hxxp://roblox[.]com

Analysis

user interaction
yes
max time kernel
137s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com
Sample261029-ya9bdacc52

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
74	5188	msedge.exe
74	5188	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1392	RobloxPlayerInstaller-BQ8R9DCR33.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-BQ8R9DCR33.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\heads\headK.mesh	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\OtaPatchConfigs\DiscoveryOtaPatchConfig.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Creepster-Regular.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\gradient.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AvatarEditorImages\Sliders\gr-slider.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\DevConsole\Close.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Guru-Regular.otf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AnchorCursor.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\blockUpperLeft.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AvatarEditorImages\Stretch\[email protected]	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AvatarToolsShared\RoundedBackgroundLeft.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\DevConsole\Filter-filled.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\scripts\humanoidWalkFamilyWithDiagonals.rbxm	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AvatarEditorImages\DarkPixel.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sounds\action_footsteps_plastic.mp3	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sky\moon.jpg	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sounds\action_jump_land.mp3	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\meshes\torso.mesh	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Oswald-Bold.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\SourceSansPro.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\sparkle.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AvatarImporter\img_window_BG.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\DateTimeLocaleConfigs\en-150.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\abilities\AbilityManagerActor_justCoreAbilities.rbxm	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Montserrat-Bold.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ArrowCursor.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\MotorCursor.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\DeviceEmulator\sim_headset.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\Michroma.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\collapsibleArrowRight.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Arimo-Bold.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Sarpanch-Regular.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\blackBkg_round.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\Cursors\KeyboardMouse\ArrowFarCursor.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\DevConsole\Clear.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\compositing\CompositLeftArmBase.mesh	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\DateTimeLocaleConfigs\fr-fr.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\Montserrat-Black.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\localizationTestingIcon.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\heads\headL.mesh	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\GrenzeGotisch-Regular.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\LuckiestGuy-Regular.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\advancedMove_keysOnly.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\DateTimeLocaleConfigs\ja-jp.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\TwemojiMozilla.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\Arimo.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\AccanthisADFStd.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\Inconsolata.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\defaultDynamicHead.rbxm	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\abilities\AbilityManagerActor_oldClientInitialize.rbxm	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\unification\AdapterReference.rbxm	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\DateTimeLocaleConfigs\en-ca.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\NotoSansGeorgian-Regular.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\compositing\R15CompositLeftArmBase.mesh	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\translateIconDark.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sky\clouds-bc4.dds	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\abilities\AbilityManagerActor_noReachAndHold.rbxm	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\NotoNaskhArabicUI-Regular.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\Ubuntu.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\AvatarEditorImages\LightPixel.png	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\configs\ReflectionLoggerConfig\EphemeralCounterWhitelistMock.json	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\DenkOne-Regular.ttf	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\Cursors\Gamepad\[email protected]	RobloxPlayerInstaller-BQ8R9DCR33.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sky\noise.dds	RobloxPlayerInstaller-BQ8R9DCR33.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller-BQ8R9DCR33.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller-BQ8R9DCR33.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-BQ8R9DCR33.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-BQ8R9DCR33.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-BQ8R9DCR33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-BQ8R9DCR33.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-BQ8R9DCR33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-BQ8R9DCR33.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-BQ8R9DCR33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-BQ8R9DCR33.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-BQ8R9DCR33.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-BQ8R9DCR33.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-BQ8R9DCR33.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{4A7C283A-71B4-4B27-A910-0DCA02BA943B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-BQ8R9DCR33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-BQ8R9DCR33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-7062aec9dbe74b14"	RobloxPlayerInstaller-BQ8R9DCR33.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 5044	4084	msedge.exe	86
PID 4084 wrote to memory of 5188	4084	msedge.exe	87
PID 4084 wrote to memory of 5808	4084	msedge.exe	88
PID 4084 wrote to memory of 5808	4084	msedge.exe	88
PID 4084 wrote to memory of 5808	4084	msedge.exe	88
PID 4084 wrote to memory of 4336	4084	msedge.exe	90
PID 4084 wrote to memory of 4336	4084	msedge.exe	90
PID 4084 wrote to memory of 5324	4084	msedge.exe	91
PID 4084 wrote to memory of 3236	4084	msedge.exe	92
PID 4084 wrote to memory of 5324	4084	msedge.exe	91
PID 4084 wrote to memory of 5324	4084	msedge.exe	91
PID 4084 wrote to memory of 3236	4084	msedge.exe	92
PID 4084 wrote to memory of 3236	4084	msedge.exe	92
PID 4084 wrote to memory of 5568	4084	msedge.exe	94
PID 4084 wrote to memory of 5568	4084	msedge.exe	94
PID 4084 wrote to memory of 5568	4084	msedge.exe	94
PID 4084 wrote to memory of 1440	4084	msedge.exe	97
PID 4084 wrote to memory of 1440	4084	msedge.exe	97
PID 4084 wrote to memory of 1440	4084	msedge.exe	97
PID 4084 wrote to memory of 1552	4084	msedge.exe	101
PID 4084 wrote to memory of 3816	4084	msedge.exe	100
PID 4084 wrote to memory of 1552	4084	msedge.exe	101
PID 4084 wrote to memory of 3816	4084	msedge.exe	100
PID 4084 wrote to memory of 3524	4084	msedge.exe	103
PID 4084 wrote to memory of 2000	4084	msedge.exe	107
PID 4084 wrote to memory of 2000	4084	msedge.exe	107
PID 4084 wrote to memory of 2000	4084	msedge.exe	107
PID 4084 wrote to memory of 4476	4084	msedge.exe	113
PID 4084 wrote to memory of 5960	4084	msedge.exe	114
PID 4084 wrote to memory of 4368	4084	msedge.exe	115
PID 4084 wrote to memory of 4288	4084	msedge.exe	117
PID 4084 wrote to memory of 4288	4084	msedge.exe	117
PID 4084 wrote to memory of 5080	4084	msedge.exe	118
PID 4084 wrote to memory of 5080	4084	msedge.exe	118
PID 4084 wrote to memory of 5080	4084	msedge.exe	118
PID 4084 wrote to memory of 824	4084	msedge.exe	119
PID 4084 wrote to memory of 1648	4084	msedge.exe	120
PID 4084 wrote to memory of 824	4084	msedge.exe	119
PID 4084 wrote to memory of 1648	4084	msedge.exe	120
PID 4084 wrote to memory of 1648	4084	msedge.exe	120
PID 4084 wrote to memory of 4668	4084	msedge.exe	121
PID 4084 wrote to memory of 5944	4084	msedge.exe	122
PID 4084 wrote to memory of 5944	4084	msedge.exe	122
PID 4084 wrote to memory of 5944	4084	msedge.exe	122
PID 4084 wrote to memory of 3892	4084	msedge.exe	123
PID 4084 wrote to memory of 3892	4084	msedge.exe	123
PID 4084 wrote to memory of 3892	4084	msedge.exe	123
PID 4084 wrote to memory of 5896	4084	msedge.exe	124
PID 4084 wrote to memory of 4924	4084	msedge.exe	125
PID 4084 wrote to memory of 4924	4084	msedge.exe	125
PID 4084 wrote to memory of 1092	4084	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff842c3c188,0x7ff842c3c194,0x7ff842c3c1a0
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8575151632151819241,15338340107070276318,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,18242305221098238952,12640639995588204261,262144 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,4777063797326118550,3508176000272971135,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9704489946283492975,17698661338455232009,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,12651997997302619251,3336172453422991939,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,2030476505815714987,3318788548728065757,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5428,i,7379968237576067001,850342887428066411,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6441278817140470751,15940340955602653241,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,13604400843966419614,1232308770568294991,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5693217909532039915,6113015305628676123,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5693217909532039915,6113015305628676123,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4980,i,10197062502960444671,1230391730224232208,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,11942118445499207804,923428615410782085,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,15111714845576654111,4374441825413651492,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,4557532610579177354,4677894908561272926,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,10375991017943434765,12036259857142990520,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7036,i,17137262578849359526,11341512955130992886,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,5518101765396636025,1231975704728762957,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4976,i,14544214312293552144,6076764811150805924,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,3487779958533079352,11703265230505708823,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7084,i,16974089318779154882,2866522418234481953,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5564,i,14783904827451935042,653599136748705601,2097152 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,3745535882041590163,12822335747312689660,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,11475476327735688609,156456523385269471,524288 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5696,i,17701030855098887735,10541921136144732198,262144 --field-trial-handle=2188,i,5700454961702281186,12655590295159636289,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4452

