hxxps://x64dbg[.]com/

Analysis

user interaction
yes
max time kernel
401s
max time network
393s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://x64dbg.com/
Sample261102-ththnsdv5r

Score

8^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
440	3392	chrome.exe

Executes dropped EXE 6 IoCs

pid	Process
3960	RobloxPlayerInstaller-9YCQ9C29BT.exe
1664	RobloxPlayerBeta.exe
1452	RobloxPlayerBeta.exe
4724	RobloxPlayerBeta.exe
5992	RobloxPlayerBeta.exe
2944	RobloxPlayerBeta.exe

Loads dropped DLL 5 IoCs

pid	Process
1664	RobloxPlayerBeta.exe
1452	RobloxPlayerBeta.exe
4724	RobloxPlayerBeta.exe
5992	RobloxPlayerBeta.exe
2944	RobloxPlayerBeta.exe

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-9YCQ9C29BT.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	89	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a5445fcc3ae9f9a2	5

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 15 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1664	RobloxPlayerBeta.exe
1664	RobloxPlayerBeta.exe
1664	RobloxPlayerBeta.exe
1452	RobloxPlayerBeta.exe
1452	RobloxPlayerBeta.exe
1452	RobloxPlayerBeta.exe
4724	RobloxPlayerBeta.exe
4724	RobloxPlayerBeta.exe
4724	RobloxPlayerBeta.exe
5992	RobloxPlayerBeta.exe
5992	RobloxPlayerBeta.exe
5992	RobloxPlayerBeta.exe
2944	RobloxPlayerBeta.exe
2944	RobloxPlayerBeta.exe
2944	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\graphic\ph-avatar-portrait.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\DenkOne.json	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\Zekton.json	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sky\clouds.dds	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Help\AButtonLight.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_11.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\InGameMenu\TouchControls\backpack_slots.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Chat\ChatDown.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\New\Unmuted60.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_5.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\ic-more.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\avatar\scripts\humanoidAnimateR15_DEPRECATED_20260813.rbxm	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\PatrickHand.json	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\Controls\DesignSystem\ButtonX.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sky\cloudDetail3D-bc4.dds	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\InspectMenu\selection_regular.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Scroll\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VirtualCursor\cursorPressed.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\MicDark\Unmuted20.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_10.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\transformFiveDegrees.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\loading\darkLoadingTexture.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Menu\hamburger3D.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\graphic\starburst_center_classic_kids_dark.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\models\Licenses\Licenses.rbxm	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\ButtonX.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\Unmuted60.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_14.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\AvatarExperience\AxisRing.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_1x_1.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\FaceControlsEditor\face_frontView.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Menu\hoverPopupLeft.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\DropDown\DropDown.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\ImageSet\AE\img_set_3x_1.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\graphic\TopBottomBorder.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\common\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\MenuBarIcons\GameSettingsTab.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Emotes\Small\SelectedLine.png	RobloxPlayerInstaller-9YCQ9C29BT.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Moments\Reactions\Animated\laugh-joy.png	RobloxPlayerInstaller-9YCQ9C29BT.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RobloxPlayerInstaller-9YCQ9C29BT.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5084	msedge.exe
3392	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-9YCQ9C29BT.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-7062aec9dbe74b14"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x32\\x32dbg.exe"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\",0"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x64\\x64dbg.exe"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-9YCQ9C29BT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5a21b87bbc2641cf"	RobloxPlayerInstaller-9YCQ9C29BT.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3548	x64dbg.exe
5968	x64dbg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe
6112	chrome.exe
6112	chrome.exe
3960	RobloxPlayerInstaller-9YCQ9C29BT.exe
3960	RobloxPlayerInstaller-9YCQ9C29BT.exe
3960	RobloxPlayerInstaller-9YCQ9C29BT.exe
3960	RobloxPlayerInstaller-9YCQ9C29BT.exe
1664	RobloxPlayerBeta.exe
5968	x64dbg.exe
5968	x64dbg.exe
1452	RobloxPlayerBeta.exe
4724	RobloxPlayerBeta.exe
5992	RobloxPlayerBeta.exe
2944	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3548	x64dbg.exe
5968	x64dbg.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	x64dbg.exe
Token: SeDebugPrivilege	3548	x64dbg.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6004	msedge.exe
3548	x64dbg.exe
5968	x64dbg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1956	1688	msedge.exe	85
PID 1688 wrote to memory of 4504	1688	msedge.exe	88
PID 1688 wrote to memory of 5084	1688	msedge.exe	87
PID 1688 wrote to memory of 4504	1688	msedge.exe	88
PID 1688 wrote to memory of 4504	1688	msedge.exe	88
PID 1688 wrote to memory of 4428	1688	msedge.exe	89
PID 1688 wrote to memory of 4428	1688	msedge.exe	89
PID 1688 wrote to memory of 3220	1688	msedge.exe	90
PID 1688 wrote to memory of 1684	1688	msedge.exe	91
PID 1688 wrote to memory of 3220	1688	msedge.exe	90
PID 1688 wrote to memory of 3220	1688	msedge.exe	90
PID 1688 wrote to memory of 1684	1688	msedge.exe	91
PID 1688 wrote to memory of 1684	1688	msedge.exe	91
PID 1688 wrote to memory of 888	1688	msedge.exe	92
PID 1688 wrote to memory of 888	1688	msedge.exe	92
PID 1688 wrote to memory of 888	1688	msedge.exe	92
PID 1688 wrote to memory of 3628	1688	msedge.exe	93
PID 1688 wrote to memory of 3628	1688	msedge.exe	93
PID 1688 wrote to memory of 3628	1688	msedge.exe	93
PID 1688 wrote to memory of 2536	1688	msedge.exe	97
PID 1688 wrote to memory of 2976	1688	msedge.exe	98
PID 1688 wrote to memory of 2536	1688	msedge.exe	97
PID 1688 wrote to memory of 2976	1688	msedge.exe	98
PID 1688 wrote to memory of 652	1688	msedge.exe	100
PID 1688 wrote to memory of 4672	1688	msedge.exe	108
PID 1688 wrote to memory of 4672	1688	msedge.exe	108
PID 1688 wrote to memory of 4672	1688	msedge.exe	108
PID 1688 wrote to memory of 4164	1688	msedge.exe	109
PID 1688 wrote to memory of 4164	1688	msedge.exe	109
PID 1688 wrote to memory of 4164	1688	msedge.exe	109
PID 1688 wrote to memory of 2336	1688	msedge.exe	110
PID 1688 wrote to memory of 2336	1688	msedge.exe	110
PID 1688 wrote to memory of 2336	1688	msedge.exe	110
PID 1688 wrote to memory of 808	1688	msedge.exe	111
PID 1688 wrote to memory of 808	1688	msedge.exe	111
PID 1688 wrote to memory of 808	1688	msedge.exe	111
PID 1688 wrote to memory of 2352	1688	msedge.exe	112
PID 1688 wrote to memory of 2352	1688	msedge.exe	112
PID 1688 wrote to memory of 2352	1688	msedge.exe	112
PID 1688 wrote to memory of 4332	1688	msedge.exe	113
PID 1688 wrote to memory of 4332	1688	msedge.exe	113
PID 1688 wrote to memory of 4332	1688	msedge.exe	113
PID 1688 wrote to memory of 4184	1688	msedge.exe	115
PID 1688 wrote to memory of 1876	1688	msedge.exe	116
PID 1688 wrote to memory of 1792	1688	msedge.exe	117
PID 1688 wrote to memory of 1588	1688	msedge.exe	119
PID 1688 wrote to memory of 4304	1688	msedge.exe	120
PID 1688 wrote to memory of 1588	1688	msedge.exe	119
PID 1688 wrote to memory of 4304	1688	msedge.exe	120
PID 1688 wrote to memory of 4304	1688	msedge.exe	120
PID 1688 wrote to memory of 4188	1688	msedge.exe	121
PID 1688 wrote to memory of 3220	1688	msedge.exe	122
PID 1688 wrote to memory of 3220	1688	msedge.exe	122
PID 1688 wrote to memory of 3220	1688	msedge.exe	122
PID 1688 wrote to memory of 2208	1688	msedge.exe	123
PID 1688 wrote to memory of 2208	1688	msedge.exe	123
PID 1688 wrote to memory of 4348	1688	msedge.exe	124
PID 1688 wrote to memory of 4348	1688	msedge.exe	124
PID 1688 wrote to memory of 4348	1688	msedge.exe	124
PID 1688 wrote to memory of 432	1688	msedge.exe	125
PID 1688 wrote to memory of 432	1688	msedge.exe	125
PID 1688 wrote to memory of 432	1688	msedge.exe	125
PID 1688 wrote to memory of 5280	1688	msedge.exe	126
PID 1688 wrote to memory of 5280	1688	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://x64dbg.com/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff5054c188,0x7fff5054c194,0x7fff5054c1a0
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,10045916375444686215,366213255342139968,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10103943469479167664,17805692488916281721,262144 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,4804476606832047024,15694111509165859094,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,17689443175551199667,398636360196056633,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,4837939761369748258,14665596488355084396,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,16771651373531508164,7750091551991014920,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,1231209384894530325,4214809650113148611,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14738452962891196267,6610073924708184283,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,18312928138616344605,5826403764034230251,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15297864434822762876,18211341050465353765,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15297864434822762876,18211341050465353765,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,2229869362143959807,12204689103094840049,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6384,i,250111816120081135,5768710489780071185,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5984,i,12233140221883186345,13805238583890579731,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4156,i,10768014897613567640,15855254343455348200,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6880,i,6231856347666623211,15536996881138876884,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6164,i,3641146132831936740,13617943986222202117,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,6464408750667585432,7925019620334349076,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,2741982256246229140,13133973853489139159,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,5959581403434196134,4841998596503324868,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,1224754222041793637,1779363716712101504,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6444,i,4735651528136816024,1261524234093124691,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,521883604671890197,17122171991117219955,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4392,i,15750145571752714812,10137945593774807523,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,11715348184523629897,16282452102034467684,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7328,i,11669405650630848966,12271744844808802063,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7596,i,17793270934489623781,14529043228252551600,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3484,i,9390741554982211452,7584007098733712974,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6620,i,16701533741624196724,13152069898245329313,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7440,i,11736370304941923284,10740798563377402423,2097152 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7808,i,12213221621200162864,1951294333898981849,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8116,i,16104732119511528489,3689299466988642606,524288 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,1912472589052842181,12726000514182907249,262144 --field-trial-handle=2224,i,17025066977629000110,9014632354462079247,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3168

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1860
- C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe
  "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe" ::install
  2⤵
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:860
- C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe
  "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff4fc0c728,0x7fff4fc0c734,0x7fff4fc0c740
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,8408331598615515714,2449177384787346396,262144 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,4913071957132170694,800057494992732906,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,15049624665093613491,16660631708238254478,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2328 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,16695074833129056259,2888857883838354856,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,9714467221446526425,9529506129357008881,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,13213089419867286665,12627341627151372559,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,5107549643144656074,4015319569602165026,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,15844489058907455239,14195157081443940930,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,1760650894904176828,8232031519970602068,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,7915960236742452082,13504482941389156318,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5820,i,4898842514468343557,6560375068599159126,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,16824942649554036576,141343508892239269,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,3444638014399849269,16846473165945197669,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5568,i,13854129062692527172,4360638224755968564,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5984,i,4998677870119778619,4811586224930116326,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,1823875589649801472,9480533227360797057,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6528,i,1916157543860569245,13788294240076954077,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6644,i,197100769975285038,16986897796998917048,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6080,i,10389721017348280558,16005806855485914315,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5976,i,5545001662392745368,8776770510461093412,2097152 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,10015111859228465875,10062207008934401483,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,17742335400401875388,870730460037953481,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,1621530863246083224,4723883487741156181,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,15991473106768956856,14244002835084012254,524288 --field-trial-handle=2076,i,5231134836320319342,5046456838603486337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:5176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4180

C:\Users\Admin\Downloads\RobloxPlayerInstaller-9YCQ9C29BT.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller-9YCQ9C29BT.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3960
- C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -personalizedToken 9YCQ9C29BT --deeplink https://www.roblox.com/download --webBtid 1793635711869001 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3960
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5968

