hxxp://www[.]roblox[.]com/login

Analysis

max time kernel
1033s
max time network
1046s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://www.roblox.com/login

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
372	discord.com
373	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{93F97084-1BD3-4559-919B-8B406823799C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
3136	msedge.exe
3136	msedge.exe
3364	identity_helper.exe
3364	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4612	3136	msedge.exe	81
PID 3136 wrote to memory of 4612	3136	msedge.exe	81
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 4788	3136	msedge.exe	82
PID 3136 wrote to memory of 1060	3136	msedge.exe	83
PID 3136 wrote to memory of 1060	3136	msedge.exe	83
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84
PID 3136 wrote to memory of 3108	3136	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.roblox.com/login
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfd9b46f8,0x7ffcfd9b4708,0x7ffcfd9b4718
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1784 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8088 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8484 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,521483519301318774,11651213264779510366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
19KB

MD5
e78f9f9e3c27e7c593b4355a84d7f65a

SHA1
562ce4ba516712d05ed293f34385d18f7138c904

SHA256
75488ac5677083f252c43009f026c2ec023ac4da3e65c5d7a084742e32abce3d

SHA512
05f9fbbd59c286024b3ad49961c4e0eaa1abcf36ed29a1d07ea73d2b057075d46fbfdda56f135145f942bd0c3d48246c73be1771c21861eec4ddf8bbc365a286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
28KB

MD5
d45c675bc9e4b2bf152eba246e052c74

SHA1
db867a534af408e7626f37e7c2988fba37d3fee5

SHA256
f4a74aea032f41add5339be5ac3edf995b1ebce17eb527e9ecf6405b1e537e4d

SHA512
b687ee376ba0cd750d7f28944d678b9b161cdf95fecd2cda0ce1074a833608ef1119bb53362a254a651c24b6283895ca89d5072518cafb425259e7d49765fbb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000088

Filesize
197KB

MD5
6def38a8707f9436fbd9077bbaba270a

SHA1
ec17d8e0aa87a2495fe068be7076f1db145c7901

SHA256
d384b8ea49693bcb78ba1dffb5d520f11d0ac29293f6cac220ee9621b61f3a7b

SHA512
ad84e8a0ec9b7f19da458264e12779c4052e0ab59c8e23598373bde92471029eb08aa3859585d3874afff06bd7b081591a2ccf3a3ff010779995314f9c255bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000092

Filesize
30KB

MD5
6fb26b39d8dcf2f09ef8aebb8a5ffe23

SHA1
578cac24c947a6d24bc05a6aa305756dd70e9ac3

SHA256
774379647c0a6db04a0c2662be757a730c20f13b4c03fe0b12d43c0f09e7a059

SHA512
c40f4771c10add1b20efb81ee3b61fc5ede4701587f29a1c2cdde8b6faabd1c76d769bf8b99aa19082012f95d99ba448a472463fb9056acd2e43542e14e605cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
f48f2bcd0f05e9388debd9ab155a0478

SHA1
0f321e4a0ef0b4d09fbb8e29e4164b418c7756fc

SHA256
94f63d9e38d9ea00405e10c4d4c07c53f37d5d0fc0c9b0dd4cf9d8037c68dd35

SHA512
2069e4a90217419383c42b16d2c047e8217d57f7f0adc410c7a3956ebcffed0cad617ea88997cb712592058d9d20402f5b367d04ef108b80fb70e51e897bb738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_globle-game.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
422c1e6afddeb25a8cedd10a8ca61f96

SHA1
c6fd2c9a1f29bde05876db7ec8d3d80988090569

SHA256
4fef6d6c60f8aee688ad4e0d8ba56c9f4d7b072d83c57eb54c554005df2443ee

SHA512
674ee25ee5bf2d6af8bca240f2ce2324ef658de0fe82080af4dce90e5d4977982693f49fab8259fdc18046f1d6a397c29abf413c360bbbb8d3b9fede70efa8cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
64f59d367413783083b79a8c4c6832fc

SHA1
359e8792c21a29548581c4fee8805832164ef2bb

SHA256
7dba1689b5c49771a84cc1bc3688463a3c3440c105938632b4152776ad3c3a67

SHA512
3cac7c06e1a919536ab914528387f412e75e3321a6a95039bbb4dc4d5fff7c476a90f703c6bc8f1202c85fde90bea206631d97fde3a3dcda75641ae1b6fb693a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f4d9903ca16026a6db4f1abda0a62de

