4e454aca377c0524077b22141308c551dca6610de68d0ae7b24751ce4836520f

Analysis

user interaction
yes
max time kernel
74s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ghost-Client.exe
Size 661KB
Sample261030-paembsds2p
SHA256 4e454aca377c0524077b22141308c551dca6610de68d0ae7b24751ce4836520f
MD5 3ed1c7cff1bcc95c6a9159690422b82d
SHA1 bce6b1ba7158c622a6f94cdfe7bb1019292b2e9b
SHA512 018dd9b44c229d52e1841b3482b9bc977ad7d21299a2dfd981dece0393f9447da3721422b590f3b1f3bf32d6ece7438cd4456feba67899ac3f63c3468fbd6e1d
SSDEEP 12288:4eydXuRzHKECDADRDfeVPtkyUA5YiQns2N/S8u4:4e2X4HKdDoY0yqiQnTN/i4
TLSH
T1E3E48E42F2A580ECC02A91398956E61FEB363C54072056CB73D07B991FB76E16FB7712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
113	5672	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5672	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{8D23B4FB-1250-457E-B42A-BF1BE4690A84}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe
436	Ghost-Client.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
436	Ghost-Client.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
436	Ghost-Client.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2224	2944	msedge.exe	92
PID 2944 wrote to memory of 5672	2944	msedge.exe	93
PID 2944 wrote to memory of 5764	2944	msedge.exe	94
PID 2944 wrote to memory of 5764	2944	msedge.exe	94
PID 2944 wrote to memory of 5764	2944	msedge.exe	94
PID 2944 wrote to memory of 5876	2944	msedge.exe	95
PID 2944 wrote to memory of 5876	2944	msedge.exe	95
PID 2944 wrote to memory of 736	2944	msedge.exe	97
PID 2944 wrote to memory of 1468	2944	msedge.exe	98
PID 2944 wrote to memory of 736	2944	msedge.exe	97
PID 2944 wrote to memory of 736	2944	msedge.exe	97
PID 2944 wrote to memory of 1468	2944	msedge.exe	98
PID 2944 wrote to memory of 1468	2944	msedge.exe	98
PID 2944 wrote to memory of 1120	2944	msedge.exe	99
PID 2944 wrote to memory of 1272	2944	msedge.exe	100
PID 2944 wrote to memory of 1120	2944	msedge.exe	99
PID 2944 wrote to memory of 1120	2944	msedge.exe	99
PID 2944 wrote to memory of 1272	2944	msedge.exe	100
PID 2944 wrote to memory of 1272	2944	msedge.exe	100
PID 2944 wrote to memory of 5740	2944	msedge.exe	102
PID 2944 wrote to memory of 5740	2944	msedge.exe	102
PID 2944 wrote to memory of 5324	2944	msedge.exe	103
PID 2944 wrote to memory of 6052	2944	msedge.exe	104
PID 2944 wrote to memory of 5324	2944	msedge.exe	103
PID 2944 wrote to memory of 6052	2944	msedge.exe	104
PID 2944 wrote to memory of 2528	2944	msedge.exe	105
PID 2944 wrote to memory of 2528	2944	msedge.exe	105
PID 2944 wrote to memory of 2528	2944	msedge.exe	105
PID 2944 wrote to memory of 4452	2944	msedge.exe	107
PID 2944 wrote to memory of 6028	2944	msedge.exe	108
PID 2944 wrote to memory of 6028	2944	msedge.exe	108
PID 2944 wrote to memory of 4540	2944	msedge.exe	109
PID 2944 wrote to memory of 4540	2944	msedge.exe	109
PID 2944 wrote to memory of 4540	2944	msedge.exe	109
PID 2944 wrote to memory of 2072	2944	msedge.exe	110
PID 2944 wrote to memory of 2072	2944	msedge.exe	110
PID 2944 wrote to memory of 2072	2944	msedge.exe	110
PID 2944 wrote to memory of 2916	2944	msedge.exe	111
PID 2944 wrote to memory of 2916	2944	msedge.exe	111
PID 2944 wrote to memory of 2916	2944	msedge.exe	111
PID 2944 wrote to memory of 6092	2944	msedge.exe	114
PID 2944 wrote to memory of 4928	2944	msedge.exe	115
PID 2944 wrote to memory of 6092	2944	msedge.exe	114
PID 2944 wrote to memory of 6092	2944	msedge.exe	114
PID 2944 wrote to memory of 4928	2944	msedge.exe	115
PID 2944 wrote to memory of 4132	2944	msedge.exe	116
PID 2944 wrote to memory of 4896	2944	msedge.exe	117
PID 2944 wrote to memory of 4896	2944	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Ghost-Client.exe
"C:\Users\Admin\AppData\Local\Temp\Ghost-Client.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UninstallDisconnect.xml
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffdb490c188,0x7ffdb490c194,0x7ffdb490c1a0
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,833470899402967636,2550517525009829915,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,2846702907711389825,17461164943965517090,262144 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,15745764567838229605,774297539809399130,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:13
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,873739253775140337,15099239107106318250,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,1402708972414800287,4794704900292800159,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,11882327408720928478,13288114894812579330,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,1535600158222776357,15651944983150364799,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8348273305832389833,14517247351847451875,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,3537316834803094925,6672422018874649622,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,2296176192843906017,7786262595956289129,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5304,i,2998505058827113491,4694890147420698165,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3445136143049707489,5886573907270816930,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3445136143049707489,5886573907270816930,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,13340211787246913718,4999915410096587136,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6508,i,6057193644648241381,6967684157289782006,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6820,i,16225279202055937190,6131553018712751598,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6956,i,11607324947120318060,902266194963073684,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7584,i,16244878927241040692,3049460971583870480,2097152 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,11582054125118980926,7175407666269312394,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,18106068805646435878,16548047324039047533,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8036,i,11836742925436315734,3027178570197896271,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,16261861270836275968,14130927385034836226,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:6416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8460,i,9773805413435078090,6278178525015562156,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:14
  2⤵
  PID:6844
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-GHRPK7BVBY.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-GHRPK7BVBY.exe"
  2⤵
  PID:6976
- - C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -personalizedToken GHRPK7BVBY --deeplink https://www.roblox.com/ --webBtid 1793362104462001 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6976
    3⤵
    PID:6436
- - C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -personalizedToken GHRPK7BVBY --deeplink https://www.roblox.com/ --webBtid 1793362104462001 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6976
    3⤵
    PID:6740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,11382819532655755331,7662847164050180923,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
  2⤵
  PID:7028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,17891051594013343104,17309487959423089517,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:14
  2⤵
  PID:7036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,2439896652910838216,2381667513571439405,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:14
  2⤵
  PID:7044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,6197478565156490511,13013309238193515882,524288 --field-trial-handle=2620,i,4450942189206370175,15537619668588029653,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:14
  2⤵
  PID:6936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4804

