3364	msedge.exe	104
PID 3364 wrote to memory of 1912	3364	msedge.exe	104
PID 3364 wrote to memory of 3236	3364	msedge.exe	105
PID 3364 wrote to memory of 3236	3364	msedge.exe	105
PID 3364 wrote to memory of 4160	3364	msedge.exe	106
PID 3364 wrote to memory of 4160	3364	msedge.exe	106
PID 3364 wrote to memory of 3248	3364	msedge.exe	111
PID 3364 wrote to memory of 3248	3364	msedge.exe	111
PID 3364 wrote to memory of 4128	3364	msedge.exe	109
PID 3364 wrote to memory of 4128	3364	msedge.exe	109
PID 3364 wrote to memory of 4876	3364	msedge.exe	110
PID 3364 wrote to memory of 3248	3364	msedge.exe	111
PID 3364 wrote to memory of 4876	3364	msedge.exe	110
PID 3364 wrote to memory of 3248	3364	msedge.exe	111
PID 3364 wrote to memory of 4524	3364	msedge.exe	113
PID 3364 wrote to memory of 1812	3364	msedge.exe	114
PID 1812 wrote to memory of 5144	1812	msedge.exe	115
PID 3364 wrote to memory of 5260	3364	msedge.exe	116
PID 3364 wrote to memory of 5260	3364	msedge.exe	116
PID 3364 wrote to memory of 5372	3364	msedge.exe	117
PID 3364 wrote to memory of 5372	3364	msedge.exe	117
PID 3364 wrote to memory of 5548	3364	msedge.exe	118
PID 3364 wrote to memory of 5548	3364	msedge.exe	118
PID 3364 wrote to memory of 5556	3364	msedge.exe	119
PID 3364 wrote to memory of 5556	3364	msedge.exe	119
PID 3364 wrote to memory of 5188	3364	msedge.exe	120
PID 3364 wrote to memory of 5188	3364	msedge.exe	120
PID 3364 wrote to memory of 5124	3364	msedge.exe	122
PID 3364 wrote to memory of 5276	3364	msedge.exe	123
PID 3364 wrote to memory of 5292	3364	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\Roblox manager assist.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox manager assist.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\is-OGGFK.tmp\Roblox manager assist.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OGGFK.tmp\Roblox manager assist.tmp" /SL5="$9004A,9979468,924672,C:\Users\Admin\AppData\Local\Temp\Roblox manager assist.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\is-K759Q.tmp\63bdcfac001ad18626d4adad4ef7e863.exe
    "C:\Users\Admin\AppData\Local\Temp\is-K759Q.tmp\63bdcfac001ad18626d4adad4ef7e863.exe" x "C:\Users\Admin\AppData\Local\Temp\is-K759Q.tmp\gamesi.7z" -o"C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:576
- - C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe
    "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe" --vid=195
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe
      "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe" --type=gpu-process --field-trial-handle=1636,18336959216289086718,15516594357573433365,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=787477679700915480 --mojo-platform-channel-handle=1644 --ignored=" --type=renderer " /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:948
  - - C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe
      "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe" --type=renderer --field-trial-handle=1636,18336959216289086718,15516594357573433365,131072 --disable-features=SpareRendererForSitePerProcess --lang --app-path="C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app" --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\preload.js" --context-isolation --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=17090542124961944392 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4620
  - - C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe
      "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe" --type=utility --field-trial-handle=1636,18336959216289086718,15516594357573433365,131072 --disable-features=SpareRendererForSitePerProcess --lang --service-sandbox-type=network --service-request-channel-token=1890384251666568292 --mojo-platform-channel-handle=2208 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:224
  - - C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe
      "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\gamesi.exe" --type=gpu-process --field-trial-handle=1636,18336959216289086718,15516594357573433365,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --service-request-channel-token=4526985084541019056 --mojo-platform-channel-handle=1644 --ignored=" --type=renderer " /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/download
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x30c,0x7ffe08f4c188,0x7ffe08f4c194,0x7ffe08f4c1a0
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,1069884727582929151,9598329565576940597,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,4710614923758330896,6057072907309129888,262144 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,4218150325513785976,12858229859132038337,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,12100436104327962933,8440054541201337572,2097152 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,17852660167303380105,8920527269488539468,2097152 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,5031717257312299120,13746166703352440393,2097152 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,2587736705977005881,16958144435088357605,2097152 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:9
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4200,i,12220376632768217306,877215278488001005,2097152 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:9
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4188,i,14284707621372556547,6754663233564006322,2097152 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,9121151212602340048,15276312579770997956,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,4982932803167976605,4591497678476783242,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,17129559380904715463,5104016548278035474,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,5973490908042838316,2026106072611858184,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,7088996408591660282,17923935291314604854,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,7088996408591660282,17923935291314604854,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,2945440244444025412,2829999234885233520,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,5716637527963580599,12919696733782301353,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,416936076723224054,817446153463741066,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,3134648251220269628,2389812706277799583,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,10022304048458134237,4372292725774288744,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,1544186712205361514,15726802751593172000,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,9266293848031848131,16925065371333580685,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,11102210745163913108,14800971960358299742,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,6521394092689154590,11477606814110623091,524288 --field-trial-handle=1992,i,4588519213647760578,14134555722022233531,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3700

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f52f976-7b20-445e-990c-1a8e4e128a1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f52f976-7b20-445e-990c-1a8e4e128a1b.tmp
Size 18KB
SHA256 d04e573c9576e9299d75489ad1d8a0e0ed83ea44794a0a1ef98b0610a8fd4f4d
MD5 ba08136fccd9dcfafb392a4c95aa10b1
SHA1 540db3c57622f308fb8e1e3256d2fcf205ac10a6
SHA512 7c79c8a248f6b2c7d3ac9a5a5ccd294754711762492d4db4e9074f13a3bd709888b6d98c1bd276b579b40a2c60f7d3ee7f6591d1973bad0b9a37913edd979bb2
SSDEEP 384:nnQkUSvM8NLTSq41gFmX565OyE82vaTZc8btWIIlf:5MBqBQEOX82vaTZcOWLp
TLSH
T17E826C71A879AC3359EBE554F68A3643DEF46077D8841F98E5DC5F2C01CA29C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1537da42-d87d-4b2a-9a40-bdb9eff720b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1537da42-d87d-4b2a-9a40-bdb9eff720b7.tmp
Size 8KB
SHA256 cd5208c3b0d14ce040635a59b2d226dc43eec4a9887d0e09751fab41b64421fa
MD5 de0d608b3f36e4b354e92076ecd72cad
SHA1 629836c9a0f75a8b517de482dc41f3b66b40cf7f
SHA512 dc367cf73ce64989e77c4b5acf3bb1b458525b32ca93b172f5211136f50d2e22c8a4e9157b033476c4463aa52ca80443aff2e5af25215519006c0ecb5bd5c3f9
SSDEEP 192:mGNs6FPhQmiUyxkv2LX565Ov+TR5BCPJCU6:mGNs6ROQ2LX565OyWUU6
TLSH
T1A302D735A968BC779EF3EE49B5873713AFE4103BE5946F84DAE81E1C019725C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73310511-11b6-4238-b27c-4a4261735b76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\73310511-11b6-4238-b27c-4a4261735b76.tmp
Size 8KB
SHA256 28e69f270ab4a4043ce9f1cba53bcc5f35d34f963f3d2e7d308dc31bccbc7bfc
MD5 71efdd30ce167864b38ac8ac1574961c
SHA1 c68a013c5725846ce70d692adf0b27eb17b2d376
SHA512 18d088b027c582c325d573e3cf85a60de71fb6215113ef7eb2f35ac0f50be99e02a5101d807e4fe9473cd11166ac5d82408e8cbfd09a896cd245056f5d1cbbca
SSDEEP 192:hGN26FPSQmiUynv3LX565Ov+TR5ERWUzqbVU6:hGN26QU3LX565OyEx2U6
TLSH
T14812E875A868EC335DE7B554F58336939EE92077EC486F84E6E82E1C04DB25C270A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f3441efe89f40c49c2eb2faa60bc806081bb2ed5672b81b3317480a16d9defd0
MD5 48af34be1fd83b68e08abd8324fcc533
SHA1 15f0d4791b9ba48b92ee9290ab043242241b1137
SHA512 9687f23e1f8c4b413fabcf01b867bb71849109f11f20aeb0da3a5e1a25b610ec3fa85aa3ce714ace9479c0c98da93c7301d990baf3c243f6c14cc1010ae46a5a
TLSH
T12ED0243073574401C1C0703743C3C3103CC5C505010D515FD0301C103C57055F40D0C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0653c7dfe0810a5ba2c25399711a69ff5ccfc817819d34f6722ae2f2cd5878f
MD5 7d9ceef5daa4101fd9b28ee948203837
SHA1 ad81e9d42e96e81834610892e0cbe006311016fb
SHA512 5fcae862842c3f4a69612b1563a769c05365d02e6c1981b600f92a8204d1bccef7066e0f30e9f4cd820c979d8be93f5d5f5a0cbcc14e4c67fdb497df535a879a
TLSH
T15DD02230F32B8002C2C0B03B83C3C3203CCACA0A020E20AEE0302C203CAA02AF80E0C2
MD5 SHA1 SHA512 TLSH

