58963df25cacb5befc394a294c2c22bdd40e4c81990dece27ecf277c7e4835cb

Analysis

user interaction
yes
max time kernel
104s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox_setup.exe
Size 13.0MB
Sample260502-pvsppafy4x
SHA256 58963df25cacb5befc394a294c2c22bdd40e4c81990dece27ecf277c7e4835cb
MD5 7df171da63e2013c9b17e1857615b192
SHA1 4ed3c36731ba8626776df5c1266898657613b394
SHA512 020f420068a2282e7c5a95c151ed95da77b1c05375f84f3fc2b65ac1ad4ad93c5588545c4eacce657e69b17374bf16c1ebcc322f696eef6357435b715d9bfd56
SSDEEP 393216:U+hqQCivNZeMiPAU5GIcesec+1IjW2wLMNADY:EQCqyAUItj6lDY
TLSH
T1CBD633A65AF474EDCDD572710DAB4420F2BAAE3C8E01159EA0613EEFFC30B996317152
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	Roblox_setup.exe

Executes dropped EXE 2 IoCs

pid	Process
5304	Roblox.exe
3164	Roblox.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Roblox.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Roblox.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_220_308172831\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1807921520\_locales\fa\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox_setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1276	msedge.exe
4680	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134221992603577539"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{51DAADFE-4E63-4664-A44E-AE10130FE169}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{B91D8D1B-4802-46C4-AFC1-8CBC7A2487AA}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 220	5984	Roblox_setup.exe	86
PID 220 wrote to memory of 2268	220	msedge.exe	87
PID 220 wrote to memory of 1276	220	msedge.exe	89
PID 220 wrote to memory of 2384	220	msedge.exe	90
PID 220 wrote to memory of 2384	220	msedge.exe	90
PID 220 wrote to memory of 2384	220	msedge.exe	90
PID 220 wrote to memory of 5980	220	msedge.exe	92
PID 220 wrote to memory of 5980	220	msedge.exe	92
PID 220 wrote to memory of 664	220	msedge.exe	93
PID 220 wrote to memory of 664	220	msedge.exe	93
PID 220 wrote to memory of 664	220	msedge.exe	93
PID 220 wrote to memory of 2800	220	msedge.exe	94
PID 220 wrote to memory of 2800	220	msedge.exe	94
PID 220 wrote to memory of 2800	220	msedge.exe	94
PID 220 wrote to memory of 4328	220	msedge.exe	97
PID 220 wrote to memory of 4328	220	msedge.exe	97
PID 220 wrote to memory of 4328	220	msedge.exe	97
PID 220 wrote to memory of 4784	220	msedge.exe	98
PID 220 wrote to memory of 4784	220	msedge.exe	98
PID 220 wrote to memory of 4784	220	msedge.exe	98
PID 220 wrote to memory of 3152	220	msedge.exe	99
PID 220 wrote to memory of 3152	220	msedge.exe	99
PID 220 wrote to memory of 3152	220	msedge.exe	99
PID 220 wrote to memory of 5424	220	msedge.exe	100
PID 220 wrote to memory of 5424	220	msedge.exe	100
PID 220 wrote to memory of 5424	220	msedge.exe	100
PID 220 wrote to memory of 964	220	msedge.exe	101
PID 220 wrote to memory of 1572	220	msedge.exe	102
PID 220 wrote to memory of 964	220	msedge.exe	101
PID 220 wrote to memory of 1572	220	msedge.exe	102
PID 220 wrote to memory of 3264	220	msedge.exe	104
PID 220 wrote to memory of 5696	220	msedge.exe	115
PID 220 wrote to memory of 5308	220	msedge.exe	116
PID 220 wrote to memory of 3000	220	msedge.exe	117
PID 220 wrote to memory of 4340	220	msedge.exe	118
PID 220 wrote to memory of 4340	220	msedge.exe	118
PID 220 wrote to memory of 5104	220	msedge.exe	119
PID 220 wrote to memory of 5104	220	msedge.exe	119
PID 220 wrote to memory of 5320	220	msedge.exe	120
PID 5320 wrote to memory of 4460	5320	msedge.exe	121
PID 5320 wrote to memory of 4680	5320	msedge.exe	122
PID 5320 wrote to memory of 408	5320	msedge.exe	123
PID 5320 wrote to memory of 408	5320	msedge.exe	123
PID 5320 wrote to memory of 408	5320	msedge.exe	123
PID 5320 wrote to memory of 5580	5320	msedge.exe	124
PID 5320 wrote to memory of 5580	5320	msedge.exe	124
PID 5320 wrote to memory of 2560	5320	msedge.exe	127
PID 5320 wrote to memory of 4652	5320	msedge.exe	131
PID 5320 wrote to memory of 3672	5320	msedge.exe	132
PID 5320 wrote to memory of 3572	5320	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\Roblox_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox_setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://small-games.info/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffd26dec188,0x7ffd26dec194,0x7ffd26dec1a0
