hxxp://roblox | Triage

Analysis

max time kernel
100s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://roblox

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230505124022.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fe255e48-d801-4e91-b17a-36dac3774ddd.tmp	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2024	powershell.exe
2024	powershell.exe
4120	msedge.exe
4120	msedge.exe
220	msedge.exe
220	msedge.exe
2268	identity_helper.exe
2268	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	powershell.exe
Token: 33	4112	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4112	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 2152	220	msedge.exe	86
PID 220 wrote to memory of 2152	220	msedge.exe	86
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 3284	220	msedge.exe	87
PID 220 wrote to memory of 4120	220	msedge.exe	88
PID 220 wrote to memory of 4120	220	msedge.exe	88
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90
PID 220 wrote to memory of 2868	220	msedge.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://roblox
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://roblox
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xb0,0xdc,0x100,0xac,0x104,0x7ffff72246f8,0x7ffff7224708,0x7ffff7224718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff622e55460,0x7ff622e55470,0x7ff622e55480
    3⤵
    PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,16107399119561189960,14004843238746332922,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x530 0x52c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a59181af0142a9a9b1872318838500e6

SHA1
a1e57e7a746378ac82f4e307d0c1603e93b6fb21

SHA256
c34d3bb3281d660870044b94754606774476e285a77c207cafa65d975cbd8d11

SHA512
be77a27e16cb9eef5325da1eb43bb9302feafeacad4c005b4d5346df173b552358424250f90ed8fd546a5030bc23b213adff6f5c571562e87d753ed4baba82ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
69KB

MD5
9b13f2a8f8de9e8da40c4e3e1392574e

SHA1
864fb91867e4c429d8ab821763bf11ce15fba384

SHA256
66094d65d176790840968a73dec5c88cb77d1d573a9cf8c32da223fffe41cba6

SHA512
9e40798ff8b457b8089c26b5745b99cb64dd125f0210894fea156346c767858e71b30af383ba8819bff54a0f9d1319bef0466b3d283fcf310d36570e4cf69806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
85KB

MD5
45a177b92bc3dac4f6955a68b5b21745

SHA1
eac969dc4f81a857fdd380b3e9c0963d8d5b87d1

SHA256
2db3b6356f027b2185f1ca4bc6b53e64e428201e70e94d1977f8aab9b24afaeb

SHA512
f6a599340db91e2a4f48babd5f5939f87b907a66a82609347f53381e8712069c3002596156de79650511c644a287cbd8c607be0f877a918ae1392456d76b90ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
1004KB

MD5
72e797c42ab56c9128e943eccc495e4f

SHA1
5038b0bf7928bd3035093198c38d00cc954f402a

SHA256
efd2c1594a84412ff33457c34d39386a212a582f84ac3903885e080ab0600e4f

SHA512
32bfec7482cac80f0081612c147b3c51f71546e940a4b16f6033a78b465fbdec41ff60bb1d86c6e035d8e9cb274a0d90afb9daebcbf94f54c21960e9804e49ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
16KB

MD5
d619769b0d3b8131a7377702d014124f

SHA1
8322e923c37939342f86fe1bbebd166383301e56

SHA256
5cc6e63dcce13f60f8afa5eee98b81d425f9df3cabc4992ee3b506cb12cf5842

SHA512
0e14a32ca5f2396d8069da3f645b4577b4333c9661eeab91b9b437b25104c592b00c8096158da6ea0e21b7ea12139eedc9d9cc6819a219c04fe425b576e44cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
202KB

MD5
9901c48297a339c554e405b4fefe7407

SHA1
5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e

SHA256
9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2

SHA512
b68ef68c4dcc31716ce25d486617f6ef929ddbb8f7030dd4838320e2803dd6dd1c83966b3484d2986b19f3bd866484c5a432f4f6533bb3e72f5c7457a9bb9742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
1024KB

MD5
19d40b230003cdff2e07eae8ff3914cd

SHA1
21e57e2ab8d24400a977ecc5bc0cf99315a6cd85

SHA256
3e2fd611228acca2857dc9243af15f5598ad4051386b022300486ed1b0f018dc

SHA512
f1349a0458f52f3f6f27e15e59a90330028f5d7bc52447ff59fc675f88f0160e223e168f1b87beaa5bdcd96ad7277df8fb792dfd82b714541e842d04d5fcbfce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
912KB