Submit Download

2e04cba6-17cb-44b9-997c-9cd7203dfd28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e04cba6-17cb-44b9-997c-9cd7203dfd28.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

382fd0dd-550f-4597-9f74-5c129cd13d23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\382fd0dd-550f-4597-9f74-5c129cd13d23.tmp
Size 11KB
SHA256 f997e6da53d305253ef3333c75620c5d3c9e7f48e2ca4ba1d9c5c422c4951337
MD5 22dc3a2026825f9b5d655e92198391d4
SHA1 896460db51013ef63b6e173d3301eb115b27f0cc
SHA512 b1d7259fe939f1f9a5027be15d6ce6637cbfc06f2025908554e7924ab5177aad5737490fd69de1f326f35f35f70f0be2c554beeaccb98f421cba34a459dbc01e
SSDEEP 192:sxZfRmYj/faKsFz6GY77Idp/I/W6+WNyh9/Y0vRgP7Ig5PJ:sxZfVj/faKsFNY4w/bm/5aj
TLSH
T1D232E8526E24A93B9CCBE219BB15BF53D2FD5032A1911E88E6FCD61C05E7BDD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5db02e41-3902-4b58-a34e-14be8cf1dce6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5db02e41-3902-4b58-a34e-14be8cf1dce6.tmp
Size 33KB
SHA256 45331b28509e6bb5610afcfc47212c2e4702602f90b6c12c4946ccb03c92836e
MD5 e4548709fa6104a5ea69d3b911c00ee4
SHA1 56b4a909fe1db1b9f7b324308e9102a0cdf710ff
SHA512 39517cece26a2b17c1ba55b043d7dc9b3db649fbd1a655dad1a132562fa350de75792d0f167025c68ed70c7b3bcc944bf76bf1988a751271eebc0edf92f860d1
SSDEEP 768:/phnP8y32pO7pLuLjNFWRmaeQwe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV304ClLlJ:/phnP8y32pOEjNFWRmaeQweu1jaK04Cx
TLSH
T124F2F97B680CCB7E4FC04A9DDC567F9A6EA802CBA698CD4047FD885C02C76EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93e60db3-d5d2-47de-abb0-7431ea2645d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93e60db3-d5d2-47de-abb0-7431ea2645d7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2d496ebc4abe019fd7828133d356960b55d904df22bd755b14e1e5ef7d2c8094
MD5 e77c8889ee03223749d7275d5a9d732c
SHA1 adc2af9acd22e455178c30fb816617dfadb3a382
SHA512 5e1ef6ca05a98ff708338217773d7e7629954bcff02503b99cb67b2660a513efff32ecf4868c35818ebf71881b19f84e54e1537f93e623e5079db53b972bcca3
TLSH
T10C71BA85E1A80C9BDF6C7CF8D5D618DBF5B2618877636D1117EBC4F8AD4EB91E008084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d5df5a9811454ee81ee5568f084bde027aacceaa99114a4c11d93682c2e9e22
MD5 fafb8d26cc074dd9247036d7e48c4394
SHA1 61024ebe594a56cf7b3cd0062390a34854d63b04
SHA512 9ec1e76ea4b7020ff856bb19e37c78b869a96e320c4498e508ffd411c0bf1198f8d55e70ac16b9f6fd5227fbbb366142a7bcaab99a9433acba834720639e4f4e
TLSH
T1A9618289C255089BEB6CBCF8E5E414EB36B46180BB63AD5217EBC5F86D4EF61A408084
MD5 SHA1 SHA512 TLSH

Submit Download

a1ed88af-579a-4942-bbc4-e558fd0c7824.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a1ed88af-579a-4942-bbc4-e558fd0c7824.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

20a09fc1-f762-47e7-ac75-07a9f14d0a72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\20a09fc1-f762-47e7-ac75-07a9f14d0a72.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