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1452

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4724

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5992

C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 13.1MB
SHA256 f52514b1b91376ff9ac66f49d16f7cbda4096d44fcfe3dbb662a2b8547dac9b8
MD5 18f405651d9446df3579f785ee96034b
SHA1 2dfa42893bef7f8277339dd44a412780db67aa36
SHA512 9d17596e911fcbe3e2870b6477c00c4ef63b9ed5a1b2e682b4c411cdf155283a6cdb150a4729264274cc1778898ee40a7f0428177e0af5e7aa173037e8f25a6b
SSDEEP 196608:jVhIFplZ45+y23Ftw2xYxKDi3zA3/4rsm5p/FMrp/2IK:jVs1F/YxKDozA3/4VdMrp/dK
TLSH
T160D69D6AB2B800E8D4BBD178C6565613EBB1B45603709BDF1AA046F61F67BE05F3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d16af3a-c900-45bd-a1bf-2b4c20f24bbe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2d16af3a-c900-45bd-a1bf-2b4c20f24bbe.tmp
Size 131KB
SHA256 aa5242b8c37c9f12ecc19e3ab4addb188454c26dfb2a5b1bcdf02db9bb812778
MD5 18227a3484cda9c7301fe49d608c9380
SHA1 3233fde3d406168f86149a063feed30f75c0f094
SHA512 a519791f7d1886ba557b0a3315dce179c31f3ab6662114ddc46bebc05712c41383736ed5d84c03db6d27d57eb709c4c4ed019685041772422f3b68034685cad2
SSDEEP 3072:X+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gq:X+hFD+7t56OD9ZfSApprq
TLSH
T10FD30232AA95D8BBC9BD6541F157A304DD72A8EE41DE3A0944465F8EE09FD4C03B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

429c958f-85bf-4526-8b3e-6015dacd6506.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\429c958f-85bf-4526-8b3e-6015dacd6506.tmp
Size 131KB
SHA256 dad65c90ffea1fd18a06bb51845bc1b1cf6e0babe116be9b2378a5b23eb57a98
MD5 2f59c396a945260d0d0d1cc22f1e166c
SHA1 004c5628e1a453b2f951cb286ad8fddd9f92ef1d
SHA512 84552cfdb63deee5320a8d446118d3cbf3cae20e86ba69df79098bac65007aab9a055abb410fdbd3021a978cb10d6d0c4fd0f9b525e17e2d77b28c8a6f2766c5
SSDEEP 3072:e+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gq:e+hFD+7t56OD9ZfSApprq
TLSH
T1DDD31232AA95D8BBC9BD6441F157A300DD72A8EE41DE3A0944465F8EE09FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 8256c1e7622729c8ed5e3789587c3ee8d4f8f07403fa02195eb6fba9ec13911f
MD5 dfa4630601879ef786557c05c9d5aed3
SHA1 382d14423cbbb0e30a4d37eb87354c5ce473accc
SHA512 ba04920f41d72c2b3df7980dc5f18022ec63082e0efb2a715c828b7d8562263f888712a38dbdf71fe8975006b0dd2dda662ab387727ffba0ec6b21a77d3d811f
MD5 SHA1 SHA512

Submit Download

1d8ae1d7-b283-4d3f-9ab4-109f2875806c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1d8ae1d7-b283-4d3f-9ab4-109f2875806c.tmp
Size 414B
SHA256 de31fc1145c7be322608cc29b2f65446a4733b17ffeb7a8394ee8a2a95ecf77d
MD5 2da084a054bd5e23e965be9f986d12ac
SHA1 bf2ec57ddb596cb7e508f8e6cb4b27de6118d9d6
SHA512 b066f6a1dedb2c37740dd29120863f1f9f43a4eeef3a4d06b5b6730ac4ac5bc57c308ef2172bdc8baef264a576fa6120c10ae5ed889bc15156627e783e19c90d
TLSH
T1D5E0E595D822AC3719F8075E6A25864AE660135B26815D0A7B3D811D4FB022601C685C
MD5 SHA1 SHA512 TLSH

Submit Download

5604f121-ad30-400d-9f62-3117aa74ef10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5604f121-ad30-400d-9f62-3117aa74ef10.tmp
Size 13KB
SHA256 1eb7183d38c5bcef7a4f41a517260890894f9aba96df95340e32ceb559cf1f7b
MD5 d6140f326789114d815e1f9d1d4bcf5c
SHA1 998dfbfbcd92f19347c7bd441a3424eea2c6671a
SHA512 21e90781e11c7437e9fd332b28e56bbd0fb19ce2a2d6fd4f8bddb6283a6853c17ba7e63c7545ac8981be2eae1a75a65a8c05eb4bb109803c28f1ac267bf6cdd1
SSDEEP 192:JRPcBhOnGN3kkAv75NDpAPRp2hcHU9QHsb+WNHAdh7gMeVvrSkw8VyIsnAUgraJ:JRPmhO6TcVxUXeWwcfe9rS4e
TLSH
T1A352D67EBA20757B9CD7D226FD257B1BE7F5102160842E84EAFD892C14E79CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 34KB
SHA256 c811b76785137c789ae1dd0f21ee61c40ee7eb76518b51e3c3fe6a32a606d92f
MD5 5591ff4b466999e32aec305d8474ac9e
SHA1 22e393341dcefff9d1d67520eb83688cb904ae1a
SHA512 04dcd2ebe34c90d7cf4e92800c4f69d7632bd45949f1c64a74256f627cc79c6ab0bf61adab871aeea10daee06e8d528c7002c39aba4f6a68b35e7aa4b03501b5
SSDEEP 768:gnBd63kaD1qJ9skOECPJ6K6LNJmuZEo1Vb:SBE0aDE7s4Y6bjp1F
TLSH
T1D4F202276B7F59F1263821E4251C30D17E3D2FE3D40114CAEE8CA58C53390926AEE966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 23KB
SHA256 02f6325f882759e2a34fac9202a6850ceb63b6a40dd3bd86906b9a8b9ea643c7
MD5 ccedf92af34b93ac813df5d3cd6d98c1
SHA1 96998bed7baba33dcbf9de8770fc805ede34199e
SHA512 e700b0219425fc806d27873944ccee67b839a25c2ab1eb5cb51e119bf11174f1b6e89b34e8bbf204b8fcdf7f96f3d13a4b4b33d07f74f16bf1f7fc2ef8677deb
SSDEEP 384:jVrOol+GBABuYxtJIMaW4lmTSsZIXkeXIHD6OCBDWL0Ti1zcpZbQWaWDS5:5rOo8QAUYpIthlmVI0HpGDwcqccWaWDS
TLSH
T108B2E0752FABBD5F1F814114803E8623E045B9E60CCDC6EB65FA8975CE2F318586D125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 50KB
SHA256 20b6087f722c22704fb8ae0fdd22186054c625c2d434b688a8c8aa0729a0427b
MD5 e5f3ea518512391541c5a2bc1f12efa0
SHA1 8f69ee70635c4ad9cc1e63805c1c101debe09159
SHA512 7a1b4641f721fbb6e5d00fc226782b74dc4c5d1b05e749ab35be682eb31a459c2c4bcf985e48f2929fd57687a8c30b41b70e7080cce0b89d8503101c3a20fc38
SSDEEP 1536:oo6jCN35tKUvchamVs6oxrmv6a9/4dGMdY7SmvCsc:R6WZfTXmVTox6iaJEjdYOmvCH
TLSH
T169330244981CB9DAD7916B57023C0B8336D32A55E41173F6112E36CBAB7F06DEA79F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 64KB
SHA256 10f88881ff3d97c2ae2627e3cfb0694da7429fcbb1ec76bd769c2cb4e079ec00
MD5 b908d213ac562fa900d999f44b944af9
SHA1 743b45b22a470ee90ac188c582bd9111b05ab2b8
SHA512 1b7fb9b7d93b1c29202f33a6cc4457d033f607c69828c13f72fafb9cbaded70975c553984a04d17ee42d615228890cdcf25eff763dcc658c09531185a279f48c
SSDEEP 1536:xOsfOL/RLRsMKsILJ09R3jVUyUsbN0vm9d/f+i58kbnNhWnT1L+:/OLZ1K1LO9RTVDN0vmzn+i8qNI5K
TLSH
T1D75302A610E68C0F1F020CBC4281F50F4F958AE1F663A45496532BFFE7617B8E648D8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 70KB
SHA256 1eb5b34f2bec1c0aa2396baa514d86f5bc221a9a7e82e4ceff33c9d250a0b278
MD5 c9eefb0e2dad48e16383d2eeed16b4c5
SHA1 90705a2ef7dceca51258bac3e343059c6f6bd9bc
SHA512 a1fb8b06506554412033dc6433a40b98d14a2d188b2c5e36548d547234eaa7cb38f1ac310750ff0ac3d570d7acef51f21134eabc77ba654db7bfaa4f1b26ce64
SSDEEP 1536:JA0P6txq0McAG7CIkC9sAeY0667MSbZQquWjCiBQul:Jx6mBcAG71E6YFQT9iaul
TLSH
T10763120D5EBA3DE37722FE1AA446A47CAC77954C96C423CA84079CF3E43C93059369B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 16de5a76138c5cbb5bc5543efe0a3914eb3c426bfcfb77d3c067c0f3f2f0653e
MD5 d09bfdddbf133d678c55171800118aa8
SHA1 a3d4acd1850d812bdb39905fe04e83a75f63e4d9
SHA512 d2e3cc3065c52141fb17f92c4a857c789bc12f97a5a58a005fc89088364ec6d4a5e85dbd67e6439359f92a190588a1ba34abd05b51aebbafd7ccac00dd9d1f90
TLSH
T1B841D95E79D6E024CF703BB04EBD4C2A1F7C01B98DBB2AA30B20B87421477A5D46D65D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccc51464-9bac-4037-b5a0-8a5bf8472cf2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ccc51464-9bac-4037-b5a0-8a5bf8472cf2.tmp
Size 9KB
SHA256 68e4d48fc62c25d3e24ecda1b5e34d419eedf6a07b6c82ec68cf60b150b31115
MD5 19ea58efdac22e351d3ebf61dfe16f43
SHA1 6d797302078e2ee029a130145353de995519f2e0
SHA512 568deabaa9e1534ced52f56ebb82f62eda1ab388823fa973b84df0bde9eb42b17659bf8e7d2e02976cc60f2a3b5a6521a18ccf3b869d386e90b31ad3163af126
SSDEEP 192:D7jZG73g3Jt6wanR+rJ8WIOtZUefyKhLaP9IQInI4I2amvFkfPbofcNPVuNhl4HA:D7jZG73g3Jt6RnR0JNIOtZU2yKhLaVId
TLSH
T154129AF7C3D9C62DC8115AF49B25AE1FCE1E1A28422C3D26C8D8AE4B93E2471D21565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e66f15cb-0d9b-487c-acd7-d2ca48f15643.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e66f15cb-0d9b-487c-acd7-d2ca48f15643.tmp
Size 1KB
SHA256 3341d79b0666b6c796540f1b8693a8a11cd842fff27a011269bb14d787048669
MD5 0d7952cee42df3ed931fa5ff22d6d916
SHA1 df1442ce1c9391df797704293ba9055390b536e0
SHA512 136ebbd654ca4667923ebff5f99c41537c4b0e8940422dbf15238d7902bfdbad5e87019d353cce5aa8490515a75718d5d52b9fc79442b18c571730e204f4e66f
TLSH
T1EB315DABDABF746720298B775D09B8052EB5B837019164F4DEA7837C70C25F31692493
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 31d07cee0f82e386b86ddd047e3c215d889c25ed8894c19ae8cdbbc213b14394
MD5 0ed94794ea4590f44161c525a4e5312d
SHA1 eab0c522b4cb55ce851473704821584ef8b8e3db
SHA512 160a99c2881edc966e5c414f38e988020a6a96d77a7672cd2c27f1966f7ee87b10d6dbf3b28b8e9658dfd1cfe584d8a010b5f7995c0188290d2eed49571c1190
TLSH
T1C5B01298C0425301C01607F811701C983154EF15A60A170241F41E21CA39351C01B154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 aa70a06f0274d1a259ef8faa3daf658c06f08b796c8eee5fb3533ec72ea8504e
MD5 201869905542d9201e995862e5d431f9
SHA1 1cf5b6085ca8901381f06d5ac4f27c061177a571
SHA512 63402a79c9caab725e52f302cb0a5a72b971d51d7f6a79f3c168bce72cd8aa4d287c03eb965b819be33ba81d3d29e57935842debb5191ba8faffd80c3f65a22c
TLSH
T118B02200C003A202C28203B02EA0F8C83030EF3FC203028383F00A33CC302A002A2A20
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 7b235b0145c40f0e94fb778d29a7c693ee36dad8a92f20470df6193e6b0c252d
MD5 0cee53d9dbcd31224082247fa52169d0
SHA1 13c5d22f560acc8e8e29d8d735b0799f6867c9ba
SHA512 3c4475c40b046c4344531bbd4a131eddc0b339701a5597f10f3d390e034c23af2788fca93a460d31f98a6debd05d4d6d5421dc89884ae20c3559ff6ab7db84ab
TLSH
T1A9A002A093C44312C0500271978516D47B10EA2643130B02409519F4D9A0782E586212
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 0f95452ebe00f0853bd77db9badfd2f2dcc649b5700aa08b12ce0f884acb11c3
MD5 6ae582adebef1653dfafddd77a77fa93
SHA1 14c56ae49a8d6524120f61905c8bf26abcf2205c
SHA512 56e7f7c95e1dd98b8911cea4e3efb12bfc4af8cbcdf78510ea2b3dedcbef303ecc8d202871db848168a61df8a6d089b58e171a99840642665e79af19b64e1817
TLSH
T1C8A00220BAC14416CD3066B070625D833657781526D1470754D21564CD5F1C552A1301
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0f7d10ad8bb67135dbdc95d6cff53344d4123e899212cb30a217ce3b7558de07
MD5 8d007153421201973faba90821659ffc
SHA1 6155503652db3b48c061a52d6f5eccec9dcc5ad3
SHA512 a70a6649a4704ac260fc6ca51442311bab4f920c70c2083f6dc03a7fc378e13e94f645fb01eb06593a733155e77877ea7d41ba6ad84e72af4bafe0ee83a19e1a
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