C:\Users\Admin\Downloads\RobloxPlayerInstaller-BQ8R9DCR33.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller-BQ8R9DCR33.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 13.1MB
SHA256 f52514b1b91376ff9ac66f49d16f7cbda4096d44fcfe3dbb662a2b8547dac9b8
MD5 18f405651d9446df3579f785ee96034b
SHA1 2dfa42893bef7f8277339dd44a412780db67aa36
SHA512 9d17596e911fcbe3e2870b6477c00c4ef63b9ed5a1b2e682b4c411cdf155283a6cdb150a4729264274cc1778898ee40a7f0428177e0af5e7aa173037e8f25a6b
SSDEEP 196608:jVhIFplZ45+y23Ftw2xYxKDi3zA3/4rsm5p/FMrp/2IK:jVs1F/YxKDozA3/4VdMrp/dK
TLSH
T160D69D6AB2B800E8D4BBD178C6565613EBB1B45603709BDF1AA046F61F67BE05F3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02a66b74-c86c-43ad-b60d-6c0eae247896.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02a66b74-c86c-43ad-b60d-6c0eae247896.tmp
Size 392B
SHA256 f9688e91a4d551a757802c263bbc7bc7a271606000aa48d29417b3d4eb159a33
MD5 dac9723df3ee8b37ca42dd79d898e703
SHA1 d027040461336cdd0dd2f54c2589193a42836eb3
SHA512 8dbbf022a67d2daf2084865be28372f35676f9e1c44c00b4d6513e088390b1db53024b85ef435dc466e8f497cafa5e45d53b4e567ccef5b331b16b8b4ba18bd7
MD5 SHA1 SHA512

