Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 11:45

General

  • Target

    https://www.roblox.ht/users/416327642223/profile

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.ht/users/416327642223/profile
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa08db46f8,0x7ffa08db4708,0x7ffa08db4718
      2⤵
        PID:876
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
        2⤵
          PID:2228
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4252
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
          2⤵
            PID:2304
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
            2⤵
              PID:3000
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
              2⤵
                PID:2104
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
                2⤵
                  PID:1840
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4492
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                  2⤵
                    PID:1020
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
                    2⤵
                      PID:628
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
                      2⤵
                        PID:516
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                        2⤵
                          PID:1908
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
                          2⤵
                            PID:1432
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6064 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3280
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6092 /prefetch:8
                            2⤵
                              PID:2280
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6104 /prefetch:8
                              2⤵
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              PID:524
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3436 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3000
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,177441288492516213,9544970478068962257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                              2⤵
                                PID:3308
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:628
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:220
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:2968

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    f9664c896e19205022c094d725f820b6

                                    SHA1

                                    f8f1baf648df755ba64b412d512446baf88c0184

                                    SHA256

                                    7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

                                    SHA512

                                    3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    847d47008dbea51cb1732d54861ba9c9

                                    SHA1

                                    f2099242027dccb88d6f05760b57f7c89d926c0d

                                    SHA256

                                    10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

                                    SHA512

                                    bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

                                    Filesize

                                    100KB

                                    MD5

                                    fdf09c3c067041ffdefcc9e1bdea9718

                                    SHA1

                                    e31cf28187466b23af697eedc92c542589b6c148

                                    SHA256

                                    144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da

                                    SHA512

                                    9e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    3KB

                                    MD5

                                    f4ebe9d8b97adf32392ea0f598c070f3

                                    SHA1

                                    4945b76fae2810019d64dab56391a943e80d181d

                                    SHA256

                                    099bb7af0db9ece01a753ee7ae479b6b88627ae55945fe19a69de4e01ccb788c

                                    SHA512

                                    edb055ef98fc3188b2ca10cda6715b174b4c544f99fee1d355078590dee030259f8641873a654cbbe49d3e2797d6f80d9e20cb565cc7c1fa8e28743a819e19b1

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    3KB

                                    MD5

                                    26d13a1b20f9b6a88d1bab825f8eb679

                                    SHA1

                                    4d2c415cd5f7ffa7510f3e7386ee5370df8e07dc

                                    SHA256

                                    83aa08aa180931e7d5252a6f5811cd3aeff3433ab6dc26f4a8c714b13b4d5e8f

                                    SHA512

                                    6387c1b0a002550c7c9f5928ce3afa46bccab0a864a48aa9ba0cd4405f1f42730bb677636c8f0f6e2d3498a173d259eb673eb0e57350589539a3b69496d877ca

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    d6a52b7bf7a4313d59e68a9f51d52178

                                    SHA1

                                    904744a9c9607b543d08625b028f74d31a806568

                                    SHA256

                                    325d64a46a2a9091259a99fee2ee1917f7fbd3f6a8dd5cfc843dd816f3c2bc4a

                                    SHA512

                                    76bb6c187c6d8901fa95fcc267df79730068f16aaf387a09e185588601cf806582f4e587b5818fcd354862e4e6bad40c9884405de9940a6e94bb1d81a5b05c97

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    937a0cbfa1e2c56d752085caa6ae0654

                                    SHA1

                                    bd0c2b9ebc1a594d611d169ced0a35e8e611cc95

                                    SHA256

                                    3624474accfa3aac2b4248e4cae752107c9bba555ee416e8ebf0cf2a92263b4d

                                    SHA512

                                    cc0932a853d91b2212ff783d2a37aa85eecf18404fc07c3be5c4fc7bdb76805f2efab7ac91b59088c3b32eac4e4e554cd4e57e5e905dacdb69b9b5ed7cf12482

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    fa26e4103b0ca83bde1fd1316f00ab77

                                    SHA1

                                    3ea628678d1787633e5ec2583ef688abe353e124

                                    SHA256

                                    1d7ab2d3629538138c6229bd982fd579313e7460aa937b59c86be792d3b6ba8c

                                    SHA512

                                    f833e218c845cdb1afcd3fa2935c89184d2f65071fb584e692580779aed9ec095956291d6fab4913fbde1dc000cdba01eba744c77e74891792474476293c3d62

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    6c756f3112190bd8e476cd4bf1d79e06

                                    SHA1

                                    7ec7be7800910ddd5f5ca2a856cfaf2df4794a04

                                    SHA256

                                    9f0fdf8220aaa420c090e81c7ab63513ab9d4665bd21df947894e75146a9d9ef

                                    SHA512

                                    5824e7af4926dd8dffb718779425866d2da0ba485deb5b49b5eca171b3e4ce228d89956b9e30a9f5c3a541f8e722762fa1cc0f9720f046ffa40bd3b9a67cec49

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    27ac823da134b08eab93b5e8d069bc82