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
PID:6292

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
PID:6336

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
PID:4312

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
PID:6388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 13.1MB
SHA256 f52514b1b91376ff9ac66f49d16f7cbda4096d44fcfe3dbb662a2b8547dac9b8
MD5 18f405651d9446df3579f785ee96034b
SHA1 2dfa42893bef7f8277339dd44a412780db67aa36
SHA512 9d17596e911fcbe3e2870b6477c00c4ef63b9ed5a1b2e682b4c411cdf155283a6cdb150a4729264274cc1778898ee40a7f0428177e0af5e7aa173037e8f25a6b
SSDEEP 196608:jVhIFplZ45+y23Ftw2xYxKDi3zA3/4rsm5p/FMrp/2IK:jVs1F/YxKDozA3/4VdMrp/dK
TLSH
T160D69D6AB2B800E8D4BBD178C6565613EBB1B45603709BDF1AA046F61F67BE05F3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.dll
Size 16.9MB
SHA256 b5e81e0cf070efa2ee8024bcd180156a5bdaddc56d0d1f4a9bc620b8753761de
MD5 980b49493bad518eef7e0c1ef65b031e
SHA1 ee5d01897c67d557c4552b3731a1c74cbcd1350d
SHA512 453218cdafb5ad9d8c506ebb80e46fbfdb359daf750f1c21383fc037cd43c5dc87732eba294ca17c63f46bcb9d5dc9ff22a60d9dd894e1cf088c1979da3120aa
SSDEEP 196608:blIMWAqLfs3M0aicICjqSiy788hVQcRO8wYXGK:K5L03Hajriy7nhVi8uK
TLSH
T11107C04EF4D616E4C5635070D26F56E3EB21309C4A682FF79A9502203A6378E3A19F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fb69756-b07a-4be2-bacd-91e3cc094675.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3fb69756-b07a-4be2-bacd-91e3cc094675.tmp
Size 34KB
SHA256 61c9f9f0ac19ad1c20afcaeefc46025077de4f1226becc20bbfd18c7ba6f1185
MD5 eab83caf2a2174df7a97865e0f872a8b
SHA1 a69d551c111995b6ad07e4187dcb367daad84571
SHA512 13b00631c3cc1c879726143a2f61cf81a7f103821298ac695dcaa2d983d213046155728a2e368f1ad723f2a14b0ae1dcd70f8d64237c4b57df6d362ab35d8c05
SSDEEP 768:Q13RglKgtlwlE57Y0GZxJsXBdK8Z86Yu8Lc:Q138wM70/JsXf7+vVA
TLSH
T13BF2AE34E8A19D638DFBD3A1724A32C3FEA451B3C5C44F58DADAAB0C048729E174791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2ee9a01-8cc2-4098-b0c4-25a67c68c7f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c2ee9a01-8cc2-4098-b0c4-25a67c68c7f5.tmp
Size 105KB
SHA256 aa204e7f585c1f2b64ec2dfe226fcda3dd40e2d6c7acaecb8bc39c51bf5021a2
MD5 82ef5ef3fd97f3d79a47f09529d45307
SHA1 4d70248d33884063e95777b4e6e0d998931440a1
SHA512 a3e3e08187ec16facc64907edae849970f4fffaceb0ff69b6b9421c352de4ae4396f6c7d28c814160c616bf604747c73d4cf8a04f10f2fc8fa4a07c14210288d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