Submit Download

1125b734-beb3-4c3a-8bf3-024079503b21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1125b734-beb3-4c3a-8bf3-024079503b21.tmp
Size 31KB
SHA256 cd018014cd8305b5424e2d8cb7a3d286c80a3b3fd5c49cc620128c220d3911b7
MD5 5efd2010037482d0de9514b610564bdd
SHA1 7efdcab13ad7abfb052a7bbf448b04c6b4746e82
SHA512 a713742e23f1e1dc0d6c45a175b38ac8a7bf42a932a59e4335118ba721b041e84c580dab6e5d76b6d4582ddce0926c92ea436c585836f4525bd4d9babcd55696
SSDEEP 384:nYiFzQkUSvmg3sNZ8TUNTUlI4maKMBMkw2f0BCpcM9omVvaTZcroMgL/7Iz9IIlO:jFdf3kwgew9BCCmVvaTZcroOLU
TLSH
T155E2B1F198D79977D9AE4B97A33D2E0299FCC143B5884A94B7C91C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19dd8b8c-4251-48d0-b918-41a9c58f65b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\19dd8b8c-4251-48d0-b918-41a9c58f65b2.tmp
Size 26KB
SHA256 33889315b75a25046109b15e42af36c2ec7d75fbccdeeff23053700976062484
MD5 8b314317f201aecdf7e3842c3bb76443
SHA1 0766d5eea64c10865a56ed751caac37ae6da9ebb
SHA512 7e3388c80b8b3da091533a1818e5132a272f5bdb3d2ca05b76f1adf0b0d793d8fb47cf678e85f6e00a4f61671ac35fdd567172570b3dd032a99671eb930a80c7
SSDEEP 384:nJiFiZcI63sN18TUNTUlIm2aKMs1NRw2f0BCpcM9ZiVsa+VYGRgL/7Iz5JoS:gFQ630wgcOwBCLiVhgPJ1
TLSH
T14CC23932EC98D9ABECEB4BE5E74A3603DEF44253858C9AD4D5D91C1D00975AD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

675bf12f-5907-4983-9e7e-242fc0f15356.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\675bf12f-5907-4983-9e7e-242fc0f15356.tmp
Size 26KB
SHA256 3d03d598061a6cc003436a333a4991827386f88d295e51bb42b5e20fe53a069c
MD5 c498e1fd5298444d43f1391f14c03689
SHA1 e69edf8a675b75c073626ac35f1890b69063c3bb
SHA512 cc964feb89e67629ac0fe25213dbd62d88784d87ecbdb26dd1560a578c33a2c0d615c3b323a445ffd7c050a84b66f4c2f65c5441c15b64793f5ed4a3ec8370b9
SSDEEP 384:nCiFzQkUSvp3sNZ8TUNTUlI4maKMBDkw2f0BCpcM9fiVvaTZcroMgL/7Iz9IIlO:JFdp3kwgeH9BCliVvaTZcroOLU
TLSH
T1E9C24A32E899DEABEDEB4BD5A70A3643DEE04253C98C5AD4E9C91C1C00DB1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88bcd800-1684-4bfc-82d9-f9ffb58af2ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88bcd800-1684-4bfc-82d9-f9ffb58af2ec.tmp
Size 32KB
SHA256 8a51be4c3ad94147caef166188a25859a2b856c5b1129b0385f04b054b3f8030
MD5 211c46071a01a372ebb51da9d3871df7
SHA1 5ee4151877f12ae23ec4e2a477a8764457575142
SHA512 96a2527b8ca35fb5fef179735d78ab2eae13e46c98a35417139af2d94a91bba0c40fefd84bf78029453466109684e71463fbe3fdbc64e8eb1a865224eb95925f
SSDEEP 384:nYiFcPQkUSvmj3sNir8TUNTUlI46aKMxMkw2f0BCpcM9omVvaTZcroMgL/7Iz9Ib:jFcRI3TrwgCU9BCCmVvaTZcroOLU
TLSH
T155E2A2F198D79977D9AE4B97A33D2E0299FCC143B5884A94B7C91C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