c0ba8d45-2c57-4de1-817f-7548402a3884.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c0ba8d45-2c57-4de1-817f-7548402a3884.tmp
Size 17KB
SHA256 bb3848999e2ddfd0a0f27f3fc3a86851b6dbac8ee46bb2d827512ccc2ce29361
MD5 ce0c5eb5beabf37922a5f0248990f798
SHA1 2f62d0dbb8fb032eb5e0bc433a3ce983bfd97ba5
SHA512 35889b11c39fae1a36d2bdd43750ae32a903a9563b6b7571398aa5ba7c019485cd34084aa68e5e36e056aef81dd25ef73015028e80d5318013f2d299f4f9d266
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3bkHGEtbVwKj:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pU
TLSH
T1827209676C4C9A370FD4C68DDC167B4FEDB5025A65EA886442FB982503D4BCF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf722fd6-3458-47e9-9aeb-4328285c0624.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cf722fd6-3458-47e9-9aeb-4328285c0624.tmp
Size 12KB
SHA256 ac1685b3fa4ef12eb2dbd9f280626cc9551cb8ba239c5a586b02cc2cbae29fc1
MD5 5848c3f87389f7f785ea165a20b4a695
SHA1 52caa175bf3cc97cea0ed2c14f34e409415fd54b
SHA512 20ce36a631deba240cf5db1490cc894760c7efe254e377fa956dca1cb88759dbddc2a4be768fd9cbdeb095c281a4905966a4efca413f38546de4839bbeaa36bb
SSDEEP 192:JRTanGN3kkAv7VNDpAPRp2h70N9QHsb+WNndh7o82rvrSkwJVyIsnAUgtaJ:JRTa6TcZxUX9Wwjz2zrSP8
TLSH
T13152C47EBA20B57B9CD7D226FE26771BD3F5102160842E84EAFD892C14E79CC2127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4a00a6f-141d-4bd5-9ebd-42f9eedbe0f2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d4a00a6f-141d-4bd5-9ebd-42f9eedbe0f2.tmp
Size 13KB
SHA256 809c437e9a597a28ec53f0619374f5e2c66a53c98c57b90c30c1150efa1a84f1
MD5 7cb4459dbea13123a4e3c1a6a120615e
SHA1 8d361d7a50811f62d850f24f14c09fb8766d174e
SHA512 e75ebccbedcd0e8e30c7121b6676ba26afe60556bc052deb1afaddde51ed9cd41140808a381343c00ec6257cc54a89721450c9f8f4023a3fca01151d26df249e
SSDEEP 192:JRPcBhanGN3kkAv75NDpAPRp2hcQ9QHsb+WNndh7gMePvrSkwJVyIsnAUgtaJ:JRPmha6TcVxUXmWwjfe3rSP8
TLSH
T17552C47EBA20757B9CDBD226FD267B1BD7F6102160842E84EAFD892C14E79CC2127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be398e69-84d5-4ea8-ac33-e639b8b725d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\be398e69-84d5-4ea8-ac33-e639b8b725d0.tmp
Size 130KB
SHA256 694f996c905fe3bc470f728fe6695e22cb37c112fc58cd34e670de895c555bf7
MD5 8acf71941ae3de8c47d69a6c78d83dd7
SHA1 f7f7a362a4cd413f64a6acaadf84b549e7be52eb
SHA512 018c22cee0a0428cd36bf1c46878e7d59f28dd7aab35128c18530fd09350662fd3d543c0aff404b77a6a0652ec7737af954e3029a781cf76aa6eb58b73a94cbd
SSDEEP 3072:O+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:O+hFD+7t56OD9ZfSApprr
TLSH
T1A0D31232AA95D8BBC9BC6541B157A304DD76ACED41DE3A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4dc2980-dd03-4d1b-bc33-ece47a17ebb3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d4dc2980-dd03-4d1b-bc33-ece47a17ebb3.tmp
Size 131KB
SHA256 20b31616de02e4830f377e25e097c5a16ebb08a589b14ee8bf7e39dc1328b54a
MD5 caf510b47d2eb7a2d7aaa9902b69d42c
SHA1 64dcb51c5598285b06409702918c3287c835b322
SHA512 01a88bb1849aa5ba6a68389282bc431556ad57c17353c50bbede6b297bc4d64cb3ebf8a16bac5affaaa73c6d355729bb4d342b045124fb298e55d07c2ab545b0
SSDEEP 3072:u+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gq:u+hFD+7t56OD9ZfSApprq
TLSH
T128D30232AA95D8BBC9BD6541F157A304DD72A8EE41DE3A0944465F8EE09FD4C03B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

172eb9c1-0f2b-4236-9e12-1b7370512d52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\172eb9c1-0f2b-4236-9e12-1b7370512d52.tmp
Size 8KB
SHA256 dedd2e7be8f0ffce756726b0dc850a5c9374b03d27d14910f9e6a4ed832a4bc1
MD5 1498d0f4653eb0f46d121acec4e4747d
SHA1 57b53d3c3e451ec5bdee5b5a74e6b8eea66af6d5
SHA512 24355b8be7e6ce99c11d0272c6564577aaf8e2e31e96d2117880a4f5229b7d108c1219a9a48006c42fb5222081b630f5d73c1eb12264675035d35ccc4604e4d9
SSDEEP 192:fONE6Dph9qQmiUySsqwGYX59eziC8px2F++2IkII2q5RU6:fONE61ioqwGYX5E78pxa++2R3U6
TLSH
T147121A76A878BC375DE3A991F48739139FE4512BEB857F40D5EC1A1C01EF29C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23df46ca-4aa4-45af-97d6-6133f70f1d8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\23df46ca-4aa4-45af-97d6-6133f70f1d8b.tmp
Size 18KB
SHA256 b73c1da55a3e8ffc3b3d27c5a153aecf8bf48a0c10dc6cf86ecc6d9d291bc186
MD5 1c12cb52893ac1639fe1b705bf4ab04c
SHA1 31fab1e4f1eb6cea96adc39ef243fdf2abf9b1dd
SHA512 bef61f43b71f87851ec20e3813d24b8bff45cda76da6411b3b1a66d2cbd328a1370a074409928db3f7ac9a47ec60e7cb271701e1c25c51d7dd29818400e83047
SSDEEP 384:EQkUSv0sNJFO8Oq5Xwv2BGYX5E78pxa++2z3H7vBE4KIIlU:00XpqWvwGYu7Wjlz3H75E3Ly
TLSH
T199826DB2A8746C3B0DE3E651F54B3A139EF4911BE6D52B80D9DD5B1C01DF28C234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a3a74ce-9ca4-4857-8667-d718cfa9d776.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a3a74ce-9ca4-4857-8667-d718cfa9d776.tmp
Size 392B
SHA256 45d4ae0c712cab13e90ef4eafbe9b6dac08bbfb95c1a80bd327f69d3d2806795
MD5 9124ee9d23227d8622f70180a5507bd6
SHA1 97b0e0c3e834da50a2ee1a283a046535a44b86df
SHA512 c7cb3233fd04e56c7e0822c1f9aca5f9c389aca9c0c6c0c7c21ca15d315438898dc3d071c5cf8401954180158c5c1074d6e8c5e520dce008d06b42015cc65afc
TLSH
T107E00102D24055BFC03C037000D3693039F2A47803F301061A001174A867B542B30FC5
MD5 SHA1 SHA512 TLSH

Submit Download

430adf63-ae51-4b19-812b-9ee50627554f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\430adf63-ae51-4b19-812b-9ee50627554f.tmp
Size 8KB
SHA256 306f53ac3309235587fe7fbeaaec28830dc5210283ee7ba2b26975c4428b1ffc
MD5 9579006d7c6b605e595fa22324980ade
SHA1 c8eee102293d90ab65b2add464ac987625059b0e
SHA512 3a729f4a35cd56f51f2bc5ee9e4e8016c6fe478ee49cf972d3c13affbc729db652aa84227b19473437ac5bd4db2ff116ea88b147b9050491ce76f875550760b2
SSDEEP 192:LJONAh6DphmqQmiUyNsq8wGYX59eziC8jkk7IwxU6:lONAh619pRwGYX5E78blU6
TLSH
T11F02E935E8787C7B4DE7AE45B54B2B139FE8212BAA906F84DAE81E1C00D764C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

742d5c1d-5113-475f-9ab5-236d6b0fdd60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\742d5c1d-5113-475f-9ab5-236d6b0fdd60.tmp
Size 26KB
SHA256 56a418d88d08c79d6f44f0c68d68bb1e56407f215564546046b36dffe4411dff
MD5 423f82d4db79d64efdf937d85b2bb0ae
SHA1 3342a675dc3c059a55ef8f1d2662c4d4182a00e5
SHA512 1451c1a915a234d63ba87b33cf028dd10d9433f650533fe30dc73479835d34682136fae2d0a5f14c41a5a689897a0e685b9b91749da9f5f11e3164939074c0c8
SSDEEP 768:U6xFI54TwgWpqGRvwGYu7Wjla3H75E3Ly:+qwbJWjIbKG
TLSH
T17BC229F258E7583BD9AE9B43A73E2D039EBCD017B5846A40F789191CCC861BFD34A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94995bf2-2808-4afe-9891-75cf1dd933eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94995bf2-2808-4afe-9891-75cf1dd933eb.tmp
Size 392B
SHA256 b2280d2693aac358d4df438c25ccb33313aea06046cade102bc2e6a1fcbf8a69
MD5 b4e7e2410907d3dae627569b6d38d122
SHA1 efe70cf525738132e4b1568f6782e98740a17a46
SHA512 03cff67faf7848e9cf69376c48927b7016aa8f70acad7e6d8586bdaa6e0bc5e580ceff9c522a7c557bd960bd6294dc9af1c2f266839a903cd37460889185a458
TLSH
T183E00201D20055BBC07C037000D32B2039B2841403D3010516101174AC35B042B30FC5
MD5 SHA1 SHA512 TLSH

Submit Download

9e92a83e-96de-4cb3-877a-84614d801c91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9e92a83e-96de-4cb3-877a-84614d801c91.tmp
Size 26KB
SHA256 063f6887ad099138ffc0580eecab3eab96f6c00d1c76d98ea1196792022a1acf
MD5 1447864180dc424174de032823177270
SHA1 8abecd9c57b59c1a5154e52982faa6878e139f66
SHA512 9eaa3843452626ec0df2868c4ef9340e37d1c4b21cf3aff66497ff3f8767e897c0ad7a4e802a9f41c28556cb592565a2cb343c0e5bf13dfedf413d039356f46f
SSDEEP 768:U6xFA54CwgWpqxRvwGYu7Wjlu3H75E3Ly:iqPaJWjAbKG
TLSH
T1F6C22AF258D7583BD9AE9B43A73E2D039EBCD017B5805A40F789491CCC8A1BFD346911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9da30738-4726-4dcd-8dea-3ddaa5cfe7fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9da30738-4726-4dcd-8dea-3ddaa5cfe7fe.tmp
Size 105KB
SHA256 1d62e22dec5c299be491cb2f809a917a5b2650bcf6f26d1655b204a91c995427
MD5 a1423f7d471bb13fff5ecfcdaea6454c
SHA1 7ded49e29e2ee4ecada313702dc82cddf87e8600
SHA512 6e90c834830dc60cf4e69d47a842a672355eeac4f32e8a0122d66df5ce75da4ac71274dc3cb208dbb06f3cd4f506485158442b7832ede2cf24ef8c5b26c1705b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T119B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ec9f3225a36b6095e8a072aff3977b6c72c6f861a6c339c4c341dbacfcabd0c
MD5 e099eb95a648ea38aff2773c3580afa6
SHA1 b16d4ca0fc492601803a2b8a12e254385f767f7e
SHA512 95eaa01bc1a2e460b0214a4a48369f37b222bf53e085bb61210a0f6e3ccc4421b5ec242c42f8a8098383d4db3086bbcdb25ce0d03ede13027668e705420b97f0
TLSH
T168D0802165753FDDD12F5035041585844E44CA3356001115571F1D2D16944D62D61DD4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