56670c44-605e-4592-be0a-6c5c4908a916.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56670c44-605e-4592-be0a-6c5c4908a916.tmp
Size 20KB
SHA256 26e4c5b18a0a8f220343a4ffa81c5b26c2aab39712d501cc686bf0215a158867
MD5 44e98edb22ae7a687c7e9e48434bb6eb
SHA1 7695ef4da605623dc4ace9c854f5fb24d59e9c1d
SHA512 ab163e2d95d0f0dbf564fe0fdecf033cab06013ad0dfcd4250592886d5d5e7d8c39f87515662f9df002854508ad48454ad109119c5191a30f81124e74147236f
SSDEEP 384:sxRnpmWM/fwseltyc/5NEktu8hyQLTnftyQLw:sLpmWM/f6lT/5dzyQLTlyQLw
TLSH
T19292C4569924D877CCCBC91DAE3A7F51E2F910239C961A8CABFCC92C04DE1FD2612427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86a34fe9-e691-4f55-a541-48454b4b1956.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86a34fe9-e691-4f55-a541-48454b4b1956.tmp
Size 27KB
SHA256 289a9e917ad1da40f0f7e9290e9b758b8592696787186d7f971f3b97f167235f
MD5 ad4b3af1f60e9f312d9b9b87693ff68b
SHA1 1c42df44490ae617373f6ef4ac88041d8ed53cc0
SHA512 52a6b78c774a3ccb5241c796462b6ecfbc47525d5a79e699576343050e6e91246f495b127dbf24c50fa4424c5b5ba462f9e08723c2f6e61d0bd3607c27d6b88c
SSDEEP 768:6Jaj2+7pLuLb/KWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDomBZrozrY:6Jaj2+Eb/KWgm0fbbu1jashBSQ
TLSH
T1D9C2BA7B740CCB7F4F900ADD99197E9B6D6802CB9698CD8047FE981C02C67EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e081ac3-b9eb-417f-bb69-9e65a2d5fc5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e081ac3-b9eb-417f-bb69-9e65a2d5fc5f.tmp
Size 20KB
SHA256 bb60147ea2c2fac59408d836a638118bfa35bf85240918135c431d1dd71fb80e
MD5 035548026a42017c7f3601c15c9fa0c3
SHA1 727455ccfb9bf148e0103319956142b15dcd8d2d
SHA512 7e84e4b7844393a0551b403709379c15fa3f95fb4fa00ef1d959cd581574f5561b2398ceb946e6d922e550ac1b46b92f733ff2810782710e2dfc255871f49726
SSDEEP 384:sxRn3mWM/fwselTy3/5NEQtW8hyQLTnftyQLw:sL3mWM/f6l2/5hbyQLTlyQLw
TLSH
T17A92C5569A24D877CCCBC51DAE3A7F51E6F910239C961A8C6BFCC92C04DE2FD2612427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