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,8523530155185898104,17672592855262005036,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,12647900919074247346,1985815048988357726,262144 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,9308380599492602595,9614173646103167933,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,8772419717772405376,114260646738156568,2097152 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9488712558332813827,12906888524273684732,2097152 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,11326437372391582162,11530858939198150829,2097152 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3908,i,7733948432570148188,8811058676474323738,2097152 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5360,i,7423617732095816182,2146285088768192494,2097152 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5108,i,8451649082966586211,4877957399855212084,2097152 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,864982604854431975,6726263613112555615,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,7575198506951489111,2979823726937230683,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,9906387164697751674,13452389102014418036,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,9906387164697751674,13452389102014418036,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,10960114230789801786,5357029529313443727,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,4022090137427556105,12871403770195847127,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,5310537902038733342,15705263852779419538,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,5703427240765761844,13749715544090098735,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,7735980296492834849,12956693539210511068,524288 --field-trial-handle=2224,i,11830767754850652988,6918215107725315447,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd26dec188,0x7ffd26dec194,0x7ffd26dec1a0
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,2024246581414055181,14848098200840696419,524288 --field-trial-handle=2104,i,13682898716889728010,11004680844337828075,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
      4⤵
      System Time Discovery
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,15167164350374410074,9913519598666518346,262144 --field-trial-handle=2104,i,13682898716889728010,11004680844337828075,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,7201147873202021777,13095802165181312639,524288 --field-trial-handle=2104,i,13682898716889728010,11004680844337828075,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,4688339402686712655,13783311914805852072,524288 --field-trial-handle=2104,i,13682898716889728010,11004680844337828075,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,4688339402686712655,13783311914805852072,524288 --field-trial-handle=2104,i,13682898716889728010,11004680844337828075,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,7534316945781175187,11669744873752124753,524288 --field-trial-handle=2104,i,13682898716889728010,11004680844337828075,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,4171450190318263537,2668724418358628992,524288 --field-trial-handle=2104,i,13682898716889728010,11004680844337828075,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,16079027509098759142,7398918505583496810,524288 --field-trial-handle=2104,i,13682898716889728010,11004680844337828075,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
      4⤵
      PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3048

C:\Games\Roblox\Roblox.exe
"C:\Games\Roblox\Roblox.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:5304

C:\Games\Roblox\Roblox.exe
"C:\Games\Roblox\Roblox.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blackBkg_square_slice2.png

Path C:\Games\Roblox\content\textures\blackBkg_square_slice2.png
Size 160B
SHA256 6a4afbbfc85e32596197cc938b0864def36a0c849008b89f1b1dcf3def9e408f
MD5 eae8efc3bd3c033535fabb5143ff27ac
SHA1 c7e99704d3738c6387de3b75f0d3f22e68cc4508
SHA512 0280579c41c53a564dd3cf7836ff2d01c650b25806a9919e5903e84705ce4e1d8cd47aca39c5e3f0ae73abc6d96c1fdaec279773a0c61710d381620d5d7ca22b
TLSH
T176C080D3E78059D8C55D01D651724244549755AA942510097714D4141478BD44090643
MD5 SHA1 SHA512 TLSH