MD5
8be6ffcbb5cdb108232091fe9a734a18

SHA1
d535a1eee42b8844d05b3f1a8c7108dfd91341bd

SHA256
910cef999a5cea9ef21c8bcebb31d234de9a6a019d557125c8eb49f5d0191b9e

SHA512
2550920ac07e79d6ee2cbea643516906c19cee0ccaa3471126b361b1c0fb8934c46129b88ea1d0f661b4357d37429548a39448c037c8b9b4794b05cd4a28313f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
79cf17a93a877e83891b866dc4e37499

SHA1
46cc8a5ce745423085ab3ea1abce5997461b266b

SHA256
3f0e707265303376eb9c6e36024f8628455b1c9267fe41ced5d082500a30cfd9

SHA512
7e22f5e418a132a0f09f002f0c80dc9349dbf5faaf3086eba5134466741f4d2388707f7d96a502219d5929c0edecd6b9df03a8818dad453b12433faa9a030e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d077cc19b48b49c823784de0a343f0c3

SHA1
9033635e19903515aba0d255b1b0ed1701786d1a

SHA256
4f9bd433a5c74062d8771a5708a182e92cc803778ee2660706289870152cf095

SHA512
bc7e120df8df41f679da6394021e3d375635120c97a9737690e2d9f28d610088ad16927cfbb57f2be291f28f0ebaefe9c5d9390dddb44c925ed6d3118e3d68ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
6207a1a2ae753175688cfc7e429d487f

SHA1
f7c10ea64e54ce66e936f99ae4ac24dc8c8c45d7

SHA256
83417a85669dcd95efe1591bfc80c5be6f9eb1ca11cd4594c2e08cbfafb1f990

SHA512
7a40f499cfa39b13418bcfe602d6ecd7ace8263bdd9b85f7089afb663845b0143aebce5421d384c2500f9b72e45918a7f8fe75d0e55a10c33b724af46621ad6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b685fdbbbfb95d3d76110b518f9ecd0e

SHA1
d3489131d48881c6924f98bf57092da3768c6a95

SHA256
993d7bc0581b61f9ad8d96469ed0d3236e830dc884639e1b22c72c0ebbf41084

SHA512
1c9f84afb29c93a245890cdbd18aa22d098ac8abf51545ea88d7c2215595dc65334576ef980a2f32f06dc138ef7f48d8152260e7a35da96cf2b486814ecdc088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
8c430165af5ce38b51e90baf1e0cb517

SHA1
3700b42c507fcbdf9903583c91596d4146927c66

SHA256
bb8b3916262d3a83b7678e96a94c0d0a873fea52a84a9f14e9f2fcee8fe45ebb

SHA512
4b4fee344c95c57bbb34622660f120207ef1cda50dd8778aa366fade689de9bf75c7cd77e53bfb8664e06e39a0c38fa4da96430edcd6631448f8dac9aa2c6e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94714ee2edb9dd09956ee20b6919ea69

SHA1
434a4dc981f97e4265769a0e36f3bf8f7bf02c6c

SHA256
77f3a950ef4757b93a48368c7a04068d319f18d09c9459c685fadf4b01f5a4d5

SHA512
96e1ae41c664525c897bfc6d6b50a085065a061e4d1a48d067e3cbb0ecd779807283a41d967d418126226f8894a2d46b00dfb9513208954897ef897f14b746e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1622e6bfe3e92f0f07adfec787d5aabf

SHA1
4bae7c71a740009242f54f0f6cbcdcf2ac7ad490

SHA256
06e84520e71f72bf2459a96313c50b62072cb9306695488bc1f94f794bd09687

SHA512
98a330e7cca1ab1307a791cbcc39ca04bb9ccc892ec2c046a31b5c00040869a3870e484dfbcccc3265e494a3a5d0d0eb16cd62f3d0f122e28ce330a990bc5268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d5b38b396c7bd51a0e1164b820da749

SHA1
354d1815ced88875e7f3775abd1d94e36d803b8a

SHA256
772ad09411c0d4b01f2041e74027c604dd03530a3abfbb1e1ba30965ce579831

SHA512
f9b9d2a2a3f356707fb719577d75d8affbd30400ebaa005644b8bc4e7ab60c7937c2f9c3a76c7df5f4c513521851965bdd7ae6cf7d55c1dcb83c8e10e6cbdb94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bdf79bc9df15e35e4a6ee5afb3b3bc96

SHA1
75af7560e1b6964f1dd70573084826aaa302da1b

SHA256
34037613c71608710ef6ce62cb4ef33896c40972f7979251752eae54601f4479

SHA512
ceea6938fe25074f16bf8ba98d527b976169b357d70e76866498e2304559539e22e1ed084d40349a37adde7bc4b6ee24ae3f030100a613fd4fff1f60a90e9134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dce3c2ac243bc372d82859b9820b49fc