SHA1
619cda9e59f55fdfddcfca745d738a7da2b7da04

SHA256
5f394f023d0c924ed48ef351f8dbd531e668f78541530192e45a7194d4b387b1

SHA512
cee6f3af1415cb4bac511e3ea5e2bb7f64cae641b2850156880580d975b3449bc255e14227f9178d5750f1b87a897f951a2fc4296a7562d5b712a7b93046eeb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b37d6db29b782b74ecbf44dbac33477

SHA1
1862be424e5a891ffe723c39bfb453db65c13c34

SHA256
8cfa7226bca6139695c0720d3fdb01645b61287b70566addd0a1a2cf751cf422

SHA512
96f08e89584fe1aedef69741716a07a8a316bd7cfb225fb9f758e67deac7eaf0e8f2ed3f57fbecfccbdfcd07da2e32bd2ce79bd1bd41cbab6803a0f0e086da68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8048bb19dcb598d6eaed771326054e53

SHA1
70d3a3560ccdb4dc78fdce380a0b0747ccb62ecd

SHA256
a39cef059f05535bf4340f66cf33c1ba020e9fe05d46ad09bd5fd0d783e2ef53

SHA512
997671ea0538e088aca6e1ad15118a6e577738e13b2beefd2fef05b5e3a51080a4287fdea6cef0788f4b40b054751183b2f077e9464c85d42942e1c06c1cc14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
82a73fa5b8424bee35f5671989e22643

SHA1
041e70edb2cca9ac27a8b23b80dcb09e44a3b615

SHA256
3e1bf1a1ee4f97b8faa8a38bd20614d9ccb32449048eff382e3d17d13c9ab49c

SHA512
348ebf006d42fa08e27ad6774d133a68a113e7a107d5f4702f1fc62a09fd61a0a96176065d99b5973d5d544bb68584072ef0d6dcd72dc5ea86e5c49ea5fd187a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
916896022cc4098ebc7efdc677962089

SHA1
4a45950a0afa578fed6889f24e22f31af129a07c

SHA256
d3a32c150ded14549938d538495a337f223f11739db03980c1ae148f873c87a8

SHA512
714919498a169c637b8a41f98c5677bd3688f01980c190664148afda5193ec17649e5f930c24fffea2f0ac120f3f10fd7074fc0a6604e4a91c60b687aa3c0da0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
c7909f2ab7ed2950d3b4c9f09ee6fb7a

SHA1
a86b6f680ec5af3f4aa2c69e615dc65e66722b5a

SHA256
d31d9153b2c61e6a2593fa8bd384df4cb9e29c591dc202e12484804bd2f675b6

SHA512
b969e7d233a956137a750edbedac17692288c95c71bf278856a6332b51758c9b5bc597a9905dd21a9ee7e0728b829a51d2f776cfac49e47d12911b7fcd9a9ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
fd392eef7a062d61fb970020d5afffc9

SHA1
1270477b49b0cc57676e4865b1e8f3197f1d243b

SHA256
f5dfb981b5492a6516f351f0a83664823ca163003b309e71722745671272a324

SHA512
46e2500771cc5a3c8eec096ed86d3106a3ae22bddd909dae1f9b6a8013d3da43be68ea0fb892e405493ea522cbfd3dafdb70d58ba618b82f9e8fefe6ce4a0b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\04442576ef6e62d561cf1ee98ac3ae4344920655\b652ec74-9bc5-4f5e-970f-59d81040b05a\index-dir\the-real-index

Filesize
600B

MD5
008c80a9691d2d2aba5e8946c2a17537

SHA1
f6b946803d898214c451f05bc428676fa61aab3b

SHA256
6a38d4379fb9152d446e9071b98839c6febe059c29acc73800ba4230dd3a928d

SHA512
96aa48730a9d9f8c1f7923b4eee2071a808a9221e2ca2df32ad03a491a5da7c13b88c1e9e541a7e7c781a3bd154d0042ded2c84d98144ef979eb38c45a8654f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\04442576ef6e62d561cf1ee98ac3ae4344920655\b652ec74-9bc5-4f5e-970f-59d81040b05a\index-dir\the-real-index~RFe58f037.TMP