Submit Download

blackBkg_square_slice4.png

Path C:\Games\Roblox\content\textures\blackBkg_square_slice4.png
Size 159B
SHA256 6b578116c55f2fe4058b6e2732d692315c6541fcca9da5782058fe99642d78ab
MD5 da5ae5480215ba337de2adb536021778
SHA1 f7a9b86fff472a2cb5136c5058f267d9c9d19cd4
SHA512 ed94313de59d792ec7597026e855c930a17e437d2f24a2bab4ee650440900896656fc410a31c369fa54a8ef3b0b4f61e175597d6cd7be33d29def4c9bc778690
TLSH
T1E6C08CE3B7548EA8862D812691A34144A0AB53FB9C6154287A68E01D00ADDA882C4653
MD5 SHA1 SHA512 TLSH

Submit Download

blackBkg_square_slice7.png

Path C:\Games\Roblox\content\textures\blackBkg_square_slice7.png
Size 161B
SHA256 b05d29d2f9eec96bb00cd1289ce75763b8d0a673d4bc2b81bc77331d11f6e438
MD5 d1f1044a84440cc53dedc573259a7887
SHA1 d414a9da9215250721ebc81cb0542ae4a530ca4a
SHA512 54e1d6d73ad08e977694675b1ce8910ee284d29831a8ac5c57490f74b70f787c39fb9d73116916091e4eefeaf48218da37be170df860f4e520bc9867d5b08ea7
TLSH
T138C08CE2B6819AD88A5D426A12A2804094AE52EE5022181EAA18C26851A89D881D1682
MD5 SHA1 SHA512 TLSH

Submit Download

btn_redGlow_slice5.png

Path C:\Games\Roblox\content\textures\ui\btn_redGlow_slice5.png
Size 2KB
SHA256 aa6767cce4ed86febdfedce6e8519e4285e8467837da768d99e4080551f9fae2
MD5 06aa795063b07aa06789355325e4ae64
SHA1 8933019dbb18743194aaa2684adeb26282f46e52
SHA512 430ba0eec15614495249129a849335e071bccad09330067450f854f23dc16de9688168cdbfc96936ff9a514da9082efb8cbf4b8ce3ff732bd4e8ea5e5d3bcd21
TLSH
T1F8517BAF9A60A08F7C8EB9420DCD0202E768226C99573B3890C165DE0091D076F660B5
MD5 SHA1 SHA512 TLSH

Submit Download

small-games.info.url

Path C:\Games\Roblox\small-games.info.url
Size 50B
SHA256 64030dfb4f3b9face0252a464d3c96e1e757cde2bd28604d134a1b8c2efaafaf
MD5 705d7159a663cea1b3db58bdedc96f77
SHA1 04a1d8bc075829ae8f05a8def19a95352855808b
SHA512 682d38c4296c47ca28e4f9b672313b94f81e0995e8a34bfed3f2e9c53b45b76dc127c4b10af72e973fa2d8a3a84754df8a7951314df88b1595a54f5767dc8b30
TLSH
T17690028E454A80A682564A8C50619650CC1570D9415BC854A150CE0518864419588B08
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c87a64e1d2125148247c09afb02df2782122b54d8a0688711dc68ff824403145
MD5 7e8f9fb22a99c46f608448a001e8101d
SHA1 51e079b978173aa097c5a765f786f2f79f4cf20e
SHA512 0dc870e3c1f47e8da84071b590634241433c132c2da810ca6807faf22406f455c4d3b35effeae4aac48bc300a17be405ce0adebd94c8a591e22ca177817b3cc9
TLSH
T139D023757795B007C29D04B2005186D5254BC48534CFC3C5F129404D58E91DD77E75D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ee030410919d7b4e987fb27ffd7fd5ba5627afb61c27c9e1b4fdfee0034b902
MD5 7f7e04adac04a9caf8a6f083a82e324d
SHA1 6660d708348456ae9e6eedf62832ed64c84d053b
SHA512 535ec9bd0cd271617e8e40e9c88c7075c6bc81e77fffbac36d3f7159c3790aa687227ae3ca2241518d99b7fbd00731947365d6e34714e9419031aca6a457b1d0
TLSH
T1F1D0A7F87B587007C28964B2545196853297D18535CEC3CA602A941D58D94D872E6647
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 261cfb2b5592bf4eed0c1297f834d0d7aff2327b9c2307cb2c7386d44aeea6bc
MD5 2d34f572ff4fa2e1668cfab72040d784
SHA1 f63793be947467e583739eeee6c82deef12fb9cb
SHA512 8a85b5d6d2d2271f68722632430f4603b60e7b0b0d8f93b035a34b0cce32db16513b4c3d761786e66b9153abc5819307b4260b27016eec307e75daa2507320d2
TLSH
T102D0A7F87B547007C28964B2549196853297D18635CEC3CA602A941D68D94E872E6647
MD5 SHA1 SHA512 TLSH