0acc0b85-d897-43f5-9f4e-3dc10e89c811.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0acc0b85-d897-43f5-9f4e-3dc10e89c811.tmp
Size 12KB
SHA256 7133a4e416eaace125cdff8deab866890dcdc91f571a0a1310844797765b395d
MD5 1fb01d2602a6615a5a3edc427701908e
SHA1 5b599c60144f9cfd72313fb4c3a53530895d6c0c
SHA512 23dd4dd2f98924a3f9525040d57dc3449d1d1cb8968bf26e029c12c545990c00a5c65c77c6caa20ed784d69448037d5075006a4d4e71f95b7259fe33185af2d6
SSDEEP 192:sxZeRukX/fasmaQZL58dzodpU1HW6+WNyms/YoDI2SYCIg5NtpJ:sxZezX/fas/O62EHbU/5SNftT
TLSH
T1AF42E815AD38A93B8CC7D209FB59BF53E2F9103291911E44AAFC8E2C14E76DE220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51d68b3d-f6d9-4f12-bf5e-c6c080642c23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51d68b3d-f6d9-4f12-bf5e-c6c080642c23.tmp
Size 12KB
SHA256 ca2854e100338828818941aeb0bf94013363604c7acc7f23254a88dd36c46a52
MD5 aeed008c0d4e0867e1c161a96f1b64c0
SHA1 e87a102eb65dec410668533fac85e16eb3cb427d
SHA512 71056c41402c7746954862d68bb0be3011d4e65b7e2a4bf37417540e1458baba57f17ee03be3337c05039450c23f366fa7af26517522f7b437410542eb151fc0
SSDEEP 192:sxZ9RukX/faskQZLx8dzodpUNHW6+WNyqYXYouI2SYCIg5NtpJ:sxZ9zX/faskOC28HboXuSNftT
TLSH
T1A542E8556D38A93B8CC7D219FB59BF53E2F9103290911E84AAFC8E2C14E76DE220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8250d083-b0b7-4fd6-93c2-4427c682751b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8250d083-b0b7-4fd6-93c2-4427c682751b.tmp
Size 12KB
SHA256 73c8fb244eb51db0299d8a5b84c10c985826036ee6ed6dcfd68f85d77bea07c1
MD5 3207ff41a4964290fd006111177f3b9a
SHA1 370a73a4fac13c83e28a14d684d6783767bcd579
SHA512 e8b2a39ced55f50846d70a6ad83d9caa974fdcdc6cd0dc0a394cb187e6ba57f33fe459b161ebb431906bb5ec61c8470d6a5a91dbbddcef16abe78df2fbd423c5
SSDEEP 192:sxZ9Ru9X/faskQZLZ8dzodpUDHW6+WNyk7ZYowIqSYCIg5NtpJ:sxZ9WX/faskO62mHbdZoSNftT
TLSH
T1D242D8556D38A93B9CC7D219FB59BF53E2F9103290811E84AAFC8E2C14E76DE620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 17KB
SHA256 f76caeee3fbddb7eb25895bd365e973f0ab51636a908f2b3001c03edb4df6178
MD5 3c1d3bb0b4f24110036853ef866bac1e
SHA1 a84804b408a34dab7d6897647a5371c2df2f4d6d
SHA512 1db214617df23d3330a5deb5ddd0e5c8e0f585598625ad8da8a08edb72fe50e54417597dae8253f2d1943a22d4db27cbc216a395bb18c1a65d7d17e0f2c75e8d
SSDEEP 384:+wnEKnJdDA7kJHZpmsnO+jtC7Kl6kOUZEFo6EXdF9ThXtIlr:jEQdDB5XO4g7UZEFotDtIlr
TLSH
T13A82D18CDD425B254C002867A3B1E9F624EEBABA0D3E78E79E407161F8AA1CE84553C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 69KB
SHA256 3bb94968821ec9ea0c51998a7f16510326192c18aa871189552a4c855c192e41
MD5 1b36052bff94818cdc9fe39e91395c0f
SHA1 5c53e971fe8539bbfb88cf402329314811798d93
SHA512 5c0b90965e0f111b1c0ca6e8747100927d3bf74ce3315c1f08a5fa13ced2380558bd3d74631c6380a99019e42098b421a50b478443bc70027695a471556a081d
SSDEEP 1536:ZLDTbx9LzkR/VKZWuueoM4h77k6uWEul4kyoXPPVBqv6m+58/ZriH:l/hZWu5oM4h7o6VnyIPNBQOmh2H
TLSH
T18063F1D1434A5CD40E3C1A1283F5B5DBB96225E04BA26EC361264C87CF4EDA9CE6B4F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 38KB
SHA256 fbc121fde8de76cf68b02bdf292cc337c558779ca06e694dd714879f63e7995b
MD5 4ba30342ac494b40cacdbbedfd1ddcfb
SHA1 9d88b992ee878eaa87bae5a77a38c8db7d4c0cab
SHA512 ffe916de836f5466c05fbd58a7fa1380c988c21b7b7281ad6f2bddbb571ca8e7d170e38e9d206af3a0f81c349e9e8fbfb8a58a4d3017d30847d725d9be34f18f
SSDEEP 768:58ezXpTpF+1kcWM/7VBPHsLMJfBDbu/OFejOZTohBRKtrPLXT6fWAEiR79cLZ:B9TpF9cWChBkLG0NmUBajoBE2S
TLSH
T16F03F25B52192DFE2CD430437EF6F0974BA643FB9C3474616BFCB48089A6284957A226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 31KB
SHA256 3225db5c489c32929af0acc10af4ce3c099862c34b48989ebca9466c2765be81
MD5 8b8cf7e3604eb5ca70b6a49b1aa50bc8
SHA1 6a022bb07da612779852d3c332ee31578719c95a
SHA512 08adf7840d3ae9119145ca0a73beaa4833f4d0c1d30a10cb461f154bd453383b5e8eac4aca0de33e4295769a05318d10d5a1bdd7dd3cb425b0a747d4f0b20633
SSDEEP 768:qeGqelYONp9zI0Cdp6Cj+BV3OVJeaRFOtrPdDdHWPmKJW:qe8YOH9+jnRFOtrPb2PhW
TLSH
T165E2F1141242F323EEBF451B24257C299FBDA61F115DF7E5B2272657DA088474F0C8EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 104KB
SHA256 39db82949ab7f2a5e0d5289260029b29eb31ba7fb871a99931798870fe73de75
MD5 2f59500f7d4cbe2332b146ef6cac2ce2
SHA1 c469dc1db704962dbec1377cf6667e84ff0029f6
SHA512 5eeebe22680f7c27c544a8dfc108f13a96f7448a38ada1c8e5f7833582514f34db8c5a7d5ddeb626d1cad9bdc1bc70b8abdcb4e58d9c1fbe91172054cedb29f2
SSDEEP 1536:nW76QKvPN15jv6VmvrVroMZJ1Tq+VrlPzvLxsa2bHGAn3ZwEAUKbO+D8Zk0ihs7A:nW7yvVL6MvrVsIJg+Vhraa6P3/dZk1kA
TLSH
T103B31294F1359CE656306A9929D0AF543A06FF2EE8ECC37BD1ECD03A2D91FE2D541182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 490KB
SHA256 d8d42d76a3b92fe0a123a0dea0f149be77cf10cf8c4b7854d87dc9502bd65554
MD5 5f05bc6223b75052b594b38016762a77
SHA1 9402fb580707b2a188e3709e3d3016cf46afb141
SHA512 cccaab7d0a3af45079b19cc17911026b598208f34e3169e4e55efc8aee179e91e188488efa21c5d4deab40b8a2ceab37da4013f7076237cc1174300771b9c623
SSDEEP 12288:NHERXJQVlxmdRFRBRxkZs3HJu8eWQ896qqW5:Fdfxmj3fx3JuIQ8ws5
TLSH
T118B4129DBF4B8C03E60976DC6E955FE623A74E2404148F3CAE114749209EF79C43AB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000171