05702a09-25a0-4858-9b17-216ea3115583.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05702a09-25a0-4858-9b17-216ea3115583.tmp
Size 16KB
SHA256 3caed815d452f2b0a2372bedf458f55a936d9e3a52ea2ca0adf0d9bbdcb7b38f
MD5 de42662287629ba6643906be5b2ab205
SHA1 c819591cf82905d98f797d135df5c16eda8369db
SHA512 c7ddf3af6f1c21e957285ff6332bd328c3e0087728cb7cabbf6fa693498dcaa52f4637c262d0ab995d69bc7bc48a5d9d3691f9f762480a8ab6e8d941c951f90e
SSDEEP 192:sxZQR+ucBWO/fTsq00VYvjUddpUuY+ScyBFHW6+WN+jUXtxuHRe33VXYgsgaNIgB:sxZQ/mWO/fTsqGi+HbXuo1Xuu/MDDxt
TLSH
T13C72B7926924A977CCC7C519BD35BF16E6F910239C924D9CAFFCC91C08EA6ED1207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1592b1d6-ff4e-4a01-a9ef-46814d248397.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1592b1d6-ff4e-4a01-a9ef-46814d248397.tmp
Size 16KB
SHA256 15ee0c6b5e6dea311f6eae0dd4859cd0d609fa66112644fcbb9cb840d1017bc7
MD5 ced82ace06084db7a045be1565f27e9d
SHA1 3a368c0c6877e310633b759e061517c8d2667e1a
SHA512 21191e1347996e08e39d86c8a8b7f8d82d02b376901261543f125e7b1dcfba904ba1b37519b1fdf371f797db9c70a11f2a695c97c98c6ac4d7427f336a33d187
SSDEEP 384:sxZQ/mWO/fTsqwyiZnHbXuo1Xtu/MDDxt:s4/mWO/fdwPnHbXP+MDDxt
TLSH
T17A72A6926924A977CCC7C519BD35BF56E2F910239C914E9CAFFCC92C08EA6ED1203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1989e431-155e-4426-9d2c-9491f05d75da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1989e431-155e-4426-9d2c-9491f05d75da.tmp
Size 9KB
SHA256 00360c504294bbc8056d67596e78d45c849e0ef9074fdff7e33788ae50664e1d
MD5 f5fe34ac0042c8b3104f2dbd8e12259f
SHA1 076e29b314fd7d317d2970a3c6008b3012b9fc07
SHA512 fab2c6f699b3373aa9316f756b37944cf046ebc92d15ca9bb0e5b8092a04561f945d3aa233808b7d72537c735cc806e63141b816d991138a37fc816720053844
SSDEEP 192:sxZNR+WO/fTsBJIdphFHW6+WNGwW/YglUaNIgrJ:sxZNDO/fTsBC7HbU/z9
TLSH
T11A22A8526E24B97B8CC7D20DBE25BF13D6F9543295951E48EAFC861C08EBADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

277afff8-f93d-4c46-86d1-60e97e00d101.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\277afff8-f93d-4c46-86d1-60e97e00d101.tmp
Size 10KB
SHA256 21bdc82355c6622e7d4d93eb764ac23a49cca378c03cf4abce7d1d59d152a4f6
MD5 548076a9dda345eb9f200570cb2124b5
SHA1 f0eaf0976db90cab593748156b72735149e1b870
SHA512 e3e8a4f358545533293c768de6bd76ca307f88961bab8ceccf1bb1a0a463cbb7caa8e57ccc7e907879928a31f35896a5c86e63f090769f9d964d270cb15d4b93
SSDEEP 192:sxZNR+WO/fTszJIdpeRrFHW6+WNG3VXYguUaNIg5wJ:sxZNDO/fTszCgHboX2S
TLSH
T19622A8926E34B97B8CC7D21DBA25BF13D6F9503295951E48EAFC861C08E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