Submit Download

3b93b544-c25d-4bf1-aa4f-9a21ed69590a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b93b544-c25d-4bf1-aa4f-9a21ed69590a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d53389b49d5d5cccf48a5cfbcee0a51440eacd447eb20b460b3130bfd6f5a464
MD5 81d7648c4a68dfca86c6e0e102b9fea3
SHA1 1c7037e7c8fdd9ff532dcb6b5997a5b2d9ae30c3
SHA512 3667d00d548088b909c4a53c00a4aa49adadd637fd6c310ba8a1f8cf7a594241df3425746794d30c358d31a48a6e318f9e1592ea1ebf3653e607119e6bf47434
TLSH
T11AE02BAACC319C2B15FA471920228B46EB51235B1F50884B3B3D92088FF0A3B0556C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 53b9b1b5c4eda2553900e32597a8f7504f9f1d355f774bc89af4fd6f30ae5606
MD5 e24d44ff5fdec7e2ce820cb28646d426
SHA1 9536f4c33e046c90f8caf680cf1b08e95b1699c2
SHA512 8d0db9411cf97f45f2b897f4bf5e6c1e9bb754f77c8fd7cc6eb42758220c2c3699d98b0665fbc5afe04262ed30c9aa31e221d4db7c22f5c73421ff89d86eff14
SSDEEP 768:5DE+mDc2YNZz3MA2f9sRnjeWQNLxgJoztmqdT4M:5DEHDcBNpMNKnjeWQNrpmq5Z
TLSH
T1001381FE2A094CD3EAD6153C1F4BDB796B34DB35FA80D9373231308646AA74A381E641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 54cc82b63dc3e812d892bb000b209cc84e587513c72a0fa919da11be5231ad12
MD5 cc14cea2de93ca0785db7e75314fca38
SHA1 68a5aa3720979b789244ff95c0636bd097b4aeb9
SHA512 b86eab6133cb0ea5dc488dbc2298f72d11b388f09d9100c560333a311fad9010492540914a2642e88d782068543b7c5beb01df2e0aaf091665ddcbfa6d3f137a
SSDEEP 1536:hu4kV4I7R8ozXpMhZJfKigRO5RAvtqyoUiOC31AXGVjJNIPKhwA6k3075n1/uIm7:UH2ZcG+0/AXG1JyS5jk7hhv
TLSH
T12EB460FB0841A01BCFA802F5D2033A3DD57B451D6DD9ECE9E6780C952865B22B6BDF48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 57f3c58c1aab829414c4fcf70750c351be156dfd3f49c6ec36152f9ad906e133
MD5 74955999ac65ef77000551a726b91a81
SHA1 69df139f073386a14c31da4027a8493a10063e84
SHA512 31534ac7e6e26a90f15f178687a440b3a085ff963b3a5c0505342e8c70d4f0ec07fb8c59b0dab152354cd7e642a3bf17248364c0217812ca4de6d5c79819ff92
SSDEEP 6144:z5SmWGbM884fGHA+30CGDZGVD0PQyCC9:z5S4FfGHA+3JGDZGVIQnC
TLSH
T10B258DDE9F287883DFA68D70F9E4EC127CB411C3B58AE0C35809C96416C63C6679B69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 d87873a0f20952082c4defaab9c665d7268147dd7848d0c2872d86aa50265f09
MD5 30d3f12d27aad846286333f7acc3dd47
SHA1 c18a62964bcdd49733587b20dda2d3766e9aceb9
SHA512 2d82b4841dd9652c298123a4037c9a1b557712d0d4b83cd70152bc0ec793afd737102f31db3f05f3790c5eae3cbb8373d3b61b1b473505bb7ec0b311618209a0