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000171
Size 27KB
SHA256 d68d919c7a0753ecfae9708ae8218da2d764feeaee7ddc4e92d5d3ff80b90908
MD5 2f08d18d795d7d59bb112dbc049012e5
SHA1 4384772b30361bfc540b01d59fb8322423f7dcc3
SHA512 1792e9786d873525660bcc9ee3c25d205743e3a3ed6a2bc6e153fce59c7ea85c9cfe71c7baa5df42e1282df6608b1e1e4e4b3d31b51e1ec053fc61eaf8675961
SSDEEP 768:UOCpHZKMPBSNqevKcZvKNAQoF1leYQ3cvo2+BmdWGu:F0eDTUqQoNvAPGu
TLSH
T183D2E1C1BE32D863D359A4D8801358B13A657BCB251B852C719E6F395F4E8D2F82544C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000217

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000217
Size 86KB
SHA256 b4b081acc27155b2bc500f88f546954f1133bc7ab0715c5809a1fa52f6ceac7f
MD5 f7603625d84204e6fba856c946f87d4c
SHA1 d0f743f0bd6d898003be308d1c466854252c469f
SHA512 af0e4ce95d91a4eb0b1183cdea4a0a8b155312a26ec3c03fb3a055f68331baa45ca8c4a0a862e2299e672264b683d40a82363a8457b3991cffb41b960be56168
SSDEEP 1536:R9B4XxDKyIySJChi+qPjYHaLs6OZrrSW3eZ6LwNri5D5Tn3MsZcoM1tj:Rjv8yo6LtORMNZN1N
TLSH
T194830876439A2AC59E7CFA00BBF6E53C0305743600778CCB0A6B3DAC791995F5198E9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000269

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000269
Size 47KB
SHA256 ccbdf3d80a07dd51f54dcf43ce2c84ab83608c31ebca9a83c1bae0ee679b658d
MD5 0b1607d55798c58b22e46e1b91c025f3
SHA1 4ff56b32775d73d961a5b10d9b9ad21bbccb4d97
SHA512 f7e2aec8167fbe11ec9f786466fd1dbb137ce99d0c25a2840f54ab94976b3fbc6acac773a1ce514398bb2cde658adb0136e4b5824a28d7582ec0b7291a7dd52a
SSDEEP 768:NLUu8kCoeKVyRrkUrG0WDvqevGPgEZCwm871sdl7qmuNE+29hc4jv2wx/gbqwIsh:hn8kCb8G4I3WpgTIXCIl7T5+xM+6guwZ
TLSH
T1E5230178D0A3EDDA38B0B030434F152D590A8F84E6D79613FC3D49E17E581A76AC57BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 70c3721e2a9f4e3dee131be9859b962ebcd5d1077d98f2b161dea54efc407a63
MD5 8e68e44a622f9eaa18711de07c3e2828
SHA1 09e7b4313ea80c6f4879b2a6a17670c64b84ed3a
SHA512 d37dee905efe90456863a80e4797e41a7d6fc546857005bab9ddf4ebe6ae52d91d95343ff910e967062b2ded264cc292c447cdc8311cf9720591edcd6387b014
SSDEEP 96:ofqcw8au6gT4Dq1h3kJE23et55vp9B4FKvBzjTKL980FthNzJW3f6qYrGtH0xwHg:Uqc+bgAI3j245RKKdjc91vNNW3iqI
TLSH
T11CF197C5F9C27982FF8C60715A980D72F670996C01621FDB9684CE74E9AFFDAE845C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 d3be4ae6c0d89f897c2836762ce3c77972d449e574f908660a349f7e701b8ab5
MD5 67e89ca195c3247f0353524c42d0ebaf
SHA1 95dcef80e94f86dfcd3862cc3787623c56cd8248
SHA512 6d76296b7ec0dc79df7a23db74a89e3fba0eaab6720a2c7b926b0ae08f997b4e014b39012aa70b2f31508fa76d79537f3c56bdf41d5fefdac3889f39f4adea57
SSDEEP 96:ICfqcw8au6UgVoq9RkkJW22et5eUpa0h4FpGzqzjTKLh0D80FGhNrJW3f6qYrGt4:Nqc+bULEkF2ve+EpGWjchK1wNlW3iqfm
TLSH
T17302D6C5F9C27982FF8C607156A50D32F670992C01221FDB6A80CE78E97FFEAA641D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b04745d485a197b4e849f00835b52d3e8238930adb0597d49e83755ad11b87a
MD5 c0b0e7e6673a7b3fb171ed1a732cb425
SHA1 1be117ef51ffff5dc19d4377a2239710df9872a0
SHA512 9fec5ab26d1bf1072fecdc488cfcf3a36224a045f5d27f7792c703938298ac784773727c83e60b56e1770f3def2ca2d7fcd3bef38064c4972904776515fd75ce
TLSH
T1E06180820983BEE0F3994576AFE50A873BB05EAC95B75F1E3794CCB8780EF162141C60
MD5 SHA1 SHA512 TLSH