92c34c2b-b9a9-4833-a548-1e520e8793ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\92c34c2b-b9a9-4833-a548-1e520e8793ac.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 879d41e90aaadbd8d90e71f6c65b025402f217b22393301fecea086447c33a45
MD5 55e73aa284270348473130e6ec3c882e
SHA1 cdd641ddd8940cd1f02ad511bc4e61c2af5e1fd3
SHA512 e27852165fd7707200a17bb85b4937b784282e60732d80673c2bac587319c56ddb6c856e52214563bd5d63360c92c6fdc683324120375670ca4d614db2885477
SSDEEP 96:KIx2Ki0y6cwKl2uO4KPa6vMJw86WSkiWHPQ0kKYBQykkc8n6q:09buvvMJw86WS7WHY04BQyLc8n6q
TLSH
T1A4B1CF9572BA124238BD350891798B2F124236B3705CE6AB3FBD05B54E37F094DBCAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a46dbd7b-6107-4e8a-9186-3340f5aef83b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a46dbd7b-6107-4e8a-9186-3340f5aef83b.tmp
Size 10KB
SHA256 617acd280d207f01f5a815ca535ea766cca56ba5fd8abf4ba762293dd766bf74
MD5 5c798b08aafd39deb22b1324810d69cc
SHA1 927a04938059bc514ec79bef293aea978ad40116
SHA512 0f1c63d03b1ba7156a5a6026d42c93749211a32e5f81d4a157218db1db6aaa22646ea9c0dd7178a5638f8aa168b6a75511889cd54859d236eab8d29fb722d0a1
SSDEEP 192:sxZfRmLj/faKsfz6GY77Idp/I/W6+WNyh9/Y0vczP7Ig4J:sxZfSj/faKsfNY4w/bm/5ic
TLSH
T1C022FA526E24A93B8CCBE218BB25BF13D6FA5032A5D11D48E6FC961C05E77DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c27e0d49-2fa4-47d5-8cff-a17ec5e40f69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c27e0d49-2fa4-47d5-8cff-a17ec5e40f69.tmp
Size 10KB
SHA256 8aad44dc6c6ce221a7b8189ce08b67fe665d19b0316c382f473ccf8f88d15427
MD5 897e9bed569676c9ed8487320ad92e01
SHA1 359d68206e05ff7ea519121726185c2b57507818
SHA512 83861270c2337525962c22e966675f87995f65c196f4b27ae8286846df319adafbe28144db25d61a187c7f85d0536317275cfc3257294d9c32e9f6379b23eb44
SSDEEP 192:sxZfRmYj/faKsAz6GY77Idp/I/W6+WNyh9/Y0vcgP7Ig5BJ:sxZfVj/faKsANY4w/bm/5hR
TLSH
T1E932E9526E24A93B8CCBD219BB25BF53D6FD5031A1D11E88E6FC961C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addbed6e-ca80-45fc-a764-7a38b36c9769.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\addbed6e-ca80-45fc-a764-7a38b36c9769.tmp
Size 18KB
SHA256 4b4cb256aab7c7ff53b903896b374dd5f4863555d33e9502c85639f5273d0fa6
MD5 26775a1def0a5609c91b8fa896fceb00
SHA1 9736e82398735be85022bd17437cd534e58d2570
SHA512 75933ab4f524b5821728789fa0fc706fc4ffeedbebb997c8ce4873e1497ea22c0b318db8916da2351b777bbad1410cdc9b090c1fe881842ec2443b4a4da786c4
SSDEEP 384:n1QkUSv08NLeSq41gFmX565OyE82vaTZc8btWIIlf:P0oqBQEOX82vaTZcOWLp
TLSH
T1BB827D71A879AC3359EBE554F68A3743DEF46077D8841F88E5DC6F2C01CA29C270AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8c69916-a392-432a-9fb5-df6aa61eefb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8c69916-a392-432a-9fb5-df6aa61eefb7.tmp
Size 18KB
SHA256 9131fadbfaa6a25cd74060f22feb0fc866f3e77011f8bfd9466f6f0a7adbdc52
MD5 9516b74b062dd958eb555bf5d7e4e4d1
SHA1 b4cf70df4f86561f16f1a5399616845df206475b
SHA512 d34d9004b063499f7d24bc3558aead0c29bfa47bb68acfc13488621cce910695551b572d5752451653fb14615a90885b1c89e3cbcc6623ce1cc8a0623fff2a7c
SSDEEP 384:n5QkUSvM8NLqSq41gFmX565OyE82vaTZc8btWIIlf:bMsqBQEOX82vaTZcOWLp
TLSH
T1E8826C71A879AC3359EBE554F68A3743DEF46077D8841F98E5DC6F2C01CA29C270AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8177d84-8677-4e53-a887-b3c18e142e84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e8177d84-8677-4e53-a887-b3c18e142e84.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 19KB
SHA256 f56c43082621a4b4e182782c85e1e683d804b232e2cbc0add8fb95a578b7444d
MD5 f81367eb73a76a0143c234b070c9ced1
SHA1 e45daa2de30812c55809fb3f2b42a4a938f9cb84
SHA512 d55d4faba0bdf0d2c12f710135706a89a14acfc89e16cce7b40fd9d10daa0a629d187875354c6a6a91245516613e4430a5ba8760eb2527cc5bdfe8e0b963f099
SSDEEP 384:jJWJ+VMa12krtuVm+cbfQOVjeQ8RJopOcghDjUN/WG5Pbm59m+GDa50qF8c/:1++VMWrVl8RJiOcgJjUN/LQ9m+GDa50c
TLSH
T14592387436F5036AF3B29F759EF1A95A643AB8629C00DB5D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 19KB
SHA256 c7518f5a17a285c30f0fb3e70aeb931c5d344c237418569d59aadeee3c107dc0
MD5 4bc24c7ee8f7183cfd834ac656c07e52
SHA1 3f46d56f7c14b70a27e9308debcdef8084da53ed
SHA512 444520226cce55abf26b274d611947a5a35aa8c7ceb0b2072436bcc9eabac56fa38a6cd300307424a3169103087c8ba0dc3a952128e56bedd8253522d2a314cf
SSDEEP 384:aJWJ+VMa12krtuVm+cbfQOVjeQ8RJoLOcghDjUN/WG5Pbm59m+GDa50qF8c/:S++VMWrVl8RJ0OcgJjUN/LQ9m+GDa50c
TLSH
T1A49238743AF50366F3B29F759AF1A95A643AB8629C00DB5D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\chrome_100_percent.pak
Size 173KB
SHA256 d8cbc2234f40b49437a5876bb008b6b43afdf92391dec3f0739be98e448ab671
MD5 c56bc01c88f2fd186ae22f10b1bd5900
SHA1 b000e68ccd919010eff8c2e114b7d1b6e702d997
SHA512 46f9158e0f06a4e415b95a7dabe88cc4f3eecc235cdaf9d744caf4de5e665ae91599e3c2feea0860e9f6eeb2eea45fe4e57542fae95ed9110d44624513de3aa0
SSDEEP 3072:xHsSzwVnp5NiU2w5+vfdYCJdx1+khejSTS9SO0vVm7O0U27IIABNHlJngfI:xHsSzwVXMUx5c1YC7x1+fSucY7OP2ITL
TLSH
T12D04DFF3B3B0BC3DE65B1A3375950B67E93B81360663030AC28699B12D56B80D9DD787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\chrome_200_percent.pak
Size 308KB
SHA256 55dd419a1cecca86665ba5e6184d6b58edf714d652e67c5220dd3b407d99afa8
MD5 9662c1f572ef83f070d2354b0275ec60
SHA1 04ce905a95a1c3b8521a17ac9f57503e7aa3eac9
SHA512 b1d34d58f5079b1db9764bce2787969113ac7cb1b83dbc3ebce8c9c287af372a639611ba11246a088243e2098dbd1d6ad51341eff2a57a995868bb0db94a3167
SSDEEP 6144:SDQYaReMYz73QYV85u/oFwvwoytKi6obByPGlPFYKxo+:3fIJg5u/oFdpxLlFYK
TLSH
T1E664F1E7F3F8AC3CE5931E3361160A63DD7754351AA6434AC28AAC343D56B9489CD38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\d3dcompiler_47.dll
Size 4.3MB
SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
MD5 fea40e5b591127ae3b065389d058a445
SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
TLSH
T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\ffmpeg.dll
Size 2.0MB
SHA256 f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
MD5 0173d01bdcb90a5027ca96d633686fd3
SHA1 9e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA512 47665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
SSDEEP 49152:A+cOvGFd/RIgWtRZgE3A0bsPSZAjhwFo7zMYq/X+838tUy1zf:ADOvkOjtRZgEwykU4f
TLSH
T167A5BF07F6A601F9D01EC1B487AFA633F6757C494620763F2780A6252E7BFD08A5EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\icudtl.dat
Size 9.9MB
SHA256 18acc07d9ca59b1e599343b022a9e602a0a0c152866f7e5dce1fedd2dbcd33a0
MD5 9e8b247aa7a609e6632518ecd6634fc0
SHA1 cc43315bec76167be7dfbb7dd0b6d61974204d6c
SHA512 7a9590f410c14886317d7cdae606b50b4a0355061e251aa3bcd3e0c614438298e839ff116553089116423e9bc98c131f35796478517d88a180a5a2d08ff7fa5f
SSDEEP 196608:wzwSv9AA0fJlt5liXUxR0rHc93WhlA6t9QJGX2EXmJNVR2m:9Kl0fJlliXUxR0rHc93WhlA6t9QJGX2z
TLSH
T1DBB62706B2FB4EC1F9FB6E70D9F462679566BC056E71815A01002F3B1C777E08762BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_blob.bin