SSDEEP 49152:kmCVWeEljQv2V7A+WB85Tb3IajEczHfsNfN9tcy9Wn/:CVLmjQvCUGygcf1ps/
TLSH
T14F869EEE8A785C83DE638E70F4E0EC477CB412C3B999C1D38458C558529B3C5BB9A26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 21KB
SHA256 2b904ffaee28de0fc214b9f8a32c23003f736720a633b78b9ca8c7f5ac98a314
MD5 b506ba49f8206be847aec8a74b1ae7fd
SHA1 d626ffbeb9ccede1e2ed008c1c65c29a80843358
SHA512 7640c8c8ba89412397822ea9a2a39b20ba1b3f372af363792ba96c6efa6356d48d83d7444cae0fb53032719e43f3d6b1102df2db037587c08cd1363aedb929cf
SSDEEP 384:lUs98mdiTj4A9sSq1YNmb9PLS4vxic3prGpW9DwwOtEyWuvT/nf96pG:v8ToA9o+NmJZ3kWmfDTnEo
TLSH
T137A2CF33990A90E6E50247DB72EA901C353CD6A0CBABD7BD518F02C0DED963F525A877
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3106d48f6462239f0bbe973957f07b67b0f67698bdc95e8f0b303925e5d3a68b
MD5 1de0772a9692223d4fae4ca62b4db6be
SHA1 be1412afc141af31b5c11c7fdd106d683bd1a619
SHA512 327a23032be3789b0fa18653d48bf324cb7e81c035ebafc9ea6fc41136a1415269c2f6dafddb623a48cd5aebd197d42e3af01a5adc976f087ca5139df7534f7f
SSDEEP 48:v6g90AIA9QTbjQa6kVngjK5Zz2XQEWaAF+BPV8uzw6fYhaJfTWIz:CH3f9Vng25+BWFI5vw6fYh4rWe
TLSH
T10D8150F02B818496F7E805F0EDE1CB6932F6E7793527EF7635BA163D5A4A38C6808410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e51b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e51b.TMP
Size 2KB
SHA256 9c55e4a9355ffda31f42d55f67bb35f80973749c55c7ce1e63408d0d88525a98
MD5 7ce16d943875d377c0dc7e04f953db87
SHA1 a2a3b2789efa1cca2103b9a8dbdcdb8501416cc0
SHA512 b6c7428b751b09afe2641208d84f678f54b2e825a56ff310bf3e42883219f0cc8e1264862651cda4334efca3b3205fe2ee629ff5bd68ced657139b7a1d050247
TLSH
T1C45151B42F459969FBE908F0DEA5C03E72F09BB9353BFF3A36B62B7D2A156104404521
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 2b23fe9acb3d997c9bd2c38f7a880d102da36e9e35651681d53fa2c854695457
MD5 b361dfe247f179e4191b95ae74f1bddc
SHA1 5ea56e1240d2d7e5bdc6d9aec093433f871c8eee
SHA512 ead013165fd22ab9831ddadef98148926850ed97311fcdd3c103a4010889d821cf18f717fb85d998f744ccddf03a2511216ae225416dbe72adf6468f6a7805bd
TLSH
T15FE0209975C6C15DD91434C7D23CAB18C3C43447DBC66E4B2B04CCC07602111B6C9757
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 34ca67d6bc8f1da11d2ca94e41c0465bc95905ae7f4af18cfcc443a0663a8a66
MD5 5d8cbdb81c3460981045c31616e726c3