SHA1
18c8f88fb391f0be466bd5549397893744156549

SHA256
70ee660ce0b2f8384164ec0feaa43e4a6e505a2074301b41c7e3da7ed8522023

SHA512
21e454a0ee42939a385b184029eb46fff0188c2c709d4f4152e6b1c0194ffa6eed36cb8b9b419f12ec44506fab5384e5dda537a97923f6730bf5b1b83cf858b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
45ecaac8e1a591ca201b1301f438475c

SHA1
fc68132824d07bc756c8ac3e030c6f764a4474bc

SHA256
4f35a56d719744f6e199e8f693ab8477eabcadfb21c9c713c33e14c07e8f0a86

SHA512
318a3eeb40c9c1d970789fcfeecc48bf4ecf8800b109814f90bc5cfecba5a1be48bead450f349b56f2189b6f01527ddbd604171e86036ecf5ae17a0b96374dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3d874cbf2372e29aa7bde5be5e1db4b3

SHA1
a9214d4e1ddfd7f4cbe8fc61f838f9f2a2f2f26f

SHA256
84c9c0c31f068bcdc2258102ef25547073b785cfedc7345f510de21dd6096000

SHA512
8f90c381382b2a95c3ba3fe941429cc70094c92e78668a54ac88ed3e030c14ee7c3ba8ee7f450533456fd1933663b4c300f265da972fc0493aa409cc17b9fe10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
1ee56c995f3d18c7b956dfaa5030e551

SHA1
a85332ed2cf690b38cd637bb5b3b1df4a3edc441

SHA256
e1d9c2acb7a98e23dc422b95ec3ab4b534c69f2da530d7ee4121877ccbf50719

SHA512
bba82a1a6d33c6a0598998e806a2c6ca6545829e864c549445cfeda4dfe517edcf3b38c71a420a11864979250e78714dce44b3dad657a4bb6f377aeeb8af32f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe577649.TMP

Filesize
536B

MD5
0d2fc32b12163de5521e2556a748e7e6

SHA1
1d6b28737bac3c86bdf899a59b32195ca4e64104

SHA256
c92ea7459faeabe255f6d00de57dca8b97dcb6cfd8f74db2da0fca072bc03530

SHA512
de323472685204e8abdd8ba32a732f71d233146d9b37e46c57d01fd5be07390e9da3e60c2e1c355da6a63f6bd7edea711e803842f8643508ea34596ad40f8f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fce165b98f673b6eaea566d2e84246c7

SHA1
1d0c052a9cc226923c1f2140bb320edc3d9f8606

SHA256
c0b0ca4be0cadd54404fe2a7ab46c4a2b610b9dc37d1e11611ed544a45ce4d49

SHA512
eae3e5db548b161e2af70a56a7c8fe015295b58b68b93fa7971f3029a6e7e662060e2cc43069e4ac6a6976e9008c94c965b4d46199c4a52ad9d195126371f88f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a66d30b452d9de53da7bba931d448b17

SHA1
d0f0b5e64a2a9d8b8659e8891c09c57cdec65c82

SHA256
3e243a442a8a9791312e134d0e24a2b670ebaea5bddc0bc0a85840cf5acdaf20

SHA512
848a90b5443800c83d4ff95c211c477b4086ce4b3b3528654791fb8160345ef880855c33940feb90a326f6678a3a6ad788543682b73d88456dcfaa153aca3970

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4ky54ij.wfx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1384ed79355689871d70ad7fdf08c48a

SHA1
575472f2a1a807654ad87acf1e55fff8bbd38a45

SHA256
4f6faaf7e1340f6f51ae4b1b55945e2a8705ebe22d74add8d74a9caee5fd05e1

SHA512
3c095b16a78d02160344cd4fdac08f53cea78edf3a194fab5c712429f2ded62f5fdaa0b49e75557e784ca69b60e105278450195b7830f81841f476dadb073464

Download Submit
memory/2024-138-0x0000024FF8200000-0x0000024FF8222000-memory.dmp

Filesize
136KB

Download
memory/2024-143-0x0000024FF80F0000-0x0000024FF8100000-memory.dmp

Filesize
64KB

Download
memory/2024-144-0x0000024FF80F0000-0x0000024FF8100000-memory.dmp

Filesize
64KB

Download
memory/2024-145-0x0000024FF80F0000-0x0000024FF8100000-memory.dmp

Filesize
64KB

Download