373a107e-387a-45fc-9b4d-612e15dd1ad7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\373a107e-387a-45fc-9b4d-612e15dd1ad7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7324f319-37d3-441a-9d53-05c6d6da3d58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7324f319-37d3-441a-9d53-05c6d6da3d58.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f536329-4752-4613-8342-5690aef1d6d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f536329-4752-4613-8342-5690aef1d6d7.tmp
Size 18KB
SHA256 c5450f495d27082e3786316b8e490ece960c9065ae88068f0884eeff351683d2
MD5 9d93e0e324557ec4b7eb1de16a2a5e48
SHA1 f75d73d5cb608eba24743f68107eb340d775c068
SHA512 e5d6c1844b0fce1a8821e62f4004fa7d80c90d952b9e97a8b464994e95b416421f4370cb126b2969fd12c17dba1c44f1ae27d29968787cc93715a6ea670f0d5d
SSDEEP 384:sxZQFmWO/fTsnWvTHRyiZnHbGuo1XJA/MDDxt:s4FmWO/fkYTxPnHbGPAMDDxt
TLSH
T18882A5926924A977CCD7C519BE35BF16E2F914229C914E9CAEFCC92C04EA6ED1303847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 41KB
SHA256 fc809549bf7be69abfde111ea2421f7c77e99d6bf7fb5e491ffb8116a7b45a7f
MD5 c78ccc490a3a341f19b7d81ea3d1f694
SHA1 90b3ff359644aaf07a06b51d53be7bfd722171a4
SHA512 df315b9e3ba964a8b2d5ea5c9579c93d34b99d4d74b2e60adb3f0aa5eae954af032f83395f82fe2f76f44b4b00e11a9bf21377039962956f0d8f55d76c3f6e85
SSDEEP 768:F8Lsj1trMU+HzdIooqgg6PW+eDS/a53yvt+ztMgt/3mgoo0yttir8y3:F8LmKoq/6Qm/8ugN//oo0AE73
TLSH
T1E713F1D827EB81315C1AA5472246BF6526175304BC4B026C7DB2FCB7E2F1844AAFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 78KB
SHA256 5ab066a45702d086eb4d22362031b7e1a45255bcdbe471455ab3b6b2dc51f973
MD5 824ab5dbd3c8195b643ecb0176bbd179
SHA1 06407b9c1fb659d3036e4209d140e9ebf573c95c
SHA512 0a9a0d5fbaa33737bccbcada003fdefb4eae6c9ac6f525110ab8811f29f6a83da00b8c15a112719c1984f852da11d0810b68da5c3d77012843ceae78d35563b0
SSDEEP 1536:RHJqapQOsXTH3fsmaWKeQxgB7SQyttQLMwnt8jBwgQn5AGjBBK:RHJgLX7JMOyiMhE5AGjBBK
TLSH
T10E7312F00864DB5AD5D2B271F78E3BF3B036FA11485FDDA750305881E84766B620E88B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 27KB
SHA256 1b1dadd6b58f546fec70c07a1a085916128f8a47fd28e626dbd2d8cfa5251cb6
MD5 a44b8f653f5a06c210f6043dfa50710b
SHA1 a3363d11ab3267361052333dc6941f114528ac51
SHA512 70c8cc5b16d82ba7f71c004904ff25db9e667391639c492f57031082be35acfdecd1a9e2c89f77e4b3fcb0a37fcfd6e38ecac380e519306800ad3fd1ad15f2bd
SSDEEP 768:0k2N8l3fMI8lJzK2BwtuM0OmlLOfzjd5cS:V2svMFzK5uqy6fz55F
TLSH
T176C2F2F950D14E8C946224EA600DF996336ED24FA874CB361F6ABEFC9248534B6C44F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 31KB
SHA256 a258dcaa34219a6253250fd12bd905eb92d8faf13288b909af829d53945a8e86
MD5 c229b974a1531c851b4bb7c133930dc0
SHA1 7fb9eed0376d3812c03174d5fe740dea3e1f5249
SHA512 ea267a9005fedbbf2ef9d4137f580451ea13449ef6bd84f5685194d2cc054d7c256758d3cf3ba868ba0ec77197509ca32931af4fbd82bbd38b2249c54ee22cf6
SSDEEP 768:yMpfRDTUuuCnzekb80O5Q1ul718L1fBzrPFCW4l0sXtDkk:yMpfR+Cnzek80O5T7I1fBn9Cbl04Ck
TLSH
T163E2F26A379BF03082C70CA379D7A5C2B11174B8DCFDD176581C599D24E86B3971AE0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 102KB
SHA256 68507cd63ba31b475df24e72126efa6f876ed08070edf9bc061370fa6d6236a1
MD5 9508051a8da5e63b0edf77fed708dbe7
SHA1 10b32bfae836baa1864152846e198fdd31e55001
SHA512 b8401dcb41ef9b0f70d9d00342349dfbe6a2218c5cc88335abac5a62360d0f0d44fa2381d82042dd0718036312903e605429ca8b57012aa74a04b02ee724f5a6
SSDEEP 3072:AC7MlsaVxw3ki4EEx1cWGSiAvi1ItUkzYdJ+oTK:j4Wa8Uzhx1/PiAvi1ouW
TLSH
T1CAA312330FAE5186C5E66D5C5F47ACBAA0C23C35254A655E2818CE39BE56728EF41C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 120KB
SHA256 8154ac8083cb8720f5aae6da3c066c6849b257f5591af5c37735f223d36299bb
MD5 fec51229481e6da6c5d4d1e2383b6110
SHA1 b1041275cb31c343eeb10252704e3ea5b6e51d4e
SHA512 ee002db8b6724c48a7c1cabdc37b0b0ab43b3bc2e2a969fedb73f6ad1536f22c8214ee52c44a35468996cc056afdd43f9adc08659b91a4ec79b8eba0f4dd30ce
SSDEEP 3072:caB8pxfHRafJtyyn5uBQPkZhPNnktAhERv68:cYMxfHwF5uBQPk/91hERvf
TLSH
T1EEC3126CAACF2394E2CD113417D2AD183AEE44668B144D7AAC55F82CD8F67F314DA077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 45KB
SHA256 983792d4dfd6b6b12fec6bbce8a84899791bc1313bd013bb04f676263b679170
MD5 c8e4c6f36ea06324798a818de3ebe51f
SHA1 edc9345d3b88ece244fb417dcf6b66baf76f6e77
SHA512 9860e84790129898b87c78d7a53793989060b2e3686f6af878643a7299b2cb91697dd9cf860dacf92b935fa25b0a84b339b9e453e5a6b01d5c92eea3b1a018da
SSDEEP 768:LA0PVKH1+lSnPlgJsaOl+X/zuR8HFzO/Se7PUaDCuLuT8Y+nPn1qcdu6clyez5k:dKH1+o1U/zxzO/tAuLur+nPn15hcse1k
TLSH
T182230156ED8383F9AC42435FCE2146B224EA4AF3F047849A3040B7529F3413B7E2BB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 247KB
SHA256 c209d08247c1d8b19f781882aa5f13d6c1182f0aaf8f50794cc2af975769e0a6
MD5 4c704f5edc63733c5711074ddc6613f8
SHA1 62ad38563492029fe2ef350fd4594469ed0892f2
SHA512 190ab5e9465b583e9f252950e7de6da867e145cdfce30ecfed3910d535cf7c5728a4d1f253b0a1cbeba6aa5bc9632213a1be969e9a2dfc5a8ea699a111344fc8
SSDEEP 6144:E72H7HHlxEJ4CUTb7e465ALScvZ7KawhP2P:E6nl2JPiakSUZ7p2o
TLSH
T1264423080EEB4997F21E86F7178CD2E43665A458B23D80E79F8E99BD9439C30C6DB507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 629KB
SHA256 67c377e1775171eebcc5b2f6a1d21ddd8dd2e28a55fddf0a8903600571d066f1
MD5 378e217ce591fa46b29dc60838a90f17
SHA1 0db9313f31b558cb1745b5dd1831b4bab601154d
SHA512 f55d776975e4f19c403b0803e4c2ab30bb88b2b1341f8b23d5b1dccd80baaa22eb28e380b3abb04db0ec65a0e4e6aa8efd88857c8b5968b959f6a6ef4566c4a7
SSDEEP 12288:zecBhoJcS+sXH7oR8AtkEZAurz8iaMlqWymzDPjxZto:pUeMI8lEGOy6DP9ZO
TLSH
T13BD4237B1B309142B56EFC916CB7FBB8016B92EA367A07955600F4B104E518FF688D3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 102KB
SHA256 20bce100e19acab922d5019ee55c6dca965b584b716e0e3479990bb99ca89aef
MD5 b1709ab341a9f5db44ed9465436bc4ac
SHA1 e73cb80f1b8c48e73d5462ae52151e74c27a7c6e
SHA512 1ea8b7c2b8f28c18586bd5ca6ee86f437e96e6fa9565fba0267b98b5f607abaf65693f8e82ab13a3df8acd633e61d484f1168c6d4f9714a73484cf1f89acba1a
SSDEEP 3072:jhXnN+PbqorsZ/TbKgqOphtIpiVNvTHSrl4PDBrNaa:9napsl6w+i7vT0l4bBrNaa
TLSH
T19DA3124E98E55B22E8C15D84CD2936E2E48FC9AE5794A0EF345DA6DF880E074C8B148A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 20KB
SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
MD5 2af2be0651a488d15f87aadbee775f4b
SHA1 6da37d1d9fd929a8c79ce771dc565d2f554e9d9d
SHA512 d532f7200f9655de22309bff4d2676a1c72c7d04ef5e50e66c4c9de71f4ff835bb8ff82066014fcdb21d88ce04a43f96e7e4260fd651f47736cb7e365ad25651
SSDEEP 384:R+ouqO6S2dxUPYYchyHCYfJFLI4+i+Qzrao5atCv5+JQ9TU2M:RtuedxXDfIFLI4xlz2catCvMJQy2M
TLSH
T14A92D06ECFAED5241F5B1ADD5ECC2AD9066AE5DD6CBE53C7AB723270D9C0D408809230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 36KB
SHA256 d881a7861279ea1fcdf0b4030c1714c7ed4c2e1560990051bae800df70fbcb1b
MD5 ee35337a988f3d4ded861c1bfd1687de
SHA1 55496798b91d93c2ac45a55dc7c194056ce76b0a
SHA512 c2f60f6bc419ea5e13b33d0d7250de4379dca4d4c04684bb5480573fb936e6cbd956097d7ca53bb1bf79c9768a700f697651c36c6f950012680adfe9954fbe52
SSDEEP 768:SMGRvHUpv2pHlsrbt2EtaB5AddPks6en+5GfL:SMavH82pi2fAPkdWzfL
TLSH
T192F2E143563A60B7EB127A7F0F673D534498A1F9CC2B35426E3B660E879633CCE60158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 71KB
SHA256 d40ca516a00f4b6ae9937cf0eaa8e1f0c2033aaf783dae3c461d68b8b142bc4e
MD5 8f850aaafc8da0df7f8f0a0b682a934b
SHA1 ef55df2e866abed76fe19b05ceb51c1147a6961f
SHA512 15160500824282d1e829908670dc7405abeb4d571ffdcf94532f55294fce77552c832f27fc14b91141ffd2aa142c441fd8e48df8e43cdbfe9283a043da2460dd
SSDEEP 1536:m4kLBYkMICj9ZBz3ff3Vpsrc6gy86ywUOWo3xmWVNKz/8A7yWuBKZS4PHS:elsr9Lrf3VGQ88hLoxPq/N7y0ZS4Py
TLSH
T14573F15242B8D90C1F6550E30BAA1EF1CD6B18CB94D4A0CCE8C7EF9DD259EAB4D66880
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 16KB
SHA256 ebcc0081f9761bb207ec35209d268f723a058c168013f15b1a401c92e25934ec
MD5 2cf8c574a39ccdb4eff91446c82eed65
SHA1 fd9cfeb4c4bcb34e2f40faab486d5d17c14943cf
SHA512 4b2d9d53e1543f0a35f64334440c311102e5a89cd95ed67fa936c0c1b1a62086abd95ca66fd89332da8ed292313718a9146b0c6505e6a750dbb7b8809653d8a5
SSDEEP 384:/TUjwI1S6QqeYhffUZ91ICdZ6ea3mm39WRUW+bXfdl2taEm4WhkXi:/bI5QRtHTdjat39rW+blVEiKi
TLSH
T14572E0F9572D2BA317C97E2D311CE53B22E70132466A00BB9EB96794BF14081D5E5C35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 24KB
SHA256 520cfb8422380de23f7b4d27904174fecee546e4ba94a3af83dc72ec438da50b
MD5 ca75aca6ac637bcb715b5e90c2e87354
SHA1 6cad2921b2f58bd7bd9922baa9676e772cf88618
SHA512 bf974c13db7a356ce076958d06c8ae2f649147b98db65236c841f0fee2a031fbedd5f876b5ecec208f7d62e7ff599cb815671bd7342b2f796b5c84fa5a6c5eaa
SSDEEP 384:lPqEsBlhy1mGdz+OaO5tnLLgySy0eVAa4vw/5eB70FIq1mFBP0/oxTGc+HoHiD64:lqEsDhyvzD3/SHePEBAG3PkoxTGcg6gZ
TLSH
T1B1B2E0DF24DC8761660785E78134A2034CA4A60A1A9BB6CCAFFD087D35C58692F4273F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 16KB
SHA256 71560d451ec7c26865bd311c2dd866bd589cd7c8db7249bb4da38c88c95f79ea
MD5 8de2c6a1051f2d87f605d228d8e1cd2c
SHA1 a4a4c16de77d2f9ba598dfc2d5e4584cf32a5c86
SHA512 1f9552e220916772403307b0c98256dbf404d7aa20c00c11422e27cc78fa5d1edfe69e6e0abca3bf927dc57961a23747a8ee6027343f639c5a307d5bad797808
SSDEEP 384:qGid/SMAinz9Hh+YYkmIoXOS0wFrqDSc59Zr4gdwnqcZn7DQf:qPd/SCnz9cAo+T1HZrldpOn7DQf
TLSH
T1F472D09D0C6E5D6AAA382158A0EF175F56120D32047379AB43CF9CACB531AB258FBA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 26KB
SHA256 9274ca76283e4e6873ac01c6c7bfffffe1a58adff5bf9b4adef8970c3a2d9cda
MD5 115dc505480e130338e185b54c09505d
SHA1 8b732d066adc398cdb1349c262c33fff5d94ab7d
SHA512 a071885ceeeb08079ddf5a6b94c75bb5ef94b086543a4e4571a0f9840ba1279fcc10474afba8054a22c79c35074981f2e73a6f658e9a851853cd0299271be04c
SSDEEP 768:smoz6addNjBEBNpTyqLcm5JcIoewhmrz/5n6l+w3:Fo6adfCIbm5JRjg05nk+2
TLSH
T12CC2F12891DD3FC269D886D43AAD7F907FF8941C0D12A92A1D8E50CEB86CC8E821F540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 33KB
SHA256 003a8b63c9b20dd1e4383cbc6f8c210988e5f58651e0103d73320147b51b0889
MD5 32483d68eb9c3d6d16afade95a9bfd2e
SHA1 169fc19f95bb16c5695718dd5e231e1f956700fb
SHA512 3f3d5d90a1d454360831b2734b64b093134124082ab1c119eb2b96be95723d17d6d0f5899c2bb9d5b3b07bd130086cfc0156b4cf1ee0c7dd8e462d85e5f87a88
SSDEEP 768:i5Q9NksiHnec0zHLLRnCL8+l3ppvvBlAqZc:iK9NfMecArBL+l3p5vBlAqZc
TLSH
T188E20260A94BF3994A65DFBD10944724B891B3CD1BDA8F4DBC48268112FCD37C6C1BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 34KB
SHA256 4f4a3f662b229952b0260e81dfb9a2257010fd60344f3c34f3f42240eb884132
MD5 ca6914af3580a2fd20ba5ee7e0c23355
SHA1 654b96c264b40d483b654e03f629f35f768c575e
SHA512 5bf62ce5fb5003ecb3238873f72a76c7222cdfcdf4fd70c0514cee0531281fe54c99bbe68af8a56986b68be5f8cb6e2114a9d7d7ade04ac9299bc33af8039114
SSDEEP 768:SzWqIUHfmwY2OM0j1WvjQ5/8l6sZ6JulPnIq5Eyll9Eb:SzVIU/JY1AY/aRZ6Jul/ECEb
TLSH
T186F2E031865FC3F1412494BF729A4F05AB9078BE6B0D44917B4DBEC976CA6F11349B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 70KB
SHA256 bc73df61a52f45941d4a6809e29d220774cfb596c91be18711d7124c8b9bd9ae
MD5 c9249ccc0127ed836167a53b2a6256e7
SHA1 21e0c446db00eb21f5bccc8dc6e24353d9cdc7e3
SHA512 fb22cce2bafd92b103434374a9580460fe6677ea16550e733410747b4ea5a1b94cccd09d222bdfdda98425bfe10f698b8156618af50008f34547274c3f278a78
SSDEEP 1536:5mXx4BtNwCmfBv/qqNcnBl6xtkS1nh/QTtABvSvNssU16mebKwmS/LqGOj0Pa:5mXKBtNPmfBKqsPkzlh1NSskmUm+OoPa
TLSH
T1446302ECDA5116C8EFADA7B13B0D8D4F4BF28B1F6D95546C216487CB83B956A3038603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 53KB
SHA256 c7e07b8a27f9d84d4fd89b3a85bc363ad558e1de16529c43cdd3a4382e81f629
MD5 47596f99f1e08c9d1194c1b90fe52f89
SHA1 6adeaccb5757ceaa625f90472075190d1c817649
SHA512 f09e1150de66bab0baf2f48705711edfd9ddddfce57df16ef5029b6a0da9636bc35c4835b0d21661a706c9412565cd3f4ecb8263cb6eef271cd078868d3c5f4f
SSDEEP 1536:pEOT9DcBdhrD2mZaw3FWelcj1GWm1JZg3:pEYcnhGRCFWUcj1Tm1vg
TLSH
T150430286D925078ABA986AB1835C954DE3FF6501E49CF8F1E1EF71C006EC6B1F69A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 70KB
SHA256 11edf2f1a83f8b87a60773a69d9fb0b76e2ffd30f0ff5702e3a57d7ffbb15b2c
MD5 c71760100e25aaedf3d8c31af82443f2
SHA1 e4dab61a9df68c5ae37b1259e7eae94c4d1e087c
SHA512 612c8758b35d20a0553663885ffd152175d6613a639586084876dad8ef716001343e2b77c46642e2221c2557e7d13a37992bd4b85218cdd82a3920c41880b5ab
SSDEEP 1536:EHOXaYMfQlrHpI55GaPvSG37qDZGe8xT856GfMLhR2:EuXavfQ3AGanSWGtG5xT8nfaL2
TLSH
T19F631272FDC12061F20CF1C4AE36DDB06DDACBB91E5632383446BA86CA5F5377284998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4
Size 69KB
SHA256 099939ff1bb543386e25375e207b2d10ff38a220bd0448e9bcc8c6a84eb74fb5
MD5 5731229f930bc6037797e9285aa24ec9
SHA1 b6e000881e99bb3207bf21f260a47715f9c3567b
SHA512 cf642aa0b7d7ec6ef67fb001a90431d97b0e04a227809760edeb6f89785b8d4ed6616d5c6e78420383af33176c2f762879b6b8224b6f17133f33daa92d89fd0c
SSDEEP 1536:T9cRypqfnVzB08NLLPUCTPXLi8oFMU0yeczzjCuN2LKGJ1u/yijpkMSg32pzlUm:T9cdnVt0qLTPXm800yeczlULlu/yiSMS
TLSH
T1576302836AA6CEC6F22753B2EFADE28C599E81E40152245BB4C59F7400760660223FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 79KB
SHA256 52f916199796a82741703a09cf0a6e8d9c980d6cb699018bef10b724abea61b0
MD5 813eb43660b19b3a6179510771f78729
SHA1 66c77339f88600eba38701bf0250457d921ecf33
SHA512 bef492248fb3718069226a03c558cbba3e6a2668d1cfab61e4d8cdc6330df70542874ad94dd82513536d096ba76d8b6611a9bcd58c47aad703d48110ef1a9e4f
SSDEEP 1536:JtwNPyz1NHqIWtZMJCo8eZD0VSH53/Z7gFnVK0sKWFLPqq0s3Za:JCtW1ttJD5ZDLh7gbK0Q1B3Za
TLSH
T1F78312112D46AAFA2622C6C3D3DA8D471CD97CC77E535F113679F014EF826A04C68CDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
Size 113KB
SHA256 8a79f571cfa79af36b7e002a937bf1a9b6d08a6af5d999c206139a5a2d783995
MD5 24f020ad862c69da42baeb62466e6ddd
SHA1 2a5585a5f3c2d3581b89edd08497698675512b69
SHA512 89f8a4c29c9d172229938ca7f157b7f90d989ea5d7169d924e652c28077253e6cf0d09c4c0a49a2b8430462429b896dcbafee26cbc5d2086d56f5dc13fe34279
SSDEEP 3072:in2Rnl2w6e5jnHJIBPsV7K/JPlyjlvVDFUOCeJHXHAZ:HnspgWBPwKhP8DmOCepAZ
TLSH
T1C9B31293C31B7942E989FA5923347EA806EB4389A3B2F80D99D5C7582EE410463EFD45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 85KB
SHA256 72b48d1c17bc225f8a35f4d08851baabaf49cca6f9bed60dd1200b9c0d994596
MD5 fcc8e8594cbc6741721be7b2b953e290
SHA1 1b48a35dd2d5ee4679fe5279edccbfa22e6d9e1d
SHA512 a6a74f4bd0a2f114ba14fd92bda886f0a632df07bc0636b042af881589c2b612d160d2e326d0b604429d92f4063ae50dce5f6ad35b594d20ff335ecbff020f82
SSDEEP 1536:vKACpZq1jyrDt8PtKbilCMLsx+2gNOw+NzQ5izHj1H9NESmfWu2gsy7u39:vdRyrhKKbigasx+2mQNzQ5kHtNmfdls1
TLSH
T157831260C59E6790374200C950AB85372FF39C82DEF7658600F79F593AE1EA1625FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 40KB
SHA256 6062486149197dfa7619ff768b4ff16f6ac3e93a03bc3322d3169bc0a15ebb7b
MD5 f54063639f91ad08e06d44f5c23c787a
SHA1 c683f68c1c5bc89e5bd78758bfd792ce176f15f6
SHA512 1d0d759ac5ce3bce3a971ad43e9c39827b06c3054423182a85c242d102fad48af48fa7ad0a870c5c4948f92f1d3bc2a7df1ddf43eadcbf18309ddace1d00bd60
SSDEEP 768:PQfxXtAdYNMow7kr6IANeOHzc/D44oBT2DG5PS9IbrBBA5on:PQfxrMow7eoeEQJG2DGE6A5on
TLSH
T1761302AB634E074DF0A5897085C91DA4F54C2C694CF2019742FA83816567FF26D1EBAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 30KB
SHA256 d6b1d20f2e189c40581d06dd8138e6a22ebae6e8d04d5f4941cac6d915818eb9
MD5 ee8974cc54f5746983b21a0b536820ca
SHA1 90b38d1772ed4b0c2aaa9140945e0a565ea94df2
SHA512 5bbc3b023aa850632b6f98f1083c193318597b3bd44c84b171aeab727893bb90e78e769701cd8c8de9f6edbfc54dc702e9995c6f5a06b4c3b32ea1e6e625d00b
SSDEEP 768:Mpm0DNOkYHm6x389lkiu+zC6+W93GIZJF402daWBn:MpZNIHm6x302iXz9+aL7FbNW5
TLSH
T1EBE2E1ED78602BD8745CD2561267BEF243D58C8E392818FFE2D65A248C1633A154F8DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 17KB
SHA256 462dd61dc192017ff8defd5ff13b8287eb2f2f1c698a64222c140f29be944142
MD5 92408587c82a55b068e8212658d4b2ca
SHA1 ab9f7e2afb3bce7c8222d6505dbb3a3c07fd041b
SHA512 53ea54a0d01103235da30ec74651b943577e13d1b365d6f9a7988e242e132fa524945afa37fa6f7178c05fd42aa5c34f2628c88d4cd8dad4bb81c922033e10e5
SSDEEP 384:8d86mQaBoavEBjxHSiQKanZjtijAhPYPFTuuxzHilLLKUFLJZwQssnA:8G6mQaaXBNyiRaZjcAF2FTuu5Cj97bBA
TLSH
T17D82D0AB2C95034C06D1BFC34E8F96E23055D37620E5B99E896159D52F5307C9C62F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 39KB
SHA256 9bac2d0c95117c1e92351897b0548cc184941c6b9edffce4510542d443e87ebe
MD5 1b209d91d43bfd6f0ecfa323b8e60d94
SHA1 b655acfb6b7cf3be4c131db396b37d85b6753170
SHA512 c986f8a844e6b60db3a8f124799c19b9e5c76362066742ccd8710da4ac6ba6dfe445b0e092524f165f5bdeca75e725a3564868d3f95ee03b2e63178963e5838f
SSDEEP 768:hUiw8NR6+YM+0eMTIXRPbDujqLq+i/UzvnIK0BjBP7KfgQn5hZ3ek4Uz:qV8NR6BMVes8RWj9xgvnIQ56k4Uz
TLSH
T13003F1F1AEA68E0A043A97239C6E20D46EF2FDC5E05FBA2F57895CD1098F3D0524D132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 45KB
SHA256 44c44c5e9cca81e4e3a8b88e6c45ef531d9ec84d198955739a4e3ca82e76f0f3
MD5 afc7d5b0c3d21def3418a9fc43858f83
SHA1 bf9c629cc33dd8475f36005870ea625624acc7b0
SHA512 04cd55b52af530e7c411b4cddb385a34304cdcaeb84b8b2e9e912f7089a125c61cb52b7966707d9fe74c986034fa6f53b1626eb0caf1f163d6ec9044462fb3f2
SSDEEP 768:zAr5A78yAtyYOzjMPHwIVoveCDn4mSE1NNJi8AlLaTmPXrnr/WPY165c3KfHJqma:8FAZAjOzjMoOy5T13Ji8EaSPjrcMgfW
TLSH
T16123E1975618B5E2D5A97B351AC3718F5F9BC0D884EB22CA258B604BE0D0CF791860EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e1
Size 350KB
SHA256 9213695e49135b2b4210878deefb3175bda171b6b435beac015f402684e5ddd0
MD5 ec8b9b0c9f3c90635368e649421dfa07
SHA1 abe7ca6128a3b1b393c902eff3ed39605279cd9f
SHA512 2072062f4ed9d3a5f4d69ed6fa79c52c12336147b03b9e0258a61cfb7efa411ec230fc8c28f2dca7bb8253bc48ecfbc51a06083ae5433962dd0f85a56f96acb0
SSDEEP 6144:VatIoleCgd8D9UZrUqr3NI5bwvb8PgMvlYeUyPWzDL80niVq03XfEt:gl3G8DWiqru5bU2yeUueL80mXfy
TLSH
T132742317566A63A822A9DCAAFFF31F02D4EDC23150ACC45B412653BCD64E6933538F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e4
Size 41KB
SHA256 504dae855be151f01ff5f0c36f628d136a3c742200a48c662f2af5bba1b8e6ce
MD5 24969bf67bf2d80cc21e9f5576384261
SHA1 735f4170613250382641d7beaacaafee63bf2c9a
SHA512 b3a4f2b77bffa695d536bb9b322d7152c85e2ce12ae9b37cf0fcf95b889d05bbb9e837ae91403340dd20a020541ffc46dd3a6d0f1ec58fa8d8937103bf8320de
SSDEEP 768:umYcJbJbpd3ek5xS+dOLJdsFo04VBdf1Cn0pAZVJvJV/o8nKHucmR0k6:uw9Tewo+dyJuFo0mtT2ZLJ9o8nCucmS9
TLSH
T1F6130242B1C3070B1C6E082489F995ED885E790AD11A72D34BB6EB7D5DCF313B285CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 21c73cd6cf21670b4a7a98aa5af3c1650d0ad100c3312786f4cf0cc4b879121b
MD5 f572426822fd4f3299b47ab3e86a84aa
SHA1 f407a96c7d06696cc9bbb90f5f3cd91c04e59048
SHA512 095b47f296df77a59b19714ca906fe5191fddf6e8058ec16df2e04e13418292cbd71dd06c9b9529c80a34d4371c5a89fe92745883b04dd7be9b98e155b5c537d
SSDEEP 192:bpWxUEqr2sjnZFW/dId37XnLuuT7Q7AwTPI+4h3UKXnKbiFlD9tIh0fgY4csG2rW:bpWxUEqr2EZQdIV7XnLu0Q7AwTPI+4qs
TLSH
T144F1FCCDB1A91164FB74BA3F26CA1CC6B33CC4D4AE9B9F225570D5BA5493390FA0414E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 902a1b4e6a3135805a4a529387effcd75bc99e070a44c8fcdbba15ddce85690b
MD5 df086fc3b7d529992f872b592f884cd6
SHA1 2d1afa3326a751d8a957f0ea151acab54239b5c0
SHA512 ffe8c90d2b97e8af733062876ff3e1c7fae189803e154f1b88eec80929bfe20565d22c12ca20627646fac53537d0d36b7c4e04a7a66dad51fa9b4674b852f0c0
SSDEEP 192:mpWOxEqUsjRZFW/dzd3PbnduDTuQ7ww9PI+MT0/XFKbiUDUtIh0uY4csG2RVKqaW:mpWOxEqUOZQdzVPbnduGQ7ww9PI+MsE3
TLSH
T1BFE10B8DB5A91124FB78B67F26C61CC6B33CC4D89EDB9F129970D5B25493380BB0818E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c1ffd1294a3de6ca00b4ba848abd13f6af6d47e923afecbda0e61ffeb02a413
MD5 f3a92f66cd556239af26f126677c3e61
SHA1 106e8d4eaa60618ccc07b7b517a84c9d619cb5db
SHA512 acb0c3b11bd253e949c35d68464dd2fef105934138ca7cec8cf2e34b51e75751c84e4dee813dc048d9b2768bf4ec3b8402630e9d8dadc24927e6f4f667f548ac
TLSH
T14561A34DD2AC8574FB68003F77D500EBF33089E04CCFDE429CA4C83A9846B149A082CE
MD5 SHA1 SHA512 TLSH