Submit Download

91d839e0-51b3-401f-bda3-8865e2f1e698.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\91d839e0-51b3-401f-bda3-8865e2f1e698.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000003.log
Size 103KB
SHA256 5a3476ce20c69fb9251e74d4817288ccf641b630a8035490647a584eeac25d85
MD5 85deed8f0f11af27533ba712d6eb7972
SHA1 5a0c1f412fff7c33032c8ed25131ae974597ad3e
SHA512 37936abd40b95a353249856f2cfae3cdc70569866b9eff42859504d0c4776570525f010c5451531158b3e45d841d261b80cacc4eb207e24f581622368c21b1b1
SSDEEP 3072:Xf/lLcsQCuCSw9ad9d/b22aBtrsHiWHLKPXl0iqjN9sGFepZxa7v/+mKFhICuWiM:UBiB
TLSH
T12CA3AE0AB3B0C469C07102F6DE449BDDAB3A2D5DFDC2976E71D07AE6D9364931E21322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 7a75ebaef4a5bb8ddd72a1f2d1d74fd6102323a16736eb54cf3181f139cbd322
MD5 0c494dbe59c849cfdbea80d6a0e16324
SHA1 3232c4285643b8f38f4028aede203caf1ec98922
SHA512 befdba0a40e4b87b5bfc9f7dac05f174bd5156b76436ad204cce13e3d700c0909409e96ffc5e687ec35abb122ee65412324b9ff2196221b8b57410c5de6826ac
TLSH
T173E068BC82D9C11F72145093A23CBB0DE793252EE78DFD854F40E9147046048B06E2D2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

070bad6a-fdc1-4dab-aaf1-77b4c7101ece.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\070bad6a-fdc1-4dab-aaf1-77b4c7101ece.tmp
Size 6KB
SHA256 b6cce681bdc169332b963520cfd84f26ed255e3d496f2b07f0e203c0ad70ea08
MD5 37834e3299cd45cb9c75d2d4a7ae1f55
SHA1 18f8333df4966fa5d2401cb4ba78c2bbb740c414
SHA512 a772f0234bbfa0c4759eb42319736396e026cdc12f7fe84ecdba8d7ec31ea0f1572c0e795ce38c6c09683ead8811e9bdca4ffbd94952330e89d231c5662c8cd5
SSDEEP 192:D18U+mUaaif10GAnXcj8QQTQVJteUN+kT6HjuMhJHxfdxjHBf09/zK:D18dLaaif10GAnXcj8QmQVJteUN+kT6Z
TLSH
T1E6E16BF753B1C96DAB1696F09A09AD1BCF980530071C78B6C5E0BE2393B35B1E101B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1179a6a4-4e5f-4705-8343-cf1591ab13d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1179a6a4-4e5f-4705-8343-cf1591ab13d6.tmp
Size 1KB
SHA256 b405a00241ae518430fa513e804c57d05dadb7b212b2ee4c940965ae9904bf63
MD5 9b6c138697218436cf69d15f44c5cc02
SHA1 72b5cf1d727cf46fcf91344d98aa087b2d89b61b
SHA512 83ce9e4c31bf88be40bd2fb4fc1e9e8cf2b5e62f0902a036fda06e0512e0f54f1d346dcee2f150d58141fdd573d715aa5e60d16061d82a6d6583bc5ff33b2cfb
TLSH
T182318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

6e421457-02ea-4d4f-bb7f-f936ba0040f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e421457-02ea-4d4f-bb7f-f936ba0040f6.tmp
Size 1KB
SHA256 ce4043574da71be16df3e9760945fbc211a657edb8093bf889cd5aa97acc8db1
MD5 d8dc7167f8c7447e3a39d69b2cd15b73
SHA1 37f48f2d898c60af824cc9143c152af54f0a868a
SHA512 ebae0aeeddc837448afa32eb768f7ff4d7c26dc154cf337c51c7c76d2e4ceffb1b00e4b7f567ff17cab1b1a96ed4f8e47c9ffc0d2b7fb3ce3d94aa51fcbe68ba
TLSH
T1FC318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