909efd26-fbc1-48b0-912f-58e232b96872.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\909efd26-fbc1-48b0-912f-58e232b96872.tmp
Size 19KB
SHA256 44456e7e8eccc84f922c416f68847857382aee6687c08b504155d512fc28146f
MD5 428f40adc051ed36092a39c9d28db657
SHA1 8ceb25572545c6f76395d1d4bc88fca742a23e90
SHA512 ae8b87d2599ce0405b2dbf4a5fec415ada9caf45e4b91df533b835a316f4479e3c81831433d8d4426a9147fad81cbc8b7378d8babac8ea4abfb4454e57bf94e0
SSDEEP 384:sxRApmzM/fwssftyX/5NE/L0yQLTnftyQLw:sUpmzM/fgf6/5coyQLTlyQLw
TLSH
T19E92D6569924D877CCCBCA1DAE3A7F51E3F910639C960A9CABFCC81804DE1FD1612427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 122KB
SHA256 f743d0f35ead8fe2411cd11092bcc1ab2b2f68dfda0c9e769bf5c0845146054b
MD5 17c0c969d49f6c5b232b846c92064a0c
SHA1 13ae49340b1b059b7575bbd50e62a6dc70417247
SHA512 e2559ab52a921a3f88e313fcb00c3a1ce324b9ac1989fe6ff3e567e271d6d729d38d92255bdf7896da53d18c23e92cfa50984d3623df2e7917719480483e51be
SSDEEP 3072:caB1vHwIbwL1JBvC5q6y8Q7abVaKQrfCNqpU6rATxwl:cYNQIkL1yyD7ZfCr6UTxA
TLSH
T14EC31229B1260381F38C0A60C5CCADB21C9E44AD3C0D6B5D76AEBF4A618F597B05DCDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 31KB
SHA256 a258dcaa34219a6253250fd12bd905eb92d8faf13288b909af829d53945a8e86
MD5 c229b974a1531c851b4bb7c133930dc0
SHA1 7fb9eed0376d3812c03174d5fe740dea3e1f5249
SHA512 ea267a9005fedbbf2ef9d4137f580451ea13449ef6bd84f5685194d2cc054d7c256758d3cf3ba868ba0ec77197509ca32931af4fbd82bbd38b2249c54ee22cf6
SSDEEP 768:yMpfRDTUuuCnzekb80O5Q1ul718L1fBzrPFCW4l0sXtDkk:yMpfR+Cnzek80O5T7I1fBn9Cbl04Ck
TLSH
T163E2F26A379BF03082C70CA379D7A5C2B11174B8DCFDD176581C599D24E86B3971AE0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 102KB
SHA256 68507cd63ba31b475df24e72126efa6f876ed08070edf9bc061370fa6d6236a1
MD5 9508051a8da5e63b0edf77fed708dbe7
SHA1 10b32bfae836baa1864152846e198fdd31e55001
SHA512 b8401dcb41ef9b0f70d9d00342349dfbe6a2218c5cc88335abac5a62360d0f0d44fa2381d82042dd0718036312903e605429ca8b57012aa74a04b02ee724f5a6
SSDEEP 3072:AC7MlsaVxw3ki4EEx1cWGSiAvi1ItUkzYdJ+oTK:j4Wa8Uzhx1/PiAvi1ouW
TLSH
T1CAA312330FAE5186C5E66D5C5F47ACBAA0C23C35254A655E2818CE39BE56728EF41C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 247KB
SHA256 03f6b04cde0ca14c95f55f012f73a212af2e7224dc289f7cc2e5bb2b94495b90
MD5 9d73ed6a5c98e0ec99682d24a2ca33aa
SHA1 c4c56bf07ab99ee90062c218db72681a8bba727d
SHA512 d17de16df12d5a19b7178c7e843687561db1b469780cf3f4c341095ff88f8348e6bd15b435ad4da69b0aad7ee3f03d43bf43ecf9553d9860a41141c844d0a8d9
SSDEEP 6144:HSu5UlcCq2I5S3ePSZ/PDkpMM8WLOSghrW70wzsF5:H/mrI5SOPSZXDXMt4hbwzC
TLSH
T193442361CD77C2F55A29BD3718E2A3B33D53A67802D1AE49EE53E80402CD6D9D28522F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 20KB
SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
MD5 2af2be0651a488d15f87aadbee775f4b
SHA1 6da37d1d9fd929a8c79ce771dc565d2f554e9d9d
SHA512 d532f7200f9655de22309bff4d2676a1c72c7d04ef5e50e66c4c9de71f4ff835bb8ff82066014fcdb21d88ce04a43f96e7e4260fd651f47736cb7e365ad25651
SSDEEP 384:R+ouqO6S2dxUPYYchyHCYfJFLI4+i+Qzrao5atCv5+JQ9TU2M:RtuedxXDfIFLI4xlz2catCvMJQy2M
TLSH
T14A92D06ECFAED5241F5B1ADD5ECC2AD9066AE5DD6CBE53C7AB723270D9C0D408809230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 35KB
SHA256 9a86ccb14ee64df74cd06f1602a792b6dcfd41df5a609a515a6a55221550afd5
MD5 4fd213e26ec0e2e35fd9490cb83413e3
SHA1 226ed83cf5f5e1a00e3a80d7d0e5215b545c45af
SHA512 878354c22b8d0c80a3c33922533f9dfb751866b352118078ef3fbea63f17caf23a820833086372128eb4dbdaf12e36f965ac1c429002ab3c4db32f8aacf64cb0
SSDEEP 768:5w5Rl9azwLXGJUYCV2UtEbyFp9fowgGkHOYrwrkSEOI5nCAvta7:5w5gzyXUUtVz2ap99FG7nPQ7
TLSH
T1C3F2F156FAC89B12EDFEC29D1C51DA0281C0F9C0867A21887964352B66CEF152BDF963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 39KB
SHA256 9d61169f0a322b68027db34b1d1c0fb29bd23cd39f77d168d880697fe8c118d5
MD5 d9eaea5e7c3a66ae55c8b049d8f13074
SHA1 957580887c704dd326a5361c1bb46100b80a8c13
SHA512 30633d685e4640e6931fc6a48e04fda1cdcc9a88acf9fa30d5d75a493f290b5416e232051177ada2ab11531be6a3258deff6ac29209074da062e6f17e93e140d
SSDEEP 768:AZPHUaORKPAyFJ1OBk6wDcx4U79q4tAdjf6GezP9Ckw1ukv+5KImAHIP8:kWSBdRO4U79tAdWpmAHIP8
TLSH
T1470302B425ED1F59AB4053083BA69C6F536A2A3D70B03C33E2F91E35136FAFDA845042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 a229392e729a624615678103cc3b83cb94bd373b32ba7f54ad13fef96fd75391
MD5 de2772e6c2e6b60c77912a9092617946
SHA1 13e0b61d59ea151895b270cd09ac145c412ac409
SHA512 3654bd23577d4e35a39c150d865da2f9a4a0cd54512fb2b47b46a6f7b7b9abf342222ebf5abc355106f44da052d59c5670490872aa656852db390c3e5d430390
SSDEEP 96:E8jsTeho/mkBURleXjicOeAyQGepvLySUZ5b6fhqBlgOZUz6HwTQqdbGgKVRJnQ0:7uYV3zu4o2UqZW3QDjVWZ
TLSH
T17FE18314CDD258BAFFA445B1D8E13D8A777409433AA32F87B6ADC97878833D80BB0605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbc5d886-9654-4c9a-bda9-2fc8a6abe3d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cbc5d886-9654-4c9a-bda9-2fc8a6abe3d8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

082fd67d-6020-4e25-b8b8-762f3fbf8cb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\082fd67d-6020-4e25-b8b8-762f3fbf8cb0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