SHA1 d811a2c367a9d234d0acb871c39c6379068103cd
SHA512 73cf5020211219178af6e6caa9518ad8863e7cd1c89830d0969b9c4543f75e40f72379410d513e58268f0c9eab81bdcce6dee0434a8c89f9ce62cc92f03f36a8
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jFFW5LzzK5fKFtI2qYpG:Tyi+7f+UZD4jJ/BDWxPCKFO2TpG
TLSH
T15FE2CE8D3B11F911C8FD733DA0C2C6E15EBC692C464DB171923898768D62AA1F4DE50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 cc82614d0c8c0939107e54a4d98bce25deb3a40b6a4d922d3904be616e6a9106
MD5 3c2788a24509b448e7fb97ab635f84f6
SHA1 d27347e70df4b9fcb53edc0db7f5b884e1c59189
SHA512 a2a2459f4b8f9c3d9209086520656545df3051f628781db63c0c7b462a6b39b7f2f6cb8681df5762570ed877c3ce27b260623fc2feb9dc186b743cfc144abae1
TLSH
T105E0262D04C8C169D02868EBC3EDBB2CC2D23812BAC83F4A270BD8C46181381F29A790
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 e2bf7c0606f5c8f7131f23a96d75f2fb91d64680c45d2756278a9b781c2491e1
MD5 82c098ffb669a102fd9e78c0042c5b62
SHA1 e80e6287271dfe04448dd693121884028158f167
SHA512 d7dec53ccbf478b0b55b5a4ea95a0a5d9ee8c6eac65fa4f8035e2aadbf28f44354807b311b49b2e41c954a8acf08025cfa35d5d3bff96d9e046be92138af734f
SSDEEP 24:LLBQJY90+mhh0GY/l1rWR1PmCx9fZjsBp6UwcECjz+AM8RdeczYJA/0g/fYH0tmp:uzBmw6QU1Pz+AM8RdeAcg/RYsNM5Dt
TLSH
T14392728B4E743813EB941FBA212B0975DD3FE16D6FA69C40307588600CF8842E039AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 e2df724ffd99a71f48757bcf2afea18812f80fe0478a631e99d27e70dba2b8fb
MD5 7361be5fc6a4c3a1d3065af62b2965c6
SHA1 3cfaccd1359ffb5e9faabcea2a6c72c55448e54a
SHA512 2974a598e7851a86f203fbfa6bf14ae82a7b770711caa0672092b21b7e56a668e00e40490e05a87de0c443109d3ffb42ffd2d020b4a7e1fb680ed1eeaf1ba506
SSDEEP 96:HpQtTTIU+bGz83uy3+u4tgp4DLjGQLBze9z3MtjBHMsDEuspU0wbtqrOQpPfR4JQ:JGTTf+G83uy3Ct7XBBK4PH7DXspU3iD
TLSH
T1EC14220E5F343722CDBD517669E744B35D7CF03F8B5266DA686114B0CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_small-games.info_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 5KB
SHA256 c427e04da12c94339041236b0b5782b8004a11ea84358d72bb44973f81e09ee0
MD5 2e1ed83effb66985745b0564e8096b83
SHA1 a6068646c9e59775ac8929f9266f6878da81bb71
SHA512 80a9c50f503d25cbb24db376d0086d56a8f31975bc0e6968f45653360bf15aa639317fc01246d7b57d86d3753ea61d132da412218730f2e1134ed0560585be6e
SSDEEP 96:9pV6MfHXeTqpHysxAwLMtCIlgrKEE8fQYMx:r0SHMwLdIlEE8on
TLSH