Submit Download

cab2e17c-babf-46c5-b8b0-132f9e3e8dfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cab2e17c-babf-46c5-b8b0-132f9e3e8dfe.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 383B
SHA256 9df43b871ed60950df5aa390da89216a0291fb143e3110e81dc14d351ddd5dde
MD5 4e88f6393e88a2890d7fd6f96a58203d
SHA1 aec2f899ae4ace5df47715caf12e6927df04238b
SHA512 897f03fd75ab80277e9802fc8366903b8762216247448335293e6544ce44ae6e8d2015351d81bb4fc14732a8fb91a9498d9988ec57e20dad8b8856ecf124238b
TLSH
T1C1E092BD46CEC21FA16828D75178BF4996F33A1B97C86E851B0CCD54F442540B66E1E0
MD5 SHA1 SHA512 TLSH

Submit Download

3249daef-8568-433c-9a9d-1ce11afd7316.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3249daef-8568-433c-9a9d-1ce11afd7316.tmp
Size 14KB
SHA256 b286b0bfa95af4478d10ee1d740c696aa5dafcb31e25ab957677934efa6640dd
MD5 a4c88e187590fc9daa60825d7fac5d24
SHA1 d8b05f707025f533e0ea37585895b31b144558b1
SHA512 c88f9a76c70639e49647d7c243fce5f341756186743231b113af788b68992f330c390c8fbd32ace3e1da091e6a787b0da0d857467ffd6d4a447f1c1c883a0c81
SSDEEP 384:DNDOCajxTzX9KpjAwZuQ81YAT2zPdfeVOcsSPNhYLONTe/win6AimhvTLGhVFom9:coev
TLSH
T1BE629EF3C3E5C66DC81126F15F287E1BCE5E091952283D6789E4EF4B63E2072E25168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47b2f1dd-51f1-4798-890f-7338032805df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\47b2f1dd-51f1-4798-890f-7338032805df.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

6dfae94f-c32e-4a6d-ae0a-fca063c852cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6dfae94f-c32e-4a6d-ae0a-fca063c852cf.tmp
Size 210B
SHA256 abe6fe65f955f2d0ebb0e22827b845636edf09cc97406caac31a450320b96d9b
MD5 f38508c6483be4306c169225f27c94be
SHA1 5b8397f75ba860ce21e7551daa41f3b1236bc116
SHA512 161f81eb0dfe30a672e2b5972b10ec90f3ab9f11fb5f0289fa77544fee988a23a3f13a05a456987adedd995aad6cffce6ace0906bd2833d7b12821d9f2d2ebec
TLSH
T150D0231331017171813D256631179C4FD7611027080AD1D4D4A09E5C27B5C7D15072C5
MD5 SHA1 SHA512 TLSH