53db4743-f625-4bc6-b9b0-f15aa89e13e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\53db4743-f625-4bc6-b9b0-f15aa89e13e1.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6affe31a-3ce1-48af-bada-a9a213e28ba2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6affe31a-3ce1-48af-bada-a9a213e28ba2.tmp
Size 210B
SHA256 b7414f064dcae3b935202ee08ba8053d5a4d5ee84db204fdc9e13d021cfcae5e
MD5 248033d2a508af2e02005f1fc2e9ba72
SHA1 1facf7abdddc5676ad5901b31f4685bdd4bae9c8
SHA512 37de9b4c3aae155638796a4ea12e28c746ad6d0a7e3f662c9dbe7ed6086c7136b5b16a14b922e71925cd1b1aa7ee0715b967efcf8b1cb9eda7e20dfd2d109049
TLSH
T197D023732189727692583E77601BAC4ED76110144C16FAD45494DE4A1579C2D15071C5
MD5 SHA1 SHA512 TLSH

Submit Download

e35dcb06-a51c-40d1-923d-f06a9b7f479f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e35dcb06-a51c-40d1-923d-f06a9b7f479f.tmp
Size 7KB
SHA256 94a1ee0bc96a58ca55f3d5a9c3fc4c2fedbf6a1b66f997fffcf0256130d7b2a6
MD5 23a7919649bd1fa1cc50a8da4c9a3554
SHA1 f95cd5e1c4a0f75120cef45a03678226bfed71b9
SHA512 4d9eb5f8965328d996a658c1d26e61459bf38311302eb994ba32d0c413fdcbeda672147adf8181711b6ef67e81defb46947cec7a92df06f0c098fe56298439bc
SSDEEP 192:DkXXknrOHWVajhnT3Xz1TCkigGRWzhfucyHwQGyvZpG7xtk:DkXXknrO2Va5T3Xz1TCkigGRWzhfucyJ
TLSH
T1BFE1BEF383F5866DD91196F0AA186E1BCF1C0525436C396A88E4AF1BA3F2471E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\069cd3e1-6137-4791-a406-55e05ee55535\index-dir\temp-index
Size 768B
SHA256 192f94b1ebe1dcbecadfc49db0d6887b42d5d7f581f4becd0f17c8aeb8965d0f
MD5 513c444aa2c37c158eddc82ece866a85
SHA1 fc66b078c6ed2b40a459fb6d87880aab8fd45a9b
SHA512 f9a7dff7aacd0d7d4b2e28bd74bee0c314f9d84252468bcb597f6b187e3a7eaefbd3645ca1600457f6b5d1394443db3c4f96532f0006a32af070c73c9a06eb23
TLSH
T1AD01EBACAC408213DA2010F868BBA590AB3584EDCF09E247489EA5242D9B6C529082D8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\069cd3e1-6137-4791-a406-55e05ee55535\index-dir\temp-index
Size 792B
SHA256 db5c6609d4c4005616afdf59f1d7302112bc3ace36e80c554e88f83fb8cbcce7
MD5 2dfa0f81e739bf7360efc146a32ae913
SHA1 705ff476ae0638c04aa06b1d6e7b43e5e1438222
SHA512 69372c051c18522c48493b9103584f7c9ab40b9ee1dc673785f693baa91c21ede5f046a16a1907ecd000bbd5997d0e216e2a1a9519f89fb32f62524715cd79ff
TLSH
T17501E1ADEC408253DA2010F468B7A5846B3548ED9F099257489D74253D976C42A092D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\069cd3e1-6137-4791-a406-55e05ee55535\index-dir\the-real-index
Size 48B
SHA256 c8fd632785c653138b2bc927dc102ff7e83ba4c2d62711f4e7fa911ae2e2132f
MD5 45488e9bd64ee616df82535897f00a2c
SHA1 e6a7f33ce649562c859aec808c7dabb26ecab996
SHA512 94c909bd91e0e33ac90da8d7f644729202e1616c8fd25cabd074595671e833f21078e43c71df3e2eea1346e0ec2276472de1b1cb8c2a52b83c7581b0c70aa5d9
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\temp-index
Size 144B
SHA256 8589661b360182f33b80d99724fdf9aa8793dc560674d119bbc52319700972cf
MD5 ae6157311d10c461cd552901a0f70b40
SHA1 99ee90e089f5f8300029c54b360988d4a4e719a8
SHA512 b61e16fe7fa220adefdd51c4708aeff987c1b6be240a415d86a4b4eb4bab34488045c9cb96fcb34823c2521819f29eb63b2600e84d0457806509d8e660af06c6
TLSH
T11EC092A45CE1B265E8A999B224BA30702AA508CD44159B6A00ECE54DACA1AE8E115204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\the-real-index
Size 144B
SHA256 69989143e430228a5a4e9d5fb22f1aa6914db374e63715c1c1e287cb32cdf98d
MD5 47c099bfbcb26d218ec063a04e332414
SHA1 e988a6db99dbb133892eb6d59ac7b71e95338e91
SHA512 e38a78ca37d4a1f360dab66d75922e2b8ea0b0769c97f0b56b7ee0c7ef5b9b4db57cf4966ba8b9a3263a17870499bd992eda3b2105de4bb9641cab0f356fc2df
TLSH
T1E7C012649DB2B162F8A9D5F128E7307115444C0458126E2F11F9E7595CF09A4DB11301
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 483B
SHA256 d8e9db1f7f57974fc82db4685ca0f4a3945b39b977e108aa22ca5b3ce25b880e