ba03b79c-a96a-455a-934f-0b46fdcc4adc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ba03b79c-a96a-455a-934f-0b46fdcc4adc.tmp
Size 7KB
SHA256 5d09929da9488e219b334b10bb990422e313c94b7b247cd24f1c27b78c8bedb5
MD5 828d9629c35e2ce1671725f8c954d0c2
SHA1 64a5347725c48062ebcd3335f7a319063befb9db
SHA512 70bfccc84a72a4f268bedcc5d345660122944f86dbe1310f21baad0d752236f589b458606cf34dc08f76de0c67c952e3118179d11411e110de9ee5aa05923b75
SSDEEP 192:D18U+mUaaif1qAnXcjQQTQVJteUN+6dxjBf09HjuMOHxTuyMLU3GzkfH8Hhy:D18dLaaif1qAnXcjQmQVJteUN+6dxjBJ
TLSH
T1F4F15AF753B1C96DAB1696F09A09AD1BCF980530075C78B6C5E07E2393B36A1F101B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d953a1ea-c129-4c9d-beb9-cd91febeb7e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d953a1ea-c129-4c9d-beb9-cd91febeb7e2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e75da698-4364-4d0b-bb20-d3f0a3cec66e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e75da698-4364-4d0b-bb20-d3f0a3cec66e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 5cc70b225e398b3b672d27e1e85c1d72d29f030aacfd7f62da7b5e2bfdcf723e
MD5 d3e4079c112efba2e779045c08d1531e
SHA1 33e2bf49fb918bb64ba2f8800e5709f16a83cd9f
SHA512 05dd62ae2357971a90a96ae5fb9b0edbdf9f0ff14cb50ea49eacc4014881cf4314f322339bfddbf340bb5aacc1a5333d46a7f4dd1c23f2ea3808bb156055a43a
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgD:ST/2dXOJhJlpfnpp3tNXVrN3+rv6
TLSH
T136B2435571BB421039FE390892B5872E024272B37159E66B7FBD40B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a81d95c2-232a-4926-808a-73844700ff66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a81d95c2-232a-4926-808a-73844700ff66.tmp
Size 12KB
SHA256 606d8e7ee2ccf677a75c317503a9a5f8a8f76936db1eecd3cbec4d0305b99e2b
MD5 51185c6ee0125769d0ec9300e27ec536
SHA1 2734d5007fa97eabb6da32518f99e1757df66e4e
SHA512 5c7f16cef5efe743ca7656063e451eb0f046bc2f540b1347d5516f168e553895098a9a4dd9b887db779daea5250ec67bd41b2755a1df78f71dc9acd7d3539457
SSDEEP 192:sxZtRu9X/fasaQZLZ8dzodpFDHW6+WNyPcdYo4IqSYCIg5NtpJ:sxZtWX/fasaO62hHb/dUSNftT
TLSH
T14D42D7556D38A93B8CC7D219FA59BF53E2F9103390911E84AAFC8E2C15E76DE220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c103cbc2-89cf-4971-b275-37a7fcf12ab6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c103cbc2-89cf-4971-b275-37a7fcf12ab6.tmp
Size 27KB
SHA256 1ded177db8190967b4530d2813844b4a77ae5a7f4672d10a44aac4a84451070c
MD5 06126dd016231a749beddf3a2af79a70
SHA1 9a31b5100b07868a1c050eb5963166237c1f8a1e
SHA512 b71b2f550179d397c51f43eeeb86a4e2a5e3b664c167c6313df03096135a0b98344a160681f261642bc95ef1bdd63fdcf8a259ecfde3ed6fdfc8741441fde172
SSDEEP 768:Px6r8j+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYrooWYbgno2:Px6r8j+Wviy8Ku1jaqpLd4jjoWgg/
TLSH
T1ADC2E93B740CCB7E5FC41A9DDC5A6F972DA802C796588D408BFA944C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d091d378-8ed5-4cf1-9208-ef8cb79d57b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d091d378-8ed5-4cf1-9208-ef8cb79d57b7.tmp
Size 414B
SHA256 6f81d9883b3030911a6b668bc1bf745b7a845f42e79e1239a4240f7588af391b
MD5 eabde5fe3cc84bde5bdb7c0a82153d78
SHA1 dcd622115e3b1e536af86e8f646911947b51eb35
SHA512 409bef53dce137aa007dbade8bb8490eab61e24e4ebcb204c497322ae2aa3566e723f285c307cce3a6d4a6767ffc328baf075f390ba42848a924ecd5cd265e64
TLSH
T13BE0E5AAC821EC2B08FD1B7C54540645EB00232B2A819D4B3B3D84088FB05374585C6C
MD5 SHA1 SHA512 TLSH

Submit Download

d165abe1-7fdf-4553-b82c-842ac122c40c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d165abe1-7fdf-4553-b82c-842ac122c40c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d55eb3b9-9f62-42ab-96a6-00e0202150f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d55eb3b9-9f62-42ab-96a6-00e0202150f3.tmp
Size 12KB
SHA256 535a4d0d837f1d18494f4d84ce908e47c01a25250211c97845cea412a0097c75
MD5 e929676f2d5b186f1ec48b976445d022
SHA1 5f704c61e4367e48422a4c56050fd82683b1644c
SHA512 4d65d6deec7e275e386db0b02f7dda23e84b86614ee1656ead16c8ab7e48a705e45c9838aacd23421d7c9ab4d735b0328c961ea88b4334b8280f0b9cbeab4950
SSDEEP 192:sxZeR3kX/fasmaQZLW8dzodpU1HW6+WNyms/YoDI2SYCIgjtpJ:sxZeKX/fas/Op2EHbU/5SNjtT
TLSH
T1E142D715AD38A93B8CC7D209FA59BF53E2F9103291911E44AAFC8E1C15E7ADE620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 719a02eee88ac3118e087e8d89330e7ed137c59f2b8e3085fc9f76fc1fa350dd
MD5 e3008070468abb403f86bc747cd1b5e8
SHA1 367b2b0d24e4fc104eecfbe88bb55ae3c2753c9b
SHA512 10347326ef2545db6181e4339385d85b84d02fa809a8bd2c206fc6d67c16e1a7f7d34f92f449f7839ba70246ed6df3692a29474771ecb33bf4eb75a70828f100
MD5 SHA1 SHA512