Submit Download

948095eb-98ab-4207-8551-89c935584dac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\948095eb-98ab-4207-8551-89c935584dac.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\317fdcb1-bb83-4d96-a759-3505e05eec40\index-dir\temp-index
Size 72B
SHA256 2b73c4e02aa0936908ee2c79bc5457e50b8fe76717ea609851ffb0c4f13158f1
MD5 112c9303072f115dedc03b38351c90b5
SHA1 3cc308341d6305532e25e8f98bad562c1b76ec41
SHA512 f497d05706719d119f3965c9eb88394a2baec2ce81cb5b11f5dadb53f6ace43200c4fcfb245b005525b2df94d9bf9e8ec4a113161d4d0c9e64da6f0c14cec043
TLSH
T1CFA0026472420C46DC34167060C64150331CCA7182115B03C8F84574ACD85DD9F020D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\317fdcb1-bb83-4d96-a759-3505e05eec40\index-dir\the-real-index
Size 48B
SHA256 e404b2ec0ea5a49660367dc9c9a6ec5e039d1c5b2fbbc13cc8b388dc45e15a13
MD5 0dc648c8b246d7adde383bb566610a51
SHA1 15fe5ce9f6e66c414d2559d2492ea23f65d607dd
SHA512 07ec5e38ec0f01dad1683a35200bf5c15f153e9a2656f5f961fb781478625abe75ca82fd3084e09d4ffe118fd1f6ed9afaba6a92f703c563f31064800ba9b0d6
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bf03c1fd-1067-4555-8633-25e9339a5e01\index-dir\temp-index
Size 72B
SHA256 cc241374503236f65549090a9e4ebdd7d9de1f6b8007bc2bf256155cec95b75a
MD5 8bd3681839c6992ec632fc5dc241ab1a
SHA1 559f693048744c6b914ed7da61cafd726a9926f3
SHA512 3fb75d59b3ccb9bf58ed099cb0d1a1f186345b9971b89154207162782ee97632a40e64adaf07f4d3f548f0d5905d366f59bf89b94e6077f44e127df477c5cfbc
TLSH
T113A002301AA03115D55D12B1314155C436B45D200755C341E4ED14B49ED62C15542101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bf03c1fd-1067-4555-8633-25e9339a5e01\index-dir\the-real-index
Size 48B
SHA256 cf07ef00b84e74b653b2948dedd203ef2b7698caf1d8bbd22bc3d10906093403
MD5 a3a94f29d32d6cfeb81d0f7ffc410f92
SHA1 ee55e096def97077d286b6745a4f94b3a8727443
SHA512 3193cd4f7c10aee364999685f4e7947e318767858b9009102983967951c0a809f8bcb503cf64f5e0451b3e5f6cf6323af54644cd13d053c65fc8f5597e0649d7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 1KB
SHA256 f98c7f7fd4835b1e71fbc5698c3f3f8471fd48991d42dcfa6c0b21fc6fbed177
MD5 8a45897095c66b0205a5d4c6eab08d97
SHA1 e430ca555fec72f1f2a58e4b421f15829149d660
SHA512 d2d8646e99ef0768ea2f09e18b80f54e12f80e6a6c91e1c284a625f2fbc6fb533891118faf903fb197a355ac4548adbb0f001ca3b9edc1fa6f57ac8588640efb
TLSH
T15831631745524B67F884227209AD549B333AE58843853B0F92EAE139ECC1B44AD9EDE8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fe4bf935-be50-4740-9698-929a47d93aa9\index-dir\temp-index
Size 2KB
SHA256 848aadf15acb4e41d8aa1cda6055c06743c05a7e522e074cd9a5ae4e0fc5ff88
MD5 d5f4571672844178c363db457cb84bb2
SHA1 534fd2d0fee5eba6f75810486942848301236c1c
SHA512 ad715aabcb9d3ea1889082015ac735f0328195add6eeefd82edbd1a7d33f292292ec63dfad3e3d5d4f6120a6082864e89f21f13f9fe0af26a9a0e425b254e765
TLSH
T1CF51D64C5C025761C86812F129F609C02B7808DD5FA40A1398EC8138B483AAD298A7BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fe4bf935-be50-4740-9698-929a47d93aa9\index-dir\the-real-index
Size 48B
SHA256 f1c74e925f50dc0ff711ab3397638dffc2b01018a37fa944e7220837b0ad7fa5
MD5 824a4b12df9db1857ecd6ca3c566c280
SHA1 343e691a533d50e20915ae79453f8901289e838d
SHA512 14eda9f16798d35c44ec4ca2ea5ab09daf4d7ef1fa205baa6296527d4f74f6e194809bfb0c16c4b747081528dddb126ba6cd306a35a6e2e1145df5df4c5645a4
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 259B
SHA256 328ed0cdc320d9dd09d04bddee44053ff3a0fb91e72ed05894648467863ae7e5
MD5 44f9ad2339ed441abd088d8901cc9b65
SHA1 067d943eb409ab65d003876457cfaee54dd86428
SHA512 87f8f270d021c0103d3b02aaf3303656166f61e7acf2970ce85c5d9ef2074ad4c1597df892b855503d32665222b825d6d1aa3809c49d1faf90c3acdfbeea06b4
TLSH
T1DBD02BF32EE62500F54793C5283004A54306788C8910AE4F501F55C391612907445C25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 161B
SHA256 1a88fefcfb3f425ceda821d21af96d221e282d5ddaba301613cc63017b3505c2
MD5 7aec65fe53ff82e9b655debf6afcc688
SHA1 0d3508b328987f97ca4eb790907e1c533c69e7da
SHA512 d1c248b45fb3b53db2474b7896e7fa1e4db8d894150fe2850d8c8b20e6af21e107e7223ab03b5568433d528e0b28d3a1d64adb86e129b6bd49e8f3862a5488a6
TLSH
T1DAC08CF71CE82400FA4A92D2A92020EA831A398D8E50AE89802F8AC361602A03861C79
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 394B
SHA256 e527df3bdb36819165ac507053d76efd5410f97a8368d5a8e97cdd36d70228a0
MD5 b9487fe232e7b9e2f5f41f783438ce8a
SHA1 1d24f28df7f4a4725da84cbac0ca4f872d773fee
SHA512 92790601d6a7d8907cfd19bf959544dba437ff18ad83cb374827a2a7144cb1176828f94a1b8d9afcf4cb6cd0af90c7876eb3bb0b09b1937226045d2bc7f93d69
TLSH
T10EE022B31FF20801BA0AE2E9653210BB4212BC5DCE90DE0E104A5A6352B12AC3518C72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 b199ba98bb5648311d3a7dd2ad45d4ffcae4e97448d1b393576f56e5ff2c3a87
MD5 f9c5d537ce95af11ed595cb433c73996
SHA1 b273ef82b41e8e0d9ff8d52db03d347363bc559b
SHA512 f1aa037d6adb4aa920c37936457af40a5be67c264d76445b3b108e11f6d41b3dd616090d4b97bcfd2b85fe63983a411a9015d756adccd4d1e8a30e8d9e18d023
TLSH
T1AEF097B32EF32414E94F43E3243044A90105BC28CE00AD8F102B7583A2B13897919C26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 386B
SHA256 f89a4fdda3c33e3a38c1123bc3c5c8885a66d406e410fef96ee7655974a4269e
MD5 b32b7ac66d73e366dd1f8a1440c65587
SHA1 eb11cd2a943adf52a34c3f4a163f6d198fcd5ff4
SHA512 2844558ff470be23989ef12c8ce6d74f1d20b6535db01c37a6eef90aed16b57c6dcfce1a3cd0d5fdfae14bc82e015bcf486cf09eea77f2f98b5411ef457f3ab7
TLSH
T1A8E068B72FE73810E9DB93D6293004A54209B968CD00EE4F201F96C3A1B1388349AC2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 281B
SHA256 92928c7d0a98e4848d0a09f399625683375ed9c95cca6946ea3de2325d70c506
MD5 4113a85e977047a44363fc0e06e58fac
SHA1 919a5fbeb2a690c42795ca5e1e517308b4dc8cc3
SHA512 1bad73db8b6fc17996593039559f7cb526b1256feed3f7d3c35605106d7f5dfd7f1202fb74490bea875477c240c3ec494e4289f5289c7e610919c44d6c3f01d1
TLSH
T19AD0C2B31DF11800A60AD2E2543100AA42117D5D9E019D4A505A7A9321711A87559C32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 399B
SHA256 c9b5df98f4916ed743fefff69a99ab30ad20c0fd8059b49b8f6001fec5c8bc3a
MD5 5d9bd78adea274c4c2d9339165e1d510
SHA1 69687a396334fbf56a8980f131113c6ae7c081d2
SHA512 425581cd82199992a24395ffb9bd6ef4efa1acc67cd593482e624de23f183d16ebc9d5494c889f8176da60287e0b15de40b6f9cc53f8075bd827579f4b3b4f2b
TLSH
T1DDE068B31FF10C01FA0FD2E6653110BB4212BC5DCE40DE0E104A7A5762F12B87618C62
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 134KB
SHA256 c390d345f0a8b7266ab3f2a2f9381073e3b57587f97521a519152f7c71e66d6f
MD5 c469751a7714f3d8f0662743f0b069a0
SHA1 47f77e963d77289a86170e19e6a21b78c81ac17b
SHA512 0d483e8fa73860e7c652fb67f2cb91027032c64ac385e6c69e118ae4c87bde62702957ce11dd4f29fc71336b39af9547f8b3bfe7ab4ad554d7145c667a780ac2
SSDEEP 3072:y2egbeWM9sRxPCa17S69wKzorZ1JUfC1Gs9:ycbeW/S69wKzorldf9
TLSH
T195D35157D1F8D963BF6B4453E4852A82B32C3007F619DAE1F987BBE0101E62A35B5C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 96B
SHA256 0d2127cf90b63f23d589eeb0b776808653780c42431219485b0a5eed419c75bf
MD5 6c89dbe2dc173c471a84a3d12b320e7a
SHA1 1ba59a1ea4a96700dbcbb68f0c87f33845c3b9c5
SHA512 8a59c49ff8ea64c089fbc70b7cd58a4991ad5b066c084d49587cdae49e966c493fa2e13f1aea81db99f17d27e1f30d5483310e22bedbad80464d02ee3db71692
TLSH
T186B02280A8000282FCF0B3F8CC800C88BB3CECB02F0B3222A0FCA030F02228032A300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 6c61d8e9d85e365611673b3a9a5da92b686f91361f7f96e1259cdaaab5607e46
MD5 d9185ff62051e27520adb1f04c970d69
SHA1 e4694406a997e9650504030a70bc5f124327cdf5
SHA512 da4a621cf0dff4c1b503223bfcfbf86e5973926246cb8212549cf3d32b3e1f42882c6b8d854503fc29acb717ac672e5d5a991a9b43fd79dc929eb96ccad2dea2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2bd0c9e961f96edf424246bc34c0d97ca895d4ba9a7d05aee218469b843be796
MD5 b71ef2f02449c6ce4fbeb85daf5f9626
SHA1 976dae4bca63c643cb1a40df9085f12803fc8a72
SHA512 31ac160da3ccd93739f034d9250e441d2d3617ec36ce63bf8ac88de5f49877b1b1464d73def4a13b1ca73b5b681ce1bda857291c6aef594234249c74df875e6e
SSDEEP 48:K0Q/26gK+/b2NWISS/K9u10/xIvY1mOUyLL5LILVLpLzL3LLLkbL3LSLPISLBLkn:KgHyKoUW6KgKPKUYAK9KSt
TLSH
T193910F1672BB4341397D6E8D4079871B429271B33214E92B7FFD44A5CE6AE144CFE8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a2a83926-f78b-450f-bb2b-891051914e05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a2a83926-f78b-450f-bb2b-891051914e05.tmp
Size 10KB
SHA256 d7f80ef79446c2da1fdf5e9aabcd22f63ca561ef2064fbadbe08415d1d05b875
MD5 483681616ddb661ab411631e03ecdd13
SHA1 c44b654d0c1e30afabd715b3f3a564242d3b2306
SHA512 d71bcc6bb5daeecdc3ab51bc9be4361bd87ffefc86107ebc6e7afcf6acb9a93c6c694bfb7c5bf05be5a83b9ea1237801b66fca623a8c0b69d212bef82263ae4a
SSDEEP 192:sxZNR+WO/fTsqfIdpeRyFHW6+WNG3VXYgigaNIg5iJ:sxZNDO/fTsqQTHboXAQ
TLSH
T1A822B7926D34A97B9CC7D21DBA25BF13E6F9503291951E48EAFCC61C08E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7141c1d-ad71-4443-af10-573a3c5f5d35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7141c1d-ad71-4443-af10-573a3c5f5d35.tmp
Size 12KB
SHA256 c5c1c25c2c0b92284beee7410cd01b227502609ef386c9b1bf49d66b0c7fb988
MD5 1ffeb648d33130c08a8ae289fe672e32
SHA1 8ce5d8ddff723e842ec2d117386b33794a929560
SHA512 6fde26263165f5c8cc80646c6823e3b978a7e011b67ce1d587fa9806bc669e14ec488504481266c9ac8d8a68528e8c032f99eea50be61eed149739a7dc726c85
SSDEEP 192:sxZNR+MPO/fTsqdVVYvjQdpmYRyFHW6+WNZXtxu33VXYgUgaNIg5iJ:sxZNxPO/fTsqcEKHbZu1X+Q
TLSH
T1A942D8926924697BDCD7D21DBE25BF13E6F9102295911E48EBFCCA1C08E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e029a455-d40e-4571-a6ec-f865047354cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e029a455-d40e-4571-a6ec-f865047354cc.tmp
Size 27KB
SHA256 687b78b6dd2ca7b9087e8f4843aa3e5c8743dbc6486413e02482ef0b9f7edb91
MD5 3697fc3cdff77898aa62080ee90415c5
SHA1 9230c6670efd9d50aa1b25ac5b402c41e32a57d9
SHA512 fd79012864285d58e60c32204c02710296760ac8e57d07ab3804122f3648e6a4f9b70c4dac4f2b1a0a9fccee48555a68c0d222bf4ba03a30ba41b99dcc5f6956
SSDEEP 768:v8ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz8rofOn:v8ichfPWvPZplu1jan+LKgznmn
TLSH
T1FBC2FA7B640CCB7E4FC01A5DDD166F9B7EA802C7AA588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ee4017fa-4e8b-4960-98cc-b94191b98a52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ee4017fa-4e8b-4960-98cc-b94191b98a52.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 f3290bde344c1dca2adb4964adf7ff85859caa6623049cf491457578e920b632
MD5 528eb3ac32349a60e3762d8b2c25ac8d
SHA1 80a81664edd6dcb80ac88a5a1df9823107ce2275
SHA512 1ed13818c225ee8210de08d801e9dc6d0973b85483dc6c5c79f5506859cc1f9582930e9ef3bbdd5b575deb1ab85403b6e999ef7a055ad31c74c4b77c68c64072
SSDEEP 3:MsEllllkEthXllkl2zEgltzGl/:/M/xT02zj
TLSH
T133440404FFC44405C7103030C571D7505371D4540D1177D3345504335DD5D500C50000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4735dd9b8d7ad88a9908bc5104658facb5f4e5e9923dc1d5b2e9ad9e5aebf153
MD5 fe3c7686526cfd5337d5092f6d5bd019
SHA1 5bc625a4d3470ab87ad05c7dfebefe17900d1b3d
SHA512 3a68efbac2dd16f0cb915b148ac000d378d0604e5192bd2cf4d4c1f896f713ff62f68b6a21faab87193731e44d39982b10f87a16e97cf0e2a8a614aaec96aa09
MD5 SHA1 SHA512