MD5 f88cdc2da74784e85fa8996b3e167666
SHA1 6f63c8d56f65ae01b6a351d8bab5ac1eb79574a0
SHA512 02f6fb78079f5894227dd506c4bc8ca28bc510d72fa2954e574f0f3f2b58fde53a350c2ee5e195b9add0ea7aca73f39b0fe7d6abecf70b2f1a930e32056f8133
TLSH
T1BCF05CBB2FE32810F8AFD7F568B204B50145BC5CC651AD4F6429A6D380F1258265AC36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 483B
SHA256 5be3b7cd4befa52aa2f9638f29731d6f73981df2de077942a679bd537d645d13
MD5 590996944286dd20cb59abfe9b3e8353
SHA1 962c3791536c974a8130a7f76d243ef277ef5135
SHA512 e27beb464a9c449e96be1c46e3ea0bc86a609f09b1ea4fd18122bcaab0fd37ed5110d22150e8f934dde7222b51ace556011a54ff9a34e590c689deb04b89a31e
TLSH
T196F05CBB2FE32810F8AFD7F568B204B40159BC5CD6506D4F6469A6D380F2258275AC36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 487B
SHA256 c94eba01eba508621d5853185f51b934c32c627281adaf1cdab22c84d2f06033
MD5 3a0746502aaff341b5fe0072048d934a
SHA1 b8d419cf89b272f5d21956863d334ce94e9132b4
SHA512 6a5de480f1436fa6cb6c74197ac8ef635d052ae71a2b6de592b8320bdd97c36a3a3953cc21fcd605ae09ee73f6bde5e4de852d8f37351490ca8253f1fdebd0e3
TLSH
T144F05CBB2FE31810F89F93F568B204A80155BC5CCA406D4FA46AB5D390F1258275AC36
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 e6470eb5559264753b68c6bbf835f130bccbce8fc43d096555242b1731aecfc7
MD5 2592de85f9d0cdc568bc5e9c890249fc
SHA1 20d0598b551c268c57287cfc0948254100cf9157
SHA512 e5ec28a65f73abfec3c252095c664e69ce3ac95471ae27d71a97c115a8d8695899941e3ca782e5b4e2e51aa4a859e27553b6d2b98673c5767b6eb827952ad9e7
TLSH
T197A00254024AA209C614E676914572A23B904832011B231395E0E4E99C93150BB61151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 7292e55ca5b76b3dfc3e5bf67cd2638c32768be177435edeff98554080a30cba
MD5 8bbbfd1bfe8c7db8b17965ff52761a30
SHA1 3c76671685584a8c0720ddecdbd27dcd1102cbd7
SHA512 acc8053da39ff79ba36b7d503c4aec5e63278fd67be3381923daa04e2d79c3024c6321dc7ea65af4877950a82324d97ab3ad01930bc736e1c52076a8b2003012
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 8b805fbf6e513cc74ab8f66cdab66b4fdcdbc511fa902f4d90855297994ebad6
MD5 055baf78e06c46c544da810811b2d12f
SHA1 418e98adba5f25c2944cc961fa57e3ca6e33bc9c
SHA512 0928a786b6c6e190a7e89ded85a319613914cbcc2198e9ee1f47c9f952f7fe91e309e9699dd4a1061d3399a7fe8f798d8c100412ba052ba6ab7594dcb9973407
TLSH
T14B713061713B62003C3D751851E4A65F439235F37428A6AB7FFA02A18A6AE440EFD8DD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6284219af12c4a180efc3f7e8548ac452af4a473573c09af55b8ee0f2e95f884
MD5 0de33ee81a081561c8993326623a04a3
SHA1 c02a0f65c739a8a70d061faa2e90199649485c23
SHA512 ab51009097141cc0cf2633a5f835494a47f303c4cee80919cfa9f6ee772e1ad28cbf5f4acdd1ff59fb0102db8391d40fc606c29df813b1183953444d2049ed9a
SSDEEP 24:KR38jAnI/KjhO1aS6lZfyXLs7sIqIRKIhU1aSdqywTwwKI9Kwho12SteByXgzQfp:K8cI/KFOc9fy9lIRK+UsKdI9KmoI/yhp
TLSH
T167915D21712B62403C3D7A1851E4A66F479635F37428A5AB7FF943F24A6AE400EBD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb1f395c-9672-413c-ae4e-9809f07de5c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb1f395c-9672-413c-ae4e-9809f07de5c3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8881994-0fc8-4bf2-a976-1ab07fb66966.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8881994-0fc8-4bf2-a976-1ab07fb66966.tmp
Size 20KB
SHA256 c97f25dfb70f72a24bb137b96b4421f2c27d179deed56064a10d52fa7f7f1142
MD5 7d65d634c604f2fbf9a5a007112ca6cc
SHA1 b2262701a4a2a2f593cfdb75a3efdec266dfd76c
SHA512 6725193c06f5e17a9fb32dfbd19f48e61c6db36b41916067217a34f122f819aeb2f3a8ac88700ca8347cefc742b8f2b38e728ad5577b5f30254d6141782bae9d
SSDEEP 384:sxRnpmzM/fwsgltyc/5NE/XhyQLTnftyQLw:sLpmzM/fMlT/5cxyQLTlyQLw
TLSH