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\natives_blob.bin
Size 80KB
SHA256 02586eeaf4ce40d1b34310d885e34fb63e8e9f155fcedbd796536735907cbe80
MD5 1582ffe1b8cb37438bc22edee6cd0a90
SHA1 01af249f33b2e5ffba18ba8f7cd76f2ee0e5f425
SHA512 8c66ba4ef15fea573c29f0f6977e290b8fd72f4c8833f31a9b0ef4285f5493e9b27daf3a02c352ed12eadce36cda933d9d97576bfa4dcbbcc04294e73ad9ebfc
SSDEEP 1536:+bz4Oif2sMnL8gDpKD0rrr/4or06mGsY3csV3iEBSsU0fHBvJ4YfD3z5Q29ei7gy:+bz4Oif2sMaEBSJ0fHBvOYbj5heikwVJ
TLSH
T16E8366677FD67AB746A5B5F6E38F971EC2B8CD23663858B29408CC84199304C847EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources.pak
Size 8.3MB
SHA256 43aa558648917a11fde82e73d9f1878d500098196e675ce2915c26361a05e8d5
MD5 95b94a5784a8b31b3dfb56ed309510cb
SHA1 85e290c41d4be9c0d591404b281dc3931bd78c0f
SHA512 86ebe9904050d8653a029b52effd977a42e727ca40e62c7d2ceed4685dfaf762678a3402c16d90bb0a05357eebb988614964fce6ae19a67636f6cc3f8578bac4
SSDEEP 98304:P7DB/Q9dFh3I2qd9VUtC1hhNm589CG+8bytTwU:jDB/ydFh3ydxhfw1aWtX
TLSH
T1AD968D573254003A82EA86FF64BA1603BB376046F45490ACF96CCDCD1BEED429276B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\main\index.js
Size 37KB
SHA256 6f3a2ca34b13636361c25e1dff28d5359f346799032fac002077dfefbffd3542
MD5 6ea67ac137c5ad846618952f83fe9c0d
SHA1 93085c776930abd087c161baa741376540445da5
SHA512 9208e169861ca094671702e3027fe11f73db47f671db07322e7f0954d507033b71c7d70307c756e80436d825f5be412be575e4bb1b721eca9ad57a313714a7e0
SSDEEP 768:iorZAZVjcWmORxDzAYEIM6LDINOtQnBoQoPfu5VS/vAwLr+FOiyRtC7rQC7DCS9B:iorZAZVYWjzAOM6LDftQnBoQoPfu5VS0
TLSH
T14D0309CC72C6F42A07A36179A81F200AF1BE0D28A41DC550E226DDE67C7558A937FF6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20e0fcac9398df304f58.woff2

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\20e0fcac9398df304f58.woff2
Size 6KB
SHA256 b8777c49882cebbe642f3653126aedc504b1d2caeb90df820c56f96b9123006f
MD5 c480c89c7f2cc37b43140d28b608ee57
SHA1 66cd57e9cdf04352fcec5b872f0303778e60bc3e
SHA512 4b069d3c003c6f17719737599408f689f16f50a634512390a6a4a839c03ad6769e876c4c2e41b1f741a282023877f3e8ecd68f2fc5f1e087108511e469e84f45
SSDEEP 192:5cVtUCUOT1huTcUgMRZY6ezi6yEBKpq5yX7PQJy:/YUFZcipEz5yE8
TLSH
T119D19FE2A20C2059E4DE242E5BB739B07221270C4F95F94C4A7E062525B56FA62DB37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67c5804322a90d8b2f34.woff2

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\67c5804322a90d8b2f34.woff2
Size 6KB
SHA256 fddfa9f33d8ab7c4132c72e417278b549b051c79d68512bed859762698a74990
MD5 d512f3397f8a864777721c460b7279b8
SHA1 d2accc35f7bdca77941f86b3ce6b24c397ca510b
SHA512 30c9bce4fe8e24400a0add9c79802c5fbb65ba2c079abca36b6d1132e11d376472e2f2d9555e229f0cdc50887df1bedb1f7814b1e64b5fff5a0045f271c09fc9
SSDEEP 192:sMU1plZPImFA41BLPM8ELgm3zn0hYy/Wz41N:A7QVQBPQgmjn0fD1N
TLSH
T14AD19EE4E0E84A5BF2A2417D72D4C63C5793EEB4907211579785A718BD498DFD8CF048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

778d1da879cff313cd40.woff2

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\778d1da879cff313cd40.woff2
Size 13KB
SHA256 8c2a54278c4cb87438f4a1c73242d727fc3eea82dc59abb393dd3937b17ce1d7
MD5 c7a65b5f9af2c8afbceed5fd6dacb46c
SHA1 54f3895b08438523a402ad5cf3c0be2168f99d30
SHA512 0aa12bb0f75ccc95ee7ed27332a36f933fa6e959d3de150ed218be43063f4998a48e54e627a239a3aeb8570286da49b8a26aaae23b27085f39b3e4f81d9a663e
SSDEEP 192:glGT2aKwQPOjhw1vfwuwIIy3dAuUAfx+UhwQSGU8r7rm5DRcG/nkFtaeSrFsdrX2:ETaKXRjfAux+uhJvm9cG/non6oD6
TLSH
T1F252C0A9C2487FA39766F7F3106DC2F570896863E40EDB11894A73B71C259E4193D6E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99d6091026fa243a1e71.woff2

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\99d6091026fa243a1e71.woff2
Size 14KB
SHA256 72b7b42dc1fe022438e97d26a6e9e979ba233d5c6760f54843d666392a73d05b
MD5 a6bbd747244c88801424addfc3459901
SHA1 6ac33280eed88afca48cc5ac08fc1f299072845f
SHA512 62253c1d0ad226076d538de6c56ac73626afbdc4fafe080c81090ce64529e0e8095298ad0a2193e76e46e1089495b6f1344a0b957847277257adf0afdb339b8a
SSDEEP 384:vQtIOUeOLkYgch4j/FVHF8YGfzRwwookmWMhrzPChBMOd65xxPc:vQtvUJWdnl7szRwwaMhi/M75Hc
TLSH
T1A852C08FA325ABABF119D1209C0D315CE270C6E7C6D65155B214A2BBA4EBBCEC471078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce543e0d04e708954e86.woff2

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\ce543e0d04e708954e86.woff2
Size 6KB
SHA256 3c2a2149f758b7744e2258f976d38259393a24343745a852747dc61f32bb15c7
MD5 3b913d79ab71a5900f234cd6e96b9f81
SHA1 91ea75c661b9b06929e1e52b6954b1a982fd641d
SHA512 44fabd746609cde0cccbbff550f5aa227ffaf164a143191afb5c50a255a7a5770ab4cea6f4dd0933034f2103151b6ff1a5a21bac74fc5e23e67263a9be5b2ff4
SSDEEP 192:QvXLvwxh90p8C2W6leejb1GLLGHSLmj8hr0hJ7ikT9btT:ybvu90WCh6pb102ymjIU7jL
TLSH
T115D19FC521CA6806F34AB17B5973F930D002675015A8BDA2D9FBC82A5760F72F292A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e447f15e9ee41f4aeacf.woff2