Filesize
48B

MD5
9de1154ec3d90773a1ef3b07ba0b7b80

SHA1
8b6e1dd6a68f971c0603412a42a7c8d1d9354968

SHA256
156f47e389768c8ded8c8a6c63562c34932899a456c0eed574cc0d9d8b7ccf7d

SHA512
b097adc0d7259999909b9ded00cad6e3e98a737f59a784d0fd8ff879e8aa5f9f97d8689a3af9562725c6d63fdad13cd4b933d618ae332fee5b56e652c5c67747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\04442576ef6e62d561cf1ee98ac3ae4344920655\index.txt

Filesize
133B

MD5
769716ca82358eeb93a18e0171128083

SHA1
c9332f90ab70a0e5d6078559a19447aba97ac8cd

SHA256
91a9e39d750b37029640216050226808a0adb381a78374a526311f6d8d0922a0

SHA512
58f320635a20a5e8fd40441a37ea548269efa0a40cddf3318d79db38e50c3d5e0d77e3d7fbae6f32043e596e6b2313234aa0e5ab7f3642e617a9eb528982877d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\04442576ef6e62d561cf1ee98ac3ae4344920655\index.txt

Filesize
129B

MD5
5fef0fc54bdb59e494ca1f3d73538460

SHA1
ca23766546e86f4c2ff534d0748b0b3cf768a021

SHA256
785cef31765b27efcdf6a71574a205856ae4315d9a4d7b1e1d78b470e6b8caa3

SHA512
c2ba4b26643f00f8c3e6b525c3f03d0e6a0ba65b872b7907041a3e7926916723f73ecc168cefa845df9d83e749529ebae5247657260aa319de52f852852808f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19fb1f7b10aa8938eaace5fc3737c70ca6271852\ffee2d88-5bf2-44b4-a1bd-e50ec2e71f8d\index-dir\the-real-index

Filesize
384B

MD5
2f8a1932a37415739ce12109a07b2f12

SHA1
57d9b35d118198952bf5bca69af10b99fcacde32

SHA256
187bb192e5acf6e62743dc151c4eca883b7471355e0e3a944fbf26fb6e23bf80

SHA512
3c78d5053e77f4e8df46ec229bf7d7ef5ec95984b38991b9331227795c61be4c3fef94239633adc11391576f998f58cc79619c00545d155c8caa84a1045bfb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19fb1f7b10aa8938eaace5fc3737c70ca6271852\ffee2d88-5bf2-44b4-a1bd-e50ec2e71f8d\index-dir\the-real-index

Filesize
384B

MD5
a343417a31ba38f1417cbe2cdb10fe6f

SHA1
5d561215edd7e7327e5fb1082225d8393c776bdb

SHA256
623328d03e0a1fd4586d6a1ccdabc82f99eb16c9bd8a2e69a3cbcd20bda1450b

SHA512
97aeefa24c9deb47c2c99c744ffad9dd589d8f9c9234920765cdc5e77f9444d397c883dc60c39cc8d3c3786c800e2227fcdd9bb4c561a8a9222ff20e0ccf45b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19fb1f7b10aa8938eaace5fc3737c70ca6271852\ffee2d88-5bf2-44b4-a1bd-e50ec2e71f8d\index-dir\the-real-index~RFe5847b2.TMP

Filesize
48B

MD5
763deced2da1aaf2840cafbe4d4eda5c

SHA1
c03fcadaf0577abaa063d48658e26c736697bff2

SHA256
274931df47c726278644d1c3cedac95619ceff9666f5a0b9c7b9a9960cbf55a6

SHA512
b828b939f5c4d44943d098ca46d2e29aba96c43fa08086236267d3fb6debd7d3ea10f2a1234b12204aba772b85bf9bbe573e3acd4b2ef93a120ad6e904957a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19fb1f7b10aa8938eaace5fc3737c70ca6271852\index.txt

Filesize
121B

MD5
0e32233f715ffee2fdfad54c0357912e

SHA1
e4bf4ae53196a7e7da2c1741e859d4bdd8a2ccac

SHA256
6d49a74a92458d00324eb7be0893956d31d2ade8f9786fef5c3f0c562d11ee7f

SHA512
5a832d57269ab0aae536a892902fc9c85ecdf3780877d08b3016d95dbd433a4917904b39df4884aa01d3c1b851a5d0c3a9a1ea18973e55c292c9bc930e065946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19fb1f7b10aa8938eaace5fc3737c70ca6271852\index.txt