T11A92C5569924D877CCCBC91DAE397F52E3F910639C961A9CABECC82C04DE1FD2612427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6b03a7a-8960-4f6c-914f-0681af9a1c73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6b03a7a-8960-4f6c-914f-0681af9a1c73.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6c31dd70-57d4-475b-82d8-b13625ad03e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6c31dd70-57d4-475b-82d8-b13625ad03e3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb05e9cf-c578-4c0b-90fa-549baf578739.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb05e9cf-c578-4c0b-90fa-549baf578739.tmp
Size 37KB
SHA256 6ef7caacd1cf1a1dd0ae2f30662361a175467e347b246840edc32b91cb597621
MD5 88ad6d89d84689677cd1bb62d501289d
SHA1 60013770b8f5fc3714a8e7fb6403fc308496642f
SHA512 922d7394b19ceb409f9836675f080bb9f36cc4e4f05eb2928c840d2cb2961475af41efc0c68f79c5b96f581287b044e6d68e57a907a7d45010827b62f220cb6e
SSDEEP 768:KFq03mwg4gWBtlwpE57Y0GZxJsXBdK8Z86Yu8Lc:v03hwI70/JsXf7+vVA
TLSH
T1C2038C35D8A1DE67ADFB97A1B70A3687EEE011A3C5C88ED4DAC99E4C00831DE1347D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1bdddca-7112-4910-b4ec-a05524699091.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d1bdddca-7112-4910-b4ec-a05524699091.tmp
Size 34KB
SHA256 7c999de952e75e16cc817450c10bd363d931f796b5ad438348a8a9b1a2c98793
MD5 5a9219241ca208be21cc09ed16b9f6b7
SHA1 53b3a47467c377e73451c3e9a586e82756327627
SHA512 e5127bb59b493f0111fb5d054cddaeeac3130c615dfaa41419d8ec21b46e973176029456b0c27f1824314c07efd805880d2468cd1c99a130b0f68b1dd8c78e89
SSDEEP 768:Zp3vglKgtlwlE57Y0GZxJsXBdK8Z86Yu8Lc:Zp3OwM70/JsXf7+vVA
TLSH
T1CBF2AE34E8A19D6389FBD3A1724A32C3FEB451A3C5C44F58DADAAB0C058729E174791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3c349ef-4faf-4e16-b0f1-e7101434615e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3c349ef-4faf-4e16-b0f1-e7101434615e.tmp
Size 39KB
SHA256 48927e1aaeb757e79ee5150cd5a676727b70bf60a3ea7518d2b8533d2877855f
MD5 492aac12096c0c75f637c826bb5d9af6
SHA1 6c57443ef74155290fcf77a27d2112755e91acaf
SHA512 0e27bb423acea0b02e05fc9c416fa7041fef24fd7f882ba95812d1f6da07b400ce0968fb712be034b76334fb13f357743e2db1814c34d6c3c39b102662d2c638
SSDEEP 768://UxvxjgC+I3QglKgtlwlE57Y0GZxJsXBdK8Z8Nj:SZj3+I3/wM70/JsXf7+Nj
TLSH
T17203BF34E8A59D2398FBE395760A73D7EEF415F384C54E688AEA9B0D058329D034781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6171e21-c080-4b6a-9fc6-e79e9d643e10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6171e21-c080-4b6a-9fc6-e79e9d643e10.tmp
Size 39KB
SHA256 875c9a62d8c04e95da7faf0fe1c036841a2f9c5f65b388f3f3bd387be5aaa461
MD5 3a7a17ec868ddf96cbf42c4bc9621eab
SHA1 c4ea53252eee64444cd0404c1c1940329bfa5c45
SHA512 96fbc97dd82454fa38a1a3e90afc784d3d9febdebeeec4e4b8146c659925c9613329255a52c6775cdf9574240de22ff98f3ce0abbb24815c2d25e08a667a40d3
SSDEEP 768:L/UxvxjgC+I3MglKgtlwlE57Y0GZxJsXBdK8Z8Nj:+Zj3+I3TwM70/JsXf7+Nj
TLSH
T14F03C034E8A59D2398FBE395760A73D7EEF415F384C54E688EE99B0D058329D034781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb07f53f-9039-401c-8ce5-48547f34ef33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eb07f53f-9039-401c-8ce5-48547f34ef33.tmp
Size 37KB
SHA256 5807a4a8655f98403ab41640bcee20cf2e6891b9de8abe7940be83ef2ba623b8
MD5 fdc54a81797c0f512bb199fc5d91b27c
SHA1 a9b6a4daeda8243fc2f22cc93ea1fafd6251b5f0
SHA512 7c73541abcd4fe5078c9e6c2eb4b0469c059a5fcd90edfac5a239a5c8694a7878f5727d15a2b0f256e1c31c7c5e84311e74f07139d4354d6015b390a3903c7d9
SSDEEP 768:A/UxvxjgC+I3JfKgtlbE57Y0GZxJsXBdK8ltSHUPpMs:tZj3+I3zy70/JsXf7HSfs
TLSH
T1BF03B034EC909D635DFBA394360A7397EEF445B3C5C55EA88AED6B0D028B26D030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a20f93e1-b31d-4da0-ba37-ebb650ae8b42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a20f93e1-b31d-4da0-ba37-ebb650ae8b42.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