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\e447f15e9ee41f4aeacf.woff2
Size 13KB
SHA256 5fc4c95920416b0ef0b5aee93a90984989183a6d29f712e725a3383309806a54
MD5 0f7d9a10be7f1a2f1a2add4dded5dae5
SHA1 03184a1d29b1199670b159f72db9f134def99cb7
SHA512 408d09e9cb26d93f97e13856b35cb80526b3b5ca36b80c76c10e57e8c0bad2fbabdc1f5f98cabc5a8a641c54adbfbf16c8d3df545de55ac247046b2f2b49f335
SSDEEP 192:Nle43znpqFnVtKVldmEi70uEzj8m4Z01ejuXHhIQ+B6MbmwYkO82W5f3vtOduaxz:hiGFTi70uq+09HyBxLqTN9wNt5Ud
TLSH
T1AB52D0D0FB09684774D3262204026AEF8DFD018C78DA08076E73E59623D75C1ED98FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\index.html
Size 558B
SHA256 10ead73f27d1906d8ab24b31f26e1c0ae6f0c2aff50e00d04d748d7ef19c8959
MD5 73352788ba0c5185d6d350d53923a56c
SHA1 d5db55c5821781dd2e15242a82f7d2adef27f2a0
SHA512 51179410631461e3b339dae7341412e257187b030a84a0fcb804fd4759831ba85e66107eeb3c40c96b51414759241f06306bd796200a15c66b0a9fea32e4f66a
TLSH
T165F02BC02DE9246419907ABC57F2328C80DAF909DA8F06B5E060152CAFD0F7DBC82EC4
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\index.js
Size 187KB
SHA256 5ffc8262b9519842904557f9ae3452d51f1edde86e231fb61b896d3e57ca62cd
MD5 c247fa977848d05795205e753728db94
SHA1 2e644efdf7c600148e368e997b4e90115d38914e
SHA512 9e578d321dedcf9957e231f93491637426ea2e9cfaaa6f71e93ef96b9ceb5fb278d2a27ed52ab4b41e66f4328be59bea29f923631a4829c9619524a7ae1c9772
SSDEEP 3072:1kA3L2hYWeMxMEW9B1BCKzKlS1PXoyHVUdXJFk:TW7/+B1BCAQLyHVkk
TLSH
T1AD1419E83891F5925BB342B310DF1807733D251B680D8960E215FD9DB8F845EA27BFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preload.js

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\preload.js
Size 372B
SHA256 1659b09a7954fa0fd90be0a1faad3d9bd767710d1df84092686fca97cc212012
MD5 db08455e9cd9db62c84c27c1e2fff2d0
SHA1 85c7fb6b86cf922989d38c2dd869cc3dcaafd1b5
SHA512 b34f8d4fdef020a51594e029252dadf45d9cef47df6e6048f61fae8bf200707ebb48848d0426d879038ac52974194ea4a16b69ca08231097826c1f27a6167d3a
TLSH
T19DE0928C20D3AF7B668671A796F725C9E15D8CA4B90814904AD2C06BB45620A80B6B1A
MD5 SHA1 SHA512 TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\images\icon.png
Size 336KB
SHA256 21a587a0d9e886e13c707f9ed00bf6b8548eacfb4693ced3d420f7bb3bb8faa8
MD5 38e7296c7f3850c6cb664b2f662193db
SHA1 30db42cf01927139a8643c8653a756e7d9a642d2
SHA512 ad63fadec6b349948d0a0b54981ebeb7d4002c1e3d6dbac83bc8419e6bb6e4a9b8bc5828b33f7cfe96684255ee9df0ac5807b15ecde94bfc51f34e068062ec44
SSDEEP 6144:hpOojCjkDBdteEzv1Xh1r6GOHM4f8pqdT5jAvE9LZs0Grx1HSWG2b4Kkl:POoOjOBdYEzvdh1rlG+qdVjZLZs1/GXt
TLSH
T17D7423C8C15FD734C399722635D63DE1CDA994298F352A137CA394B6AD1832738286EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assassinscreed.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\assassinscreed.png
Size 23KB
SHA256 0cbf6491a48ede84d37a9f3e14d585e45091cc9b21f60cdd12dfa29d92c69393
MD5 3c23f7f84b60b235ad99200a978c390e
SHA1 ab6b63db6d211ef1adaec063029153af550d60d7
SHA512 e7bc22ccc821a27d3d29b5bb3e1c25bb0f6f8e3288896f069b155c3d7a3f21ad2c2c67ab4a63a673458c644c716407a5a790f74c913c7b68fcb7571fea63850e
SSDEEP 384:mNpOzCRILTN3eiU7pNDyQLk3AVZuTPlYBz+VkEcRYR6Vcdz4ScWAKNy:mDrILTle/vDyQLeAVZuaR+VkrRY4VCzw
TLSH
T167B2E10325BEB427A533A2454DBAD8E06A2A2899E1D877BCFD117F4D71B568032531B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beamngdrive.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\beamngdrive.png
Size 102KB
SHA256 7a5a4e0f399255b1edd89ce6bdef6c603f7319a3c0e2c1bacf8b043d467a9f07
MD5 e9a639369e5c5edf2ab65348a7afabae
SHA1 fe0efad108b0ab6d926f694a1c38f45ed022cf20
SHA512 2e7dcff9c2dbec17565a5c04b046abdcd96d487c58d3af5ec5dba21cd4133a15e71c59256b9d0cb61129762080ce73045d40ac1936f0fe7945f926605c7afb77
SSDEEP 1536:NYCoyv9eMzknbdTHki16JbrDJ69HBndC/g7HJli+mUjyPe/TZu3lb/:SCBv9eLbZEiEFoHkg7pE+myyPermlb/
TLSH
T1FEA3128D68372534F9E1DC546756B8E6B8F798A0B7CC394A0D5D2B4AB1C42CCE31F186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

callofduty.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\callofduty.png
Size 110KB
SHA256 cd0eb7fa16c073bf91defb67bcebdf8f609f2e8e26c3339ac1e63801e19aa329
MD5 c40b2c16dad08a7e5920ddb538fc237b
SHA1 c806e8d31fd65fa7849a872816ef2b45f175a95f
SHA512 cff0d3954e47d72422ae7ee427d41b01fc8761c7d9861897bfc7ece9e80075b1c1f80cfc0a0ef8971fb989207362e05350a8d8cab3f02f2127fd0ee06ed1ce57
SSDEEP 3072:ejpZd3Pynd3djLoLQ10aC+8LXF4tqHSpJjuw:eJa9lqQFMCtqHW/
TLSH
T165B312AF5C48CED0ACE2B0F6A6E54D19384BE89E528C604D691D3C08DCD7BBD425E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