Filesize
121B

MD5
ad5a90b82f78a7626d1ccbec5aa715ac

SHA1
530a2ddd8ded7dec778249fa1c67a14ff35025a2

SHA256
e649dcd18eaeaf60e21e6cf38366e0a10ea0a1038c133d1c8be7b53cafaef75d

SHA512
2d4e3dfd32373be8d23c37bf485bc2a8cf28f703dfe1daec7411fb6a977ef56bafb8c6d310a3fff2405ea1801eba68b7d88562e3e919bad8dd9851f1353ed231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19fb1f7b10aa8938eaace5fc3737c70ca6271852\index.txt~RFe5847e1.TMP

Filesize
125B

MD5
81997f087fe90848e3b52ade0066b12a

SHA1
daa1a4f0aa0fcfde5399596790f337145538f1c9

SHA256
25dba55c8084234dbd4cf35f32fb5983858a35bff87dcf8dc30237618abda222

SHA512
8891e1e4112400e0ffe3dd17a13e37d29150afbb7f68b24786d55ee29795b9f6aa8b1625a020e4a364e3de286cc46563ca4ef416b8ab44741dec7aac6d215999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
06be2ee3c8f19725f268d627fdb868dd

SHA1
222d42e5b548c79d5942af3a3afe1af486a4c204

SHA256
cf0ae64759ff4de068f78b9ce80d4b9225fabc0d9ea88d2cafe3c0a379576fc0

SHA512
d5e0c1e694e5e8b2d5035f59b3ae843c027158007102e7d2011faeffccd86cf71665de6a728749afdbebe96a01c414469088a15b082e9e25a60736816df11fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
144B

MD5
743efaebf89499ec0df70fb01a235930

SHA1
7758fa400e003f805a7787ff77c28f58d6bb2509

SHA256
6e55ad9fcb8c12b6df299898d06ff60de29ccfba4f330d7b5414da2d879dfb33

SHA512
960ffdfab7665b953a8dedae0c15ef71b0ce22b7ba9989611d2e570da8196198fb23da477d0b2a34773e0947b4058be88041de2d3377b8447a211d7ef3c9903f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584486.TMP

Filesize
48B

MD5
774f59d97490b0a30e3b2d881dde9db1

SHA1
78ca5290425dcb9a17598a6255eabd0d406ef2b3

SHA256
b1b4625a7aea7e345cc267e2e2406edb9e316d00145b6a3681d26e9479655cca

SHA512
18ddb88c32d2c0db1fcd3e473965a3e1c58243fd8cffe44f6835b0f3d0c02efb197cc5731b646dd34075bf38a70af0e9ec6746c38bb9c930164b103bc957459f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cdce76e235ae39820ae02685d8ff5b4d

SHA1
7cbbaba6bd2ca0073f23626ce531643f1acb2434

SHA256
3bcb6a3959c99f42c6998f96fa66dfb8125c5257f7224b628de7e56b20147dc5

SHA512
557fc504b62fea62e20e3262fcebdff83c4dbf197e09acf4cdb9e84118ad743fc91737e62f3a7565b0fee338bf7d00f3088ec56dd7709e3897ccf49edceea988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
42b97684c26eb94e26634b6c0a769c6b

SHA1
6300acd7dda4e143a9e48087b53be91948b35ccd

SHA256
026c4d3ca28cf56d64fabb5a52f1e00ab9898b5cc3df3f2d0759812659b1b471

SHA512
0bd9da75804c0b5d983c0e8e436d0a297c3d62594c3108b9f1d0b8a856880f22d93cdf50cd10d5740981ceba3d2ceb2027a6f98010dc20cf4752857e6825fd09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e6a0d4a49632d631fc0d60939317352a

SHA1
54c9de887c53001afb1e5f88763d7d4f4dda8485

SHA256
ed845033811a0410f3bd26b6455f522e6bc256237ceb93c48dc670ff4828db51

SHA512
d8ed77aa989e4464a2194b54a6ed63dd26ccbb20fd9c5dcfd6c4bf480b886228ee65264f454ee5f3d2c3f1350b99b2df81978c70b1423c4fd082462adbee4ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5cdd49b579babb6bb7e5d7febd5dcfdf