ced4e4b1-328a-4e88-971c-4e93fa3c94ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ced4e4b1-328a-4e88-971c-4e93fa3c94ca.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f3f01537-ff52-4e96-a21c-1439a1d6f612.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3f01537-ff52-4e96-a21c-1439a1d6f612.tmp
Size 38KB
SHA256 ada85d541cb579c8b3b5fcec9da2fc26d38e3cd6a52386a531bf5cc5057bfe7e
MD5 49f6e2f294d24fd9d219a3da372a5057
SHA1 85ba579946e0c5f09def94ec8e1be83d4b03e9e6
SHA512 579daa83460d30509def1e65e79899200e60177a97274c6a9243d9dde445973be55c76927898761616a990185fe98dd8b91bb1f1b6dfd4756a2467cebb8348ef
SSDEEP 768:r/UxvxjgC+I3LYcKgtlwVE57Y0GZxJsXBdK8E8SHUPpMs:eZj3+I3Rw870/JsXf7tSfs
TLSH
T15F03B034E8619D6359FBE390360A73D7EEF455F3C4C54EA88AEA9B0D05872AD030791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69224c7a-7975-48bf-8c99-812ea0a56ff4.tmp

Path C:\Users\Admin\AppData\Local\Temp\69224c7a-7975-48bf-8c99-812ea0a56ff4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

a0a8f0c7-56c2-41d0-8ef9-4a1bc94bc6ef.tmp

Path C:\Users\Admin\AppData\Local\Temp\a0a8f0c7-56c2-41d0-8ef9-4a1bc94bc6ef.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 d1c10a8f7e6656809c5ed4fca2f735132134b1ba2322decafdf17823322e9595
MD5 439b8a1949495f50f80c27195fd25948
SHA1 4bfeae7d814ab8d1090bbc943405f62be30bff8a
SHA512 9a95a44a206ba5aa6bcef9f3710d6d090756216db7b6df2ba6fb2f8283d1840d75c50385ef65aa7f5eec75aae84437b8363519e385680608f7da916a76d98bcc
TLSH
T1802100604E9E570BF2F382367EAD6391EB312C01770C1F1E40CA524D18B9600ADA9F7E
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Studio.lnk

Path C:\Users\Admin\Desktop\Roblox Studio.lnk
Size 1KB
SHA256 b648d563bdc69674e4669cd964df0f24766027afb91881922aad5c475d35088a
MD5 d41488024a4d56c8b6ed09b088443eb8
SHA1 f243460d9377500b51f189f8955e8398bcf41823
SHA512 1cd4c961acfd82021ef55602b6a5edc72f5ea8e87c86ff07d3264fa851b21803cb98dfb9ea1a478b09b22c1ee7d961abe28dcf31f5584c9cb231afe83eac35b9
TLSH
T14921AB644FAB1B5AF1E2863B79556342CB327C02AB185F2E40C6428A18352009CA8F6F
MD5 SHA1 SHA512 TLSH

Submit Download

852d2542-6107-4fc7-a870-5f9291067fb6.tmp

Path C:\Users\Admin\Downloads\852d2542-6107-4fc7-a870-5f9291067fb6.tmp
Size 16KB
SHA256 5f1788a3a1f691745c7b52508ca343c37c7976609b674377520e2af02ea599e5
MD5 f02ede07204dd6b69047d5e4a1156112
SHA1 9fb98dc3588377cdba6882db5810a2f1326b0f0e
SHA512 3852cc5dda5eed1e841e387544708ed6e1f7cdfb9424ff86c3970de3f6528f3ec9505336a408e86d8a020eee694bbb1ef49e22f5ac6797d287194a7cb3585325
SSDEEP 384:WKAaEBW1W0q8dGqesbPAlO9LzCjzar7zMY0SgsaJzt+5eWs9U+:eajq8kieWs9L
TLSH
T193729420E4B1E47CE41AE2B687E2B4B4E178F99EC310B0DB055D52632676EF867BF150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller-GHRPK7BVBY.exe.crdownload

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-GHRPK7BVBY.exe.crdownload
Size 13.2MB
SHA256 19c68344c5e95d70bb59475a696838b50d94216ccdbb6c27c6c29e4d729c0171
MD5 b2d39424d98b15791a22ae607d85dd3f
SHA1 5ff42a9afac12adbb60346c7f1bb923015683c48
SHA512 7155696c4e4fae5a77ddfc55a50867625c4c94672a3825b4437bf7537cdecc9eff25cd106fe712da4c170f9eae7776cb3f87582ed1d548481d4944727a02f013
SSDEEP 196608:oGNlRA0k5a4nF9Ljyl6OqZr5LT8EI3i5pAPtGEgT:oY8tFol6O+r5LT8EfYngT
TLSH
T118D69D6AB2B800E8D4BBD178C6465617EBB1B41603709BDF1AA046F61F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download