                                    SHA1

                                    6887bb66e658d3647e03a6a10c53fdac6cadfc24

                                    SHA256

                                    edb5491aa5c2c5ed0bc9d36149bca05507a9b154a690a0fdc2dd6a1ee629bd69

                                    SHA512

                                    48b79ddb80931d53c47276f31a105864950144d71c633d82ba88d6e0ebdd8969ce95b13b9e0fb3747a12c7e0964ce9a970d475deab7e9874113aaea5247381b1

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    8110422cb1cee294f8f9c1e6c772caf3

                                    SHA1

                                    212ea08a9a5fbbbbb7e46ea0131d3a0373850bc6

                                    SHA256

                                    b12567f3fd5b9289ec5b9ca6f7233335dc535186ff04f4de42dcd9874e2002b0

                                    SHA512

                                    a560920ef1ff972bf9f6416c2554fba52e52cd8ee1a9be179c9cbb65d4622a2af315680629e556a256c4eeb0a59227c8076cf884d52d186baea1773dae64bf35

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    8091b0d146604538f0a28485ce56babd

                                    SHA1

                                    cf0a8d2f02338ac55333d24fa45ca1abec989b58

                                    SHA256

                                    1c3bbb2e99fb3a1fd3142f8cf133912d4830631e73ba9de8aa92af188ab171c1

                                    SHA512

                                    80374cbbb71330fc70af33a4a039f00d721f454a2a7af59d6be2ab3479c2f622eb6daf5d6b70e964f32f95c21307517aadf80f0d93d1aa9ef6672b60e605b30c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    960d65bc62ddf7208a0eab51d0f56203

                                    SHA1

                                    ae688f9d79e07724edc0375214e6cbc8a9db4256

                                    SHA256

                                    f9b835052979f842cf4e6acc05959c341e0c700540d2a829266e95789318a9bf

                                    SHA512

                                    66b0a8384d428c3afbfdb99a09afe8a181ca0f1471672a28bcecdfbec66919cf71f925e264b6dcbc943fea63bd17ce4e7681ad5c84c7ae18d0db0018d721c89d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    2KB

                                    MD5

                                    54027bd32d7ed6d343d5791919bc6ab3

                                    SHA1

                                    9ff315ecb08f6e2085833fd06114cdaa02ee79db

                                    SHA256

                                    611bfbfe830a3e64c526d1544ec5be64f14ccd9c3b876cd899b71664699605dc

                                    SHA512

                                    83485944d1fb049b78492c1357a9497cd130bdd7b8fe6254cd18040dd1b5a44afddfef00ea5148aa2e5f78b9b0a54e4cce3c4378c54303093c5bdde9984fc141

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    87a323424cdb26f46b73da350168ae6d

                                    SHA1

                                    13b224c9d3b730f6d52f702f9e49072223e22484

                                    SHA256

                                    0764838f73714ed53957eb96d5b65a53b667d3d81c5d684d3698e5114864d7a4

                                    SHA512

                                    a89e36415a26384d47e2546944f817060a9af58c375e8f68601e3816babcd3866f47f9e6676d52de64611d1b5d03c62ce81c94eac22bacc6c38e1b2268aff853

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    da97e0abceb8409bcd07cf3c405533f7

                                    SHA1

                                    dae7c707c84a991b3037de1ac4189392b9e5d75e

                                    SHA256

                                    66d28b422e8d30850860e0fac8aed05aa7123663e64e8fb8890cb68c35f46ce2

                                    SHA512

                                    52a2ab205590c44498029387e1a2f28acbbf0fd350296407d568316c8ae3515df48d090ad2377898491373c653f2b6a3873be9403a5b689c0f8e9db7c4cd4840

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582c99.TMP

                                    Filesize

                                    1KB

                                    MD5

                                    5bcd02c06530af78530f2b5986388aad

                                    SHA1

                                    f00a9330a1f245ba88dc8f835c425cc1f20e377a

                                    SHA256

                                    1da8a16dbdcd68331bd2293e34b7972444a7e364eb42f92a7670af15f650d95e

                                    SHA512

                                    49560a09e2fbfcadd3b331687a364b291dc30863c1b2b6e52790fe77b765c7de2073d963eaa3b5a3c86c3a9ba032fe7babe6478b7e1c81c38bcf55c7a54b16f5

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    8c1057d7a5ff0de3fa39ae30418e4f8e

                                    SHA1

                                    5f70a5ba60a91d753ca05bc9ad6038c42648e0c8

                                    SHA256

                                    15fb42b084614a33bfe282c509ec3c92cf15b4deddc9c44862f11cb3a51be7cf

                                    SHA512

                                    36d1b516c0978306e199c9442c1f0634158964106bb2f2c2eaaf07c125e345f7a25048289864e4ae80e450cc60f10ffaaea1debb2c701a43a7b16282d6b4512c

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                    Filesize

                                    2B

                                    MD5

                                    f3b25701fe362ec84616a93a45ce9998

                                    SHA1

                                    d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                    SHA256

                                    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                    SHA512

                                    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                  • \??\pipe\LOCAL\crashpad_3200_ERLIQKRYSQCSNVVC

                                    MD5

                                    d41d8cd98f00b204e9800998ecf8427e

                                    SHA1

                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                    SHA256

                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                    SHA512

                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e