SHA1
b27784e14c9badd709f438edae60567a2261453b

SHA256
d345ec08a24143974173cc36042c5140d85207f76162cf20df7e6c1b8559bff8

SHA512
89ac11bf02f07d4c2e25ff904a302a809f5629569c8ac30315c4144d1558953b05618ca681a2f062cd499411a99427568d46ae2f02cde8ab2c92698abb8045f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b8e6929524e13954942e8e4c64bbd120

SHA1
6a580cef4799aab8bb8331048d044d610e60d5e2

SHA256
4de200257badc666e4e79f24f7b7f4f662346f5d3306da214fe39de53a1e6eaa

SHA512
2f5d8a4c9eaab2ad6e7ea4b4984262b38e42d851775c478e65434160908c19d9aa18ac717b1536def6c2046c46fe12a3d8de96252e8da7edcb037ef4eddc19c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
7b243a65fafb10903e1d17e00d209966

SHA1
12bf2eb8d0e297e296cf8a62e71a8cadd826c4c1

SHA256
8a8bfd995175bef42d354c1fea547d7fe17f94675a7c4ccd13470fd903783b36

SHA512
475b302c4e8ad2f35f97004dc47c79311f9be5d4a4b633de6c3241adf478f4e9a10519500f0d40f2a215d9b8aae50fb3d9331f7ef79368818715addcfa293e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8994c7566e1b698e29e3ccb11d0ca421

SHA1
94149df64e551bfb62dc07a4592fe74f77c95a26

SHA256
c91156127c5af09c8f4a13337c08f1842a623344a0dcb43f4bbb091852193624

SHA512
35cc92b47beb9a3c5e2e12051b2c673974914fb20e0703a1943412a56a400a8e97b97e7ab911fd620d711876aa5de79a1a77cc4c2c791c1bbb69888dd1d532e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
29719dab1162b5d6e168ea06dccd4dbb

SHA1
f671f99ca6acdb396f57e29ce4cd92d9c42d664d

SHA256
ef018fe5044fe63a9ab58a5c562464df39733359aa9b5835912289a9b58cf86c

SHA512
a36d0f1c1cf34f3d1e85c8979a9916cf3b4501509a4bd28866ef9613c90e9529246f81e9812c8e5d40f8ae4ccfe9535a02467da8829867b304f1a5e013cf8d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0ffaf0555788d3e606081202df12c15f

SHA1
684b20e4d9ec605c61fcc0575868f5edc46c9da5

SHA256
e45b20b7aeda346bcf8b623dab1ed5709253fff490cd2ca94c84006aa57e000b

SHA512
b5c2b1abbc52e8a45c8ec5b58539f130421547b89a33bed67757b148c27a7d2ea47c132588fee4f1590a5b278f53f21e4972255750eb315fe31084981e841988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a76b.TMP

Filesize
1KB

MD5
ff0954f69c036a6d503a7d090c025064

SHA1
af6169d4e4700c67ee68f3c1792cf7d41470e501

SHA256
ed68e9028a9f57ca1cbc618f2f6d653204810a895b87aa349a4eeef79b8aa3ca

SHA512
89ce7a79f71ea7ebf96027938c481a45877c2179fcff543bb75516b991f69d1c6aa63423ccfdd0c9dfc9ae970d2e8d18193106f68d6c854aa8b749ed5d8c85e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2b857c6-4c38-41f2-8c4d-ecea236c22aa.tmp

Filesize
16KB

MD5
0d03db66175eba886f348b7eef760825

SHA1
54c8cfb8ce3f2a4e94e416fe208971d44b5a1f07

SHA256
a3fcca56871b9da4b719b790a333e49e065ee0d83fd4d5079eb8e5f4d87e3f7e

SHA512
9ee3d753218e1821b4347f93fdf34e6b3e288667391ebdc23f9ff4ddc606d687dc2deb8c217309ffebe4ce37328d3f563e33f49c799a8f09fbcb99ad9cff3690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
32ea95f4dcc4c3383e53c77de519f399

SHA1
94cf54460ec724fef6e14211786c885640635b3b

SHA256
e2921562517bf97c829400c40ca4dc491a0bf9ab58eb98a5a6612945ab5970b2

SHA512
5761ca2d7ae06de133f2a8ab5e680b7b92855cfd5294a2b120f34aa86f9a66306d46031c651c63b62114cf2346344b76a768842ffdf3bf03154911bbe092054e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit