hxxps://create[.]roblox[.]com/dashboard/creations/experiences/5294748261/places

Analysis

max time kernel
1785s
max time network
1684s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
29/04/2024, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://create.roblox.com/dashboard/creations/experiences/5294748261/places
Sample240429-t4a88aff3y

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
4912	msedge.exe
4912	msedge.exe
1848	identity_helper.exe
1848	identity_helper.exe
744	msedge.exe
744	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4464	4912	msedge.exe	80
PID 4912 wrote to memory of 4464	4912	msedge.exe	80
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2764	4912	msedge.exe	81
PID 4912 wrote to memory of 2772	4912	msedge.exe	82
PID 4912 wrote to memory of 2772	4912	msedge.exe	82
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83
PID 4912 wrote to memory of 2408	4912	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://create.roblox.com/dashboard/creations/experiences/5294748261/places
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdde7a3cb8,0x7ffdde7a3cc8,0x7ffdde7a3cd8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,73823331773463329,8521057541149424744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b1fa098c668cdf8092aa096c83328b93e4014df102614aaaf6ab8dc12844bdc0
MD5 7c16971be0e6f1e01725260be0e299cd
SHA1 e7dc1882a0fc68087a2d146b3a639ee7392ac5ed
SHA512 dc76816e756d27eedc2fe7035101f35d90d54ec7d7c724ad6a330b5dd2b1e6d108f3ae44cedb14a02110157be8ddac7d454efae1becebf0efc9931fdc06e953c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8728752ef08d5b17d7eb77ed69cfdd1fc73b9d6e27200844b0953aeece7a7fdc
MD5 bdf3e009c72d4fe1aa9a062e409d68f6
SHA1 7c7cc29a19adb5aa0a44782bb644575340914474
SHA512 75b85a025733914163d90846af462124db41a40f1ce97e1e0736a05e4f09fe9e78d72316753317dabea28d50906631f634431a39384a332d66fa87352ff497f8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b7107f04af6fab507a048e05fc0c2bb8d27ca777f3ba41107c421ccf891b7771
MD5 e3e23f7766d2513ca329f00f85546ab3
SHA1 7bf6a7b8b3191df1e65c8f59f97f923ecaf77a3c
SHA512 e4577233e027feceaefa3809520f9bcc0fcdc0c17d0b4e77b06f96035990a8a9151087ff4fe9d9d4f7ea052412bf01cc5b980667c7b40614cd695ede54666a97
SSDEEP 96:nck39xm/DQYmt97kDmPwSv0MoiVmdHIrJsp0WQyV+VuziX3wI3:nck3eID7kCPv0MAIFspLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d68f7395ae89098e6879f9081515449fd2021467c9c980f4811eb35b9e56c721
MD5 e3b895ae0f7809a4d6b81c806fa2b88d
SHA1 eba49b64caecb2604b3575b5e31b57c6e4ac439c
SHA512 690173e97f0188f07af20f51cec9abb2b55640b9f015d15c3af1f687bd260c6e0d4626e9978a9548b4b6e23fae9b7d64b07962c6273467bb17e7b9f1c21ec9fe
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3oXxe2RUfVRTZIDiRVY7:M9iIxuERzA83h09RZxA3IlqFIDiDY7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa19e59a64ce516996b2013ef3366c47fb9aee4f246c6446abf21f87fc3cc6a3
MD5 9d5481bcf70f0a75c6411779807c4455
SHA1 bb218b6a5362055aa2094aaa0182d9ed334cf207
SHA512 0c9073edd94e3223143151f30c252f51486bbb4f21ae5a48e45150571175aa08e97a1d72d0871e0f6381eaed5fd853976520e0d51eff28d7e1454c1f76b145c8
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG+Xxe2RUfVRTZIumRVY7:M9iIxuERzA83h09RZxASG+lqFIumDY7
MD5 SHA1 SHA512 SSDEEP

Submit Download