counterstrike.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\counterstrike.png
Size 37KB
SHA256 8e8b47802aa5fcd8f084721b7337675789adec6eeccf4a01b0b87fc545f893f3
MD5 0022d77585ee56bc9bfb1b7b70ab18de
SHA1 6a3c7a6208a537bc06bd18652fa17b056358d811
SHA512 4de4ed1b9f173f22e1752607bc9b5a33d9f074a004515df20115012e542d0a015bc10b878fb447ab27200b450bb0129fe74d260beda8525d8e56453961830439
SSDEEP 768:S0AuOATDQ5n9bHJPpOPQDakFI+Wu+oQzB/ATA1B+9sL64l:euB4lkKHKZAQusW+
TLSH
T1B70302F4CD868874F2B608395C26469293D4A162A9084BFEDD11BFE6C7EC512E57F092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eurotrucksimulator.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\eurotrucksimulator.png
Size 40KB
SHA256 43092ba476dc6ea9f3b40b90d1c6f02f040d2f3b3ff23c9a0244b879e0c260f7
MD5 39ffbf80634926c2b5fbbcb0b07bbb35
SHA1 3aae1c0534ffcf3feb539c49967f649a85d699ba
SHA512 1a393920f9d69958f835be49d88d7b1df87333e6774108fabf6c6e6970deefe2bd77b8ef1fbe8a683415c22b91a91f83b4a413fe32f9d02a698c40f7f2c15391
SSDEEP 768:XIonubhktWCfTap2uIPIUQamqA7unYhXzG069XK96idQVRnW/+ZnSYsczwvZ2S2l:4oumtBTE2uIPI+mqYtK/9XKwikRW/awg
TLSH
T18B1302EC18C8DA84E3A8C9D6F135CE9323D19E2D73D8C100F666078AD85CCF5582E86E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fifa.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\fifa.png
Size 40KB
SHA256 5bea0218a1ce2bcd3cb65c18f7d422c4a5f943f8beb17dd7ae6b7783f11a8bf3
MD5 5fb2a9aa8372c47ee781a04106367008
SHA1 23b56321fb0b8487eff1b345ed7cab38b995fcf6
SHA512 e0f4695e93baf5a86375414f880cb720c71f62ff02f64c050746f3d3b62aee30cff1aab965be6b96a2e79b583107982f5ba8d0ee7e265126caa775e7a00879fd
SSDEEP 768:fXmJhP7uVV1VuwitxNTEaY9Dj0kKhogvkcm1Y9Ly/cRUE3CyHRhmy:eJhjI1uDtatjTKh9kcp9/U+Dnmy
TLSH
T1E413F291CE626A4C68E5DB4BC724DF383360DD1FBE16B21151DB7D97AC3868CC528604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fnaf.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\fnaf.png
Size 77KB
SHA256 ecabf07d6addef6a9a2e5108e5adcdc8afd1967233a6178d8f346fcff359e9c1
MD5 6eab37e5f41d0dd0549f7ba07f28b8a6
SHA1 a382b6b758bb7d55caa68c491ea01e4631b40df3
SHA512 113960e5ed378a7af80aca56a678dd20332c3b932da963c4fce387b94f2aaff43cd4e793041ea7fb754021f9dceabbb09d5b3edcaacf3e774e0c6dd9eaf74644
SSDEEP 1536:W6YBQBQHsJrjYgZtwEYczVFWZ8Ekrc923M1d29a4w37gGIFOORfft:WjRHs9FZCEY0FKBd1dYk7kFOORft
TLSH
T173730289A28D6EE8DC27FC39E655065F53FEB08C5D09312B344A47076E7178C936A2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fortnite.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\fortnite.png
Size 2KB
SHA256 c4caea7f6f402742b658d98988f354577bc2fd5ca56f710125d40b33eeb866a8
MD5 8af59f5b20362772e22a9ad41403c891
SHA1 af6ce6178c4cb8958dd02a8387a0135ad23587d6
SHA512 6332c6181fa23c3874df867141855fd63d5e8ce1d7cd0e279c8960f028652f8b3c9d2e324ce2aadc9cafbc4f8cacfdfaa602c4a3a848a2b604d4afae844c75a9
TLSH
T120512A4E1E0D8F2EEB7E499E4731FA637246853182E6B1B118DD93BD0C52182C6D3290
MD5 SHA1 SHA512 TLSH

Submit Download

garrysmod.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\garrysmod.png
Size 41KB
SHA256 0522ebab2c1c7a8c82d87f697a99ea18b8d247e1a67620107bbd989ab5025335
MD5 194e8bf022a7b171e9103a2a355f564b
SHA1 f78caaa1f4347c1de24ba4650027e5c38ad09115
SHA512 30f7da14cb3daa39b1d860fb51468e2ded26de64491dab5eb2af3bfa9b113cfc0fbaca610b649aaf68cfa04b2c13d3f030a41b15db3b4b126f8775564f8e3aba
SSDEEP 768:2+JkzthDK6+5qfTy2pLJaBe2+8auGLdZ1mHXnGKfm26JYm0oRdx7:nmb+wfTy6sedluEm3nGSfoR7
TLSH
T1B713F1FB9F26F98884FA10B2313EE200F153BF678D0AA421E6A716F53B5570DE257110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genshinimpact.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\genshinimpact.png
Size 74KB
SHA256 0ed9e610e8ed24a72812a31f21d360dafd354b1f8ad1e8cf6ccb3c16aea4eb4f
MD5 240ebee374f0c8eb491067c0685a5d43
SHA1 a8a2579c54c08543d4171b783746054850e03dac
SHA512 daac3abfbde89fc089d3fb34cf89f8996ffe12b275da70c5a228f802c8b96adebaa8193d0657d4e9360dfe868d41e1f56c7c1ee067a4037d88dcbe17d5655c25
SSDEEP 1536:PILjRF4bR+HGJHbrmIvcsAwCSm7pit1KlUPX/DWa64HXnKss:AuIE71vHArE1cUPrP3n8
TLSH
T13B730205C0287CBA450F0E344AB1C3EE460D79B679D2B43ADF6256F180C6DB2735A696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gta.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\gta.png
Size 181KB
SHA256 fc7b9ea9cac51673e507c4584fec29b6f367f2220387a1961d7bbe15e866dcf1
MD5 521cc46a97e77a7e84dbca62cb57b5b2
SHA1 367c1208d80f1ed1f93b4573590d923e97627d31
SHA512 a4907e13dcd421de541d7441b92fc7f4faacb5fbae286c3135e4a34d43c88eba96e15791d96670763c4500653aa58651bc8daf3b80fa796a39edf851738005f6
SSDEEP 3072:bQDI0BXqN6UFq7H7MSZTybWcybcgfG6HIVjK8Acj0ZS5Uc2INOhh6bk:bQD9Bq4xMzVgfqYcj+S5BF6R
TLSH
T12304125DA870E1A6BF90F4770D472888196B48E758514762B90A3F7BBEB36E3C788053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heroes.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\heroes.png
Size 124KB
SHA256 f5aa59de85c3cabc5f91e2828ed11a6ad2ef84e79b279de5b48a15910b64bda1
MD5 2b4bf2546999404ac10fd90b74689cbc
SHA1 5d978f6960e9c7ad5ea40c1dcdd8a45222ace75a
SHA512 afd06b0ac8b258f9b7a50ff298a15bdee1ad4a4a4dfa51f875432eb22a988cd77f75a728a0898fb15bfe1382d046817d30af134af5857060498b7fd7295d5fe5
SSDEEP 3072:J/wpG+RmuJooIEDKsf7XERmPjLcKoTs2H:vuJoBg7XE8PjLcKoTxH
TLSH
T152C3124638FA394F623E25DFE8BA8BFA533637548075070B9474B3935C276A0D04C7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mafia.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\mafia.png
Size 25KB
SHA256 e4003aef536f72dd00d3b510fc5427a992ac7c95e08ba17ed09874f1d96a07c3
MD5 a097a87e1f2ec2799c9f6e675f220995
SHA1 a4ee05325a26e3e4f8d8386189f103d11e7caa42
SHA512 8b0a03b78a8a7a3901e54dd3d205b9c632d452b7d27ae45d066a01eb1ca825bd9aaa1569d23c2fae5fe4270002bc5a92f6f606f31551d95e632ece28cc5836c6
SSDEEP 768:vHaIn13CKcdE2rW/uhajkAF30oIjrxg2NKJK:CU13ChunkakyUjlg2KK
TLSH
T1C6C2E0D20B4CE5BCC692E57F936AE71F7E99E270CA22912612AD8F1950CE76002C0379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metro.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\metro.png
Size 114KB
SHA256 278a2234d1b9134b643047b977708d27f72cb7dbbe3e4f9e10b87b940aef187f
MD5 99ae5b8c12b0d327b0ce9263d08c565b
SHA1 ed0326854ee4c445b4ab80148139e5a5038fe0f8
SHA512 e0f51e79b1f0b3ec1da3f4afeefd257c6d8964ace9bb0fc2bca3f9cc0e788c601b6c47be3989ad061e4f7c34b86940c32c728755a85df1b4f9d3ed68548fc66d
SSDEEP 3072:fGN3N/9peBdPMMNEowuVjL74FiPfJAF1b1ZrQov/u1:fuN/K3pNku94F2azcO/u1
TLSH
T153B312FA7D99177DE6F0EDCBC9C285F98F28FC6A285939CC011421BD2B02580EACD651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mysummercar.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\mysummercar.png
Size 68KB
SHA256 d843656bb29bc244431e6303216ee2c927e984399a1216c162b1aa06d0e719cc
MD5 7d36555f8490e0420b33d762cc6d3d13
SHA1 f80bafc373c19b247d8357e5a7945781ca613bde
SHA512 3aa400fb322cb27237a61a8b3c0e9636b2139ba02cca958d58b20d7f610bf20ba5d146f1eb5c3d7d614856be75069060334993e4cccacdf2dd86841af9f89b18
SSDEEP 1536:wYIdZgYMRs9edtgRXR6+dV7/T5cblw4dGNX+5WufTejk:wis9WtkA+3T5cblRdlgk
TLSH
T1C3630287F06B6BAE1C9027522CEA2743C484772C958BD4E86CA93F571E7DB34A3F1251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfs.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\nfs.png
Size 17KB
SHA256 b94d20c6adfade94f607326cf5f9d8eb08dd9d3854924b8a2d66f30e23d5e955
MD5 bbf6223061c47254fe9ad7f8160d9bea
SHA1 489ca56b4948f0c66e8f72440b02b89af6cf5585
SHA512 74c423ea9038565ab2cdd465d7dadbac0d1f677fe7a614259e33428f07e571aea0f37adf40ef66a87e82432485f161c2ddea42d0fb0c69312b5f30c1f0cd9941
SSDEEP 384:iDC5eN/Lqv3ywlypZ/zWtwBTsHtn/aUPtZ8xt1LUeUm:ZYN/L01lAz+w6NCm0LUlm
TLSH
T17582E0BBD2A72348CFD1D8BF3A676F01E4B6D524EC996B0162EC47619D10FC91332892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plantsvszombies.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\plantsvszombies.png
Size 2KB
SHA256 fe0161263f81ddfce76663247bb8c55c9e967aa2b8e885419ca4df7a20e1326d
MD5 35f4cd064b98e509137020c20f19e1ee
SHA1 f11afe55638a065fe560e69abb1c69d81a1207e4
SHA512 97c1b317a3e90d791a0fa9975b811ad2b81f3419506d3811192a70a16079fed45ee91880ad5432acc39b8c712e210b0e458a534ab2c1af4fe8b7dd70277eb2db
TLSH
T1E941529F797FE6A9C561ABBC13A63091C833288AA45ABB442029C7A78405E74032577B
MD5 SHA1 SHA512 TLSH