Submit Download

afe0d179-f9d6-47ac-a7ff-e828e6beb30c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\afe0d179-f9d6-47ac-a7ff-e828e6beb30c.tmp
Size 25KB
SHA256 e97799dd5d23c0893ac50f03abe6dc82610e032f7313429273a6585e09740486
MD5 0819cdbe4b4e3efeaf7cf9519d956fe2
SHA1 6afaaa329a4093e3f66cd1f81730c5de4a6deb2f
SHA512 0af809369e2665a17a1c8233ca1e165028529c7b2fdb43c4a9ab6e255cefe2d2d21f9c4bfd154e33b3b3580b61187750f023cb012fa06ab231dbd7d66dee23ff
SSDEEP 384:npiFiZcI63sNw8TUNTUlIm2aKMiyN4w2f0BCpcM2Fuosa+VYGRgL/7Iz5JoS:AFQ63dwgcVZBC6FuohgPJ1
TLSH
T10BC24932EC98D9BBE8FB4FD9AB4A7607DEE01157949C89C4DAD81D1D00836AD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c630f1d8-562d-4eec-82aa-6d6af6fb6fd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c630f1d8-562d-4eec-82aa-6d6af6fb6fd3.tmp
Size 26KB
SHA256 c725651ff71fee5d31e3a2c9c963741e82ef85dc4a699923f2933efa5cedd837
MD5 79940406dc456dc1442acf3b58b56186
SHA1 582ae048b18a85f9370cff450ca4b6ca58a7eb83
SHA512 795598f2e9390f1a16160ba18baeb10cb8c73a662513003e3d1c98b04be6320ff67e37d6df5a81d1f5b0a7ff8f7ae46830cdecb9caa3a331c27b4d8513d61e90
SSDEEP 384:nqiFzQkUSvp3sNZ8TUNTUlI4maKM0Dkw2f0BCpcM9fiVvaTZcroMgL/7Iz9IIlO:hFdp3kwgeS9BCliVvaTZcroOLU
TLSH
T1D8C23B32E899DEABEDE74BD5A70A3643DEE04253C98C5AD4E9C95C1C00DB1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4d941db-19fd-408e-90c7-3c8918324137.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4d941db-19fd-408e-90c7-3c8918324137.tmp
Size 392B
SHA256 3814cdb29dbeec0f5269029fa505b788fcf46a81c2ea8d61993ceca5e01e9abf
MD5 9cadcdf9fdcd1b30a87a34179bbc75ef
SHA1 a3f81bef5f7659a54645314b6bb06fbe993b0e89
SHA512 1f2ba55f3437d33ac808b6a909e8098dfca8ce12ea083905ab918d5509cabc231de2a32f01bfe812036ee05d816aa2de55a8a98e036a3fec2ddf035905609823
TLSH
T122E001429B00019AC024073010832F302BE1C120127202074A21066C2C223406E10784
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f123e99d71c0e12ceade5e0ae3db2c16d9bbcf4034d73ff6915e333e5ebe8fb7
MD5 f800ef3bc2928935ccea651c6a7e6926
SHA1 da40072f60264b577887975031ce765acb2290b6
SHA512 86eeb2aa6c95bc3125e934a8c446054083cfa8d33831fcc2c0dc1d055a4fafda4d32666306a940b27edf14e2779669fdead71eae3e498ae02f84ef2e7a301c5e
TLSH
T192415D58A6F91008B3B7BF5A9BF6A86D547EBD772F06D45D10010E4E0626B44C872733
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

14245281-3cfb-45ff-8e3c-ba4a1a3d04d1.tmp

Path C:\Users\Admin\Downloads\14245281-3cfb-45ff-8e3c-ba4a1a3d04d1.tmp
Size 63KB
SHA256 a9b43dcf10aa50ecf9ba6730b6f51ea44ac4acd0310248c3a247203a34990d0a
MD5 99f6fb0899e0352f94ea95f7776c7f07
SHA1 2d82454482b95ac7ea39ed96514bd6c3396c29a6
SHA512 78f2ce0d9edcb7c26bab6066ac6004e436b80ef0200d247e260b1bd39c0e33060c94cd0a9a3ce31833ba69131e985acbfc71b066f74df7555590a39cb232c29a
SSDEEP 768:eajq8kieWs9YiHiCNIC5rZ8SOYpum8/TbNS3ToHzLeJX+X6d+mCcJrsdoK4H:eaeBWSZCqOU4/lSdJuXcrUQ
TLSH
T1F7531A25E8B0647CD11BE2B15B92F4B4E3B9F86E8310B0DF024893622775DE267BE594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2645bc9e-b285-434e-84ef-ca97c41f5703.tmp

Path C:\Users\Admin\Downloads\2645bc9e-b285-434e-84ef-ca97c41f5703.tmp
Size 168KB
SHA256 5b31f6f7d4b5e8e2a25948a31ed86791e74e8f332a28141427c54299ef4861e0
MD5 9ecb6c1dccaec304deb963178d6ea54c
SHA1 5b8969fc81123fbe064934eb0d912b7bc2d82992
SHA512 9f503a48d01c70fc5b2ba46d74046743213957a5279a2c2e51802c52bec065a34292be70009f9ba17794ac230cf01a8fbbe48b583d3e5804ea40988113cbc833
SSDEEP 3072:wWSZE/w2Xcrthm2M+iPG3qYWVv4fHyPO4Av1SM:wWSZapcrtDqYI4v2Ax
TLSH
T140F3496DF0A1203CD05BD1B2C797A9B5D275B45E83A4B0EB0299C2B52733ED11B7E9E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller-PMV3TV8JM6.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-PMV3TV8JM6.exe
Size 13.2MB
SHA256 19c68344c5e95d70bb59475a696838b50d94216ccdbb6c27c6c29e4d729c0171
MD5 b2d39424d98b15791a22ae607d85dd3f
SHA1 5ff42a9afac12adbb60346c7f1bb923015683c48
SHA512 7155696c4e4fae5a77ddfc55a50867625c4c94672a3825b4437bf7537cdecc9eff25cd106fe712da4c170f9eae7776cb3f87582ed1d548481d4944727a02f013
SSDEEP 196608:oGNlRA0k5a4nF9Ljyl6OqZr5LT8EI3i5pAPtGEgT:oY8tFol6O+r5LT8EfYngT
TLSH
T118D69D6AB2B800E8D4BBD178C6465617EBB1B41603709BDF1AA046F61F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3524-706-0x000001343D720000-0x000001343E720000-memory.dmp

Download