Submit Download

bb7aba06-450a-4ff6-b1ec-2c6ab84ec2ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb7aba06-450a-4ff6-b1ec-2c6ab84ec2ee.tmp
Size 392B
SHA256 3adba1195c6120d4c0930f2b66d82acd2e5f65a4890a162150ef7e3522a48814
MD5 7fcc29887adbb02c1d6a67a44c7be526
SHA1 bcd90ca06f1b6d08b9289d9b5c99d4b73b0d9e79
SHA512 aafb996ce20e6f9c3e3b831ce63c53ddb69e74b67419ae7cf51a1866eac82486b0a5a231c8e4ce90a8b8dabfb809cb8b6fbe12ea5f58cc9fda7f6f466bf71460
TLSH
T1FBE00201520055B7C02C037000C32F103A72841403D30205162011685C247002A30D85
MD5 SHA1 SHA512 TLSH

Submit Download

bd32118d-7988-45e2-b755-c5383c827f1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd32118d-7988-45e2-b755-c5383c827f1a.tmp
Size 18KB
SHA256 f36459346642f0280d1886a31cf20354b755ec92b58309f1429ae649c0b1f6de
MD5 5cab97d61e2fca9386c763f2f492c2a0
SHA1 31c5ba23b6ce4a0c3ee9469436e907f5b2c648e1
SHA512 c3923aa2d92d50435da1c51d389541e96df5334b6a1b9c93cc4dc999893f11911f631f60228cff6f5c2d1fe8bae9402f1bcb969516f937bc32b17e786afdba2f
SSDEEP 384:1QkUSv0sNJAO8Oq5XnOBGYX5E78pxa++2z3H7vBE4KIIlU:P0Qpq5YGYu7Wjlz3H75E3Ly
TLSH
T145827DB2A8786C3B0DE3E651F54B3A139EF4911BD6D52B80D9DD5B1C01DF28C234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c587e321-5c62-4dac-94ab-c4bff0068a51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c587e321-5c62-4dac-94ab-c4bff0068a51.tmp
Size 31KB
SHA256 27e1abb1ad692d189dbd68217026a9d4684f8a14f2a0393522d01ad01a7efa8c
MD5 be318d9b109667def63777d200ba5935
SHA1 2445cdaffdd43d09b41d670a5a62b8f7de36346c
SHA512 19b9188d3e9c4c08c3be5c0e278263130a01e8673c8ceb588e40699589a7e6d9796c4dcab5e3b168c6f11f860dab2f8569f3de8eb26f012b4e7f4d7851fabf8d
SSDEEP 768:U6xFg54DwgWpqDnvwGYu7WjladxS2K9aqIH75E3Ly:mqgkJWj8dqIbKG
TLSH
T109E24AE194D35CB6C9AD97C3A77DAD02AABCC037B4445A08B3E5652CEC8B1BFD346811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9492bc0-4b08-4e18-8b96-d1ad6543d370.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9492bc0-4b08-4e18-8b96-d1ad6543d370.tmp
Size 392B
SHA256 d67a24e26afebdfe0d7d0edd265fff871fcf967fba111f7a1db6bedb6064e403
MD5 d485ba11ab3aa27e24e69911553daa8b
SHA1 2f6233af42d92b75e22ab2e55eea38f82c84a53f
SHA512 49cecfb5d8d6fc8108ce88c5ed918a6b2ec656144e6361ef24e0daef2a8128d02b39afbb33d4669e3703801a0e38c5c82b4c2febb60d6058ab2b4741ae831bc3
TLSH
T129E00116E34155BFC03C037240D36D313DF2A4B817F301061A2015BCB8A6B582731FC5
MD5 SHA1 SHA512 TLSH

Submit Download

15d77549-423b-4a2d-82f0-5dc755cbce11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15d77549-423b-4a2d-82f0-5dc755cbce11.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fd42f340-3949-4f72-bb2e-2bc65cb670ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fd42f340-3949-4f72-bb2e-2bc65cb670ad.tmp
Size 392B
SHA256 70fffe11dc53bf9fb790433484d41298b309efc20fe2f89677e7bcc9ed57e8cd
MD5 c88d0d02e59ac66ed3f0adcaf0cc3b19
SHA1 3c93036d2dab0dc26e2ad6dcf32ca48ff07b4339
SHA512 53ccb6b2f4c68270f8960f812c068064eadea5126daa5af0461beaa980f70c4616e11f91aff9672649e0b2b41b21eb4e19adb8adf9360885a46d31cd46cea27e
TLSH
T1BEE00102D34155BFC03C037000D36C3139F2A4B817F301061A1015B8B8A7B582B31FC5
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 16276783f396df99e3cdada81813dcd2ca109c4fe2231fb706bd5487d2591949
MD5 2c34986e442df8b2790b1209f1e4909d
SHA1 4615dca76ff1e4b5a7a20c6e110277b9a9aafa0d
SHA512 664d50d5cc25653adad3357aa6a1185dfb9008d60d7e00af8938f18e80d4856ac0db6fda5d5e2d33717eb9db99093ce25f442f4c6ab15c40309857e92c215312
TLSH
T13A41189CA6FD1148B3B76F599BF2A8AD847BB8772E0AD55E10210D4F0A27B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download

RBX522EC388443C48D29B0A691455478384

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX522EC388443C48D29B0A691455478384
Size 64B
SHA256 8fdcac352853895dc5a0c10b6de2802a8154f306f5252bb65e31a0673a5c07c8
MD5 49d913c636aaf6fe1ec9921883b91b83
SHA1 5035b92a434715c1b6bb755ba6311242d584a797
SHA512 e89190b41ab8174e0dfc29b019d895ed17bc57782403545bf9b31faf5c92f73cb3a9b23f32bea775bf0cc019a616f8f3a5bd6070305cf493b2b3caad829abe49
TLSH
T10AA00257AE55DF15C55604B194B1B155532153316592919A021F96344D14838E214015
MD5 SHA1 SHA512 TLSH

Submit Download

c6cc619d-40e1-43df-b980-358721bbafe1.tmp

Path C:\Users\Admin\AppData\Local\Temp\c6cc619d-40e1-43df-b980-358721bbafe1.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6112_1330481158\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller-9YCQ9C29BT.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-9YCQ9C29BT.exe
Size 13.2MB
SHA256 19c68344c5e95d70bb59475a696838b50d94216ccdbb6c27c6c29e4d729c0171
MD5 b2d39424d98b15791a22ae607d85dd3f
SHA1 5ff42a9afac12adbb60346c7f1bb923015683c48
SHA512 7155696c4e4fae5a77ddfc55a50867625c4c94672a3825b4437bf7537cdecc9eff25cd106fe712da4c170f9eae7776cb3f87582ed1d548481d4944727a02f013
SSDEEP 196608:oGNlRA0k5a4nF9Ljyl6OqZr5LT8EI3i5pAPtGEgT:oY8tFol6O+r5LT8EfYngT
TLSH
T118D69D6AB2B800E8D4BBD178C6465617EBB1B41603709BDF1AA046F61F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7088712-bb56-4dab-a3b2-a549187c7b13.tmp

Path C:\Users\Admin\Downloads\e7088712-bb56-4dab-a3b2-a549187c7b13.tmp
Size 15KB
SHA256 56f5fa63c8efd2a3cf4426d9369a9b84b779260717bebb06eafc678c1ec9a63a
MD5 74a1138e1c8bf36cc6081291edb01ed7
SHA1 06f295a38133a496270e2c173b67aafd9001e41c
SHA512 91f6fbdd27b7c772cbe9de013e6aaca56d1b79859ffc095a9363f95ecaa39de6505572366168c523cf670195a295080d0eb1803bd839978863c8a82d01783c0d
SSDEEP 384:+0xTy22MisXRhhV2oPTLwl6Cdhj3nPxThidLp6iyP:pB/biQ/HfPfk6C3rPxyWP
TLSH
T16172D0969C385AB1C53A737F544AB98B60F071A5F345B3B63B26A0034E9FF1942C3259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_2026-05-27_12-11.zip

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip
Size 30.1MB
SHA256 d41966dfc5b435a372798245300ca0ab7bb8e48bdbf48512c6fb20fcca427697
MD5 92f0d724a9b174c161e23a95f19a54c6
SHA1 4f70bf300e79e0a88d59ab3bfe68d22daf003cea
SHA512 4acb68e66fd10d6a1a582e38bd92e13e8f30a21b717ea6b6225e691a959062500ccd78ade0c022106e75caf4c0f324c90d6d24bf9b80ac727758eb98385f15c2
SSDEEP 786432:7tNbaw+FcDCi5hL4PLxZiFOhbJjcg74hw9NoiBDm67fv3aH1nbmHFvH:7i+DrjgNZiFQdJqwUGDmEfvKH1bml/
TLSH
T12B67334EE2ADB50ACF4F7B7366F2A115CA8DE560607CF32E46E6340D49EC5F4A46E240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64dbg.ini

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.ini
Size 50KB
SHA256 91f43cde41ec345fb17da258f67354df77265e582cef8c2f4c2509f8ce9eff0a
MD5 c420018f34a2f2e5333f5bd782e214d6
SHA1 6a109edb3b1f5238452c3f98c36ca9e083ab9dbc
SHA512 7e46b30eea5e51101017c15397e73124cd3aed1082764a7351fbfb1a6bc9618a51753e0c9b1f351dcb1e33b0f6ec6e2f6f107571a47d9db33dae4f0a97fd8387
SSDEEP 384:mDi+Revjjjq7sBu9pwbwiy7Lrbriy2cr6eG4le1kuiEA3KErhknVas0m/5tLTzys:V+8v5pYr6eG4Y1kujb
TLSH
T1BA331D9E1C0F5A888D473355E3FB340867DF390A10E918E80B38DFCE9F5965944F69AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x96dbg.ini

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.ini
Size 122B
SHA256 672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc
MD5 45c1e010baaeb6b086b93c73cbfa1433
SHA1 6570b66b77103aac30dc7cccfacde1e42413890a
SHA512 6b00d4050ad80dc575b056e40b3fdae831e57d1b035fc7500c1523c70c7f03f344e8b53b070ec3c8482fcb7c300d401260502ba4c04076ee23db66c236d3ad50
TLSH
T1E7B0022A0DD3515E3769D195C2B095A03702F4167C595B2C8DC0574958EB6096442C92
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3548-1739-0x00007FFF4CC30000-0x00007FFF4D185000-memory.dmp

Download

memory/3548-1742-0x000000006A7C0000-0x000000006A7D5000-memory.dmp

Download

memory/3548-1744-0x000000006A7C0000-0x000000006A7D5000-memory.dmp

Download

memory/5968-2715-0x00007FFF4D830000-0x00007FFF4DD85000-memory.dmp

Download

memory/5968-2717-0x000000006A7C0000-0x000000006A7D5000-memory.dmp

Download

memory/5968-2721-0x000000006A7C0000-0x000000006A7D5000-memory.dmp

Download