Submit Download

pubg.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\pubg.png
Size 167KB
SHA256 5e6be67b20ad7b82a4ab42137c0a9b6289dc9e31eff0119058cc22f8668d853a
MD5 914998e8f09929ee66fc7726d09195b5
SHA1 5ed570cdf499d7619ed826e656389eb31dc5a568
SHA512 1e89916ba14541e5e2cf0b1fe383970ec9b319051f80f138d20b8e5572e707f5801a19995a150829904fcf61edbceac0ea5264ec4ade1caa9e447b39c94d75de
SSDEEP 3072:Q3xRIK1MpbqwBWsHWWdYKAsVqy1N+RGNPgQ7zE4koZvsMiP+HzZUw0dlNmZ:QIK2pbqJsHWUYi0QMoSQ37ZvYP+HzywD
TLSH
T11BF312DCC0DECEFAF02923B227861B5C8835B2A4D4374E65F2BC58A745816D6B06DE71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roblox.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\roblox.png
Size 1KB
SHA256 1dcb31265efd9ef0aada62141d9ed71cc34d98e938543e90652ff1c2d1438564
MD5 b3add97c24694347efe728ceb493ee2e
SHA1 0eeeb19633422b1241f4306419a0f15f39d58de9
SHA512 541008c0bf29856e1770bd3ba3b3ee6d9a278d12f48dcbe1d6d4a954de58039674ea780eaeefaaf20b155032a694efa65cd99bf2522c05c0ea9ee971462abcca
TLSH
T1A731096A8D33C891ED50762E7EF2414A9A329A62519D1D38EF0096587E90CCCE6C049B
MD5 SHA1 SHA512 TLSH

Submit Download

rust.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\rust.png
Size 4KB
SHA256 ff7d5f4b1177a418fa75fe9cd9fbefe3a1b07f314f3d5a5179015f6827870380
MD5 cc3852bc3f9a32f7c46333069cba6f8b
SHA1 48dc429482f845e95d6b8336a089d3e755937895
SHA512 a4cd2e5e10207e7f943e91d1a0d56bc4f3b3a695ef7668057382cb982c455084617f880bfcb83970f18f78632103b15260bc710b9c6eecc19e2816da6c78137a
SSDEEP 96:/v6rc2xdUysxPNWVZA/JN4bERHKaluQoT+LZ:X6r1dnsxPN0A/neqHKkuQqEZ
TLSH
T102914B1A7590D2B0D121D03C8A209FF5DB4258A427DC6BA06E5EEC6D8F7AD613239057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sims.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\sims.png
Size 27KB
SHA256 da47f0b7d472cfc36c2c0d4c6f1ba89db817c3d065d3f2aab659d71f7b949ee9
MD5 2d2aa79edba03e24c9a3e461ce71908f
SHA1 7145259025ba43b12bd26587fe0681b2677e5d1a
SHA512 2cb5a8ee53b8d6a80a7c1fd45ee3c432fde4662cfdbec25985de853f18f0dfb7f8d0e90130809f278953d1356e953f1a70d2f304abd6bdef3070aa960301b179
SSDEEP 768:dLn75AS68WEh/xUJ/GtXHl4wgRLt13uZf42r:ZnOSlhJ0/qXHERrEr
TLSH
T1B4C2E1667C43A1BFCFFD13658780345A4DD79E89687720A34A51A87BBD34081A43ECEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stalker.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\stalker.png
Size 246KB
SHA256 8984ea92a84bc75cc26d11c5941a33c02490ac108260619122482a113e51d8c8
MD5 394f7aa26c110a306628b1f0292d7bcd
SHA1 c58bb14fe43f1a57e261e58aca7671fbed471a45
SHA512 422e82a497158dc8b49ceced8cf7b5e9256d783ef7881705f69d19096f64534eb3c85b4c29dfd740bbefc6c80d4cc37c2199851e563f54ffe907d8d6ade1f67a
SSDEEP 6144:UMWyCYTsvmJicWbscgRyf4PFWWVe5H/Jv8quytE5U/DrW9:Ux71m8cMsc5QEd5ZRJiMA
TLSH
T10734125CEA2BAEB0F7604B71596FAFB4E59216F464B333871737288D0E510CA463885F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

standoff2.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\standoff2.png
Size 10KB
SHA256 479f6f708a943741423246d0ee8ec9b20b2fc49df3226cdff7d7e5e164c83abc
MD5 d2e2c5b61e741801bebf63deaee96d36
SHA1 c75027d8ca321fdf33a4988bc7f97a11c7f43207
SHA512 5ee37866eaebf64771380b93247010f7f6b7116ff3b4c66a8588309b748aa1f79bdddd0944601dd2875e7fbb7ee66dcc3b6e11ae7fe9a2dfa2443cc9c38bc36c
SSDEEP 192:DBchx6zMhwZFWbuWq6yCAZA88oA0P66r2BEf9NCzOJU/ZOT/iOwa5rpVjWa0yHzX:uhx6zMHbuwyCCALcRNCO7iOwEpVjWaZz
TLSH
T10F22BF8616C96C27A57079B167012B75ADB318F5FD0EBF9110763A173F74C518ADE013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

teardown.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\teardown.png
Size 98KB
SHA256 36bb0f8efd3e1a9b13a25f9e457b3b5d3c3a17a3420c3e550ac38ebe296fdb5c
MD5 c516eaf58311977daf7316a512e59db7
SHA1 2fb5fb1fc0cd4e12e63a8c0b10afd83495950d4f
SHA512 beba24c31bc89632c29078f6acb7228bbf022fcda06e978efab1b38728cbf7325c567d4566eb15780a9fb0bafed0a530360665f552a993ab3d89e915d852fd4b
SSDEEP 1536:bK8bLIGkig2ZebRVedf/vI7jT0W1BWqlKSRq/Ur+nyXs1iCc:b1si0Vsf6tMCKSgUnOc
TLSH
T1B6A31250FD064F4A0E0DEAAEF45020E677D0AFE08EFB96E4612FCE954A02766D6C7D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

terraria.png

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\.webpack\renderer\main_window\static\img\terraria.png
Size 68KB
SHA256 828739263925c3c625a2a4bd8bdd892c1067727b213aee1d6752705273ff2465
MD5 427455709a3a3cd92f3b39cfe8596af3
SHA1 70a4f1b3def0144c690003f290d9d2f2b9e739eb
SHA512 a05b003604efb98d5a757929493319fdce1496bce064439996ea0fe40caa3497c0211a05c09b50d80e73464e7e93bf8779841e7e68c3c6e61400b686451b01c0
SSDEEP 1536:KbVwLT6FHHvl2ImSJxLdPtMvFKEAkGkwEbrK9y+3EfaDFs1:b2FvlXz3LKFGkDbrK9ygEuFu
TLSH
T1A9630278E8983E6B048C968E6C1B54FA613D84CE53051F0FD242BE8665E174FD286E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\resources\app\package.json
Size 2KB
SHA256 3be24dce5b00a4cbb7dbda19d9be141f4f6333910ee5132ca864a059ba2fbe5b
MD5 b8534cf475e2752ba3d44c698f2a65e4
SHA1 1492232e6e8d55f141049e201ce4edb47a4bcf9e
SHA512 560dc54c9b103f9ebbbd9486e6fa01a37009d291f5c08176ced1f88bae4969614d056bef8ff82ba187c18513e646b6c07b298d3705e27b8b18bd2861710abf1e
TLSH
T1A251B810CD06CEA31AA8498664740B83306D59972D59FC4D33B193AC4FAC69F717AFAE
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\v8_context_snapshot.bin
Size 684KB
SHA256 6baadc6adcd5e51d549a4d2f07b619d2a5b97f99a372f33efd3c84d2a369c747
MD5 791e836529dc39d99117742c225a537d
SHA1 8d035c2446758ec65c41e48d3671004527a55772
SHA512 afca91bad91c359af1febc86e5e0cf16b0b2549ccdb6ae1d733f9d66e0d1daa4a3b96273d7888835dfe820722ca8d7e38b1085011dd7d6851a3198cdc18bbac2
SSDEEP 6144:HKD0vNuoqa+sNmrtM2EWAVBeKoGd9Wdv0HNdI9wALRLHi:HSaMmeK5dvIqAdzi
TLSH
T153E4C7A077A1EE87E723957656814BB0B354F10C9B11EB2F2328583C3D2F5E50E98F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3315a608-f0b4-48d0-9d9f-ac1954196d68.tmp

Path C:\Users\Admin\AppData\Local\Temp\3315a608-f0b4-48d0-9d9f-ac1954196d68.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

993e1341-4d24-4347-9e6b-74ef29246664.tmp

Path C:\Users\Admin\AppData\Local\Temp\993e1341-4d24-4347-9e6b-74ef29246664.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63bdcfac001ad18626d4adad4ef7e863.exe

Path C:\Users\Admin\AppData\Local\Temp\is-K759Q.tmp\63bdcfac001ad18626d4adad4ef7e863.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gamesi.7z

Path C:\Users\Admin\AppData\Local\Temp\is-K759Q.tmp\gamesi.7z
Size 41.8MB
SHA256 735dbe1656277125aeb4d19c458cf535a3c835452f16e405fcd478515f64bf06
MD5 0382be4c44561fb7f6c6c8135320b2e5
SHA1 d9e26b7c5d2efd98707c86c070e96c459480cf66
SHA512 bd6ede670a058d316e4e788c66db1bf2f3c7193027c5eab7c5cfe24fbbefc4ef0a805376551e8a138d93afe032c89a06c1427e00d90949ae7530d7b2060df615
SSDEEP 786432:iptZmFXJuwBJUozaOW3Ufv9hjNq7s5afqBvQNZiJ4pr9:ipzaXxJUoXdv9h5q7s5aSQ
TLSH
T18FA733825A00B05FDB707F358D36A56B34A27A50BBBFC149D70433F814AABB17A352B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox manager assist.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-OGGFK.tmp\Roblox manager assist.tmp
Size 3.6MB
SHA256 9bc4ba34c403ac68461d526f651476ca4275bfc52709df565dc7256a3c41fd51
MD5 57dd05677f60dc04dadcf6e516d0fa72
SHA1 90e9bdee76ed8921eea4720fcca642298fefc7f1
SHA512 ac13d0835035b0fe598cb6173d858810b8a780366ba367576d89d57d3064f72549d74fee51bf9adf2576b5c8ff80c45be44f2c1ded5ec03a8e5746ee0d3f94d3
SSDEEP 49152:Q44B+lNsHPWeelGdwSxQRw9CuL0wijepA8oGd9Tg70azpkfa333TDE9E:fIPp70wijepoGzgbAa333TB
TLSH
T180066D13F388613ED05B2A3B693F9254583F767039178C579AEC3A8C4E795802E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3364_1253690588\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

6eeba4fb-5287-4e6f-bb96-83f458c45a91.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3364_1535383871\6eeba4fb-5287-4e6f-bb96-83f458c45a91.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3364_1535383871\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-410-0x00007FFE29A80000-0x00007FFE29A81000-memory.dmp

Download

memory/1104-7-0x0000000000BD0000-0x0000000000CC1000-memory.dmp

Download

memory/1104-0-0x0000000000BD0000-0x0000000000CC1000-memory.dmp

Download

memory/2728-480-0x0000000000960000-0x0000000000D18000-memory.dmp

Download

memory/2728-8-0x0000000000960000-0x0000000000D18000-memory.dmp

Download

memory/2728-9-0x0000000003010000-0x0000000003011000-memory.dmp

Download

memory/2728-13-0x0000000000960000-0x0000000000D18000-memory.dmp

Download

memory/2728-5-0x0000000003010000-0x0000000003011000-memory.dmp

Download

memory/2728-324-0x0000000000960000-0x0000000000D18000-memory.dmp

Download