T1CFB1FDFF248205FA9BBA53E2040B72ECDF7A952D4CDEAF4CE166E90401D08768495F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 67f36f8937d8bdf1389e17c2ab721027ecaaa79fa817a00bdf18f50a81cd0f88
MD5 3cfa45c9df2b2ff39606ae520df7cfed
SHA1 c244775228a84d759d47cf701256b84a3f5204af
SHA512 33c9da9a7cdea340348ae4274e5cb46b8d15242317917fb8a54bcd0dd21c7f4f5186d6da88f5b2ae36b18e454ada88480a8d9709e04d2f2c290da0bb1b367c23
TLSH
T1CDE0D87644DDC159920920ABD32DBB1CD3E13816D6C82F491B05DC44B041244F685BD5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 bb1c8e7aa5406e5d922bea2577ebad294341cb9d42f834fe38f67341aeb4e920
MD5 a325df7ed0e2a4d3ec03979d8e6fee16
SHA1 f6e1d2eb7d8539fb1e2c6cb5b527d746ccb88591
SHA512 3fb78a2358470c44980a1d29e119d4c6927f80d035241416aea6c29ec824c963d1553a8b3ea33aead5209823cebc7e48f0cc4f4612e82f48d67703ab151fdcb2
SSDEEP 384:DLiJPlxhahG2N5BkWj9Vq/61B7sVLhfZXBwohRw20yabAIwhpsVuAxsFcEBkMGMa:0C7OfXjuvefc
TLSH
T15B523BF7C3E8CA7E8A1191F4BE196E1BCE5C092807AC395A85E57F1A63E3470D20155F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 24b4ab654a1cb90fa98ed06aa99d628c274c13adcfe7c92527435bd4a3a2a585
MD5 5ff410948f2553afa3ddba680c30aa96
SHA1 ff4fc5298a4dbc409748e2bb20bfcba01119ee59
SHA512 6248ed601adcc36cedc0dba771a860cd427c0c1973b75e9a5c99f9f3ff4b050ac7359c1ba47447febef7e400055ab7acbb2b2600ed3e70aac7e2c9e3c00a2fb8
SSDEEP 96:s+UCQ0UHU39UxA0a+UBQCUWyCUi1QpUzEYURQ02WUCLQZUBFUGQlUyxU/QYUz2TQ:JUOUHUNUxBa+UvUzCUioUgYU8WUtUbUV
TLSH
T111B17D5B96BE741750B80DA71E08B80DBB79A4390391B0F9DA77C36C70D28FB471947A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 5e8fe44d6ba6a25fea9dcba2d2e8824d59e516906db6b084040e3cd3cb6daad4
MD5 bd2815af0fdcd23cf23df929c9b73a66
SHA1 7ed3888cb602bcfedb6a472056df8e208e7377f7
SHA512 54dc6a80e274d830ab1854746ecada5f88869aaa09a953652dc68b9f3675637bce47b6fcc193f6d75064bed989455679b09d7aaf825465075f0ac2cabc4925b5
SSDEEP 384:sxZsqk9/f5skWvRAnNovMWHbR/PZ/7afBHANcrOWlbM:skh9/fJYRAwHblPZ7afJANcCWlo
TLSH
T177A28593B5741ABB4FEA5536F045F72AD6A4042796904E826AFCCE0C08E7AED7401C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ce1c4a4050c844c6eac0453a6c96169c8096cfafbc338482007623fb8d413c28
MD5 146b09dd489f73d803dfed3d7434013d
SHA1 46e468943d915ffd21ae35c5150e3e598a391807
SHA512 37fccc34bfd524f09bd2b07be1e829bf9b55911754d9149abde512b1b4483ac7535d6dffa80b2297f2e952fe1f3afbfdd96e35610a4e6db7a7f0a78b5318c3d5
SSDEEP 384:sxZsq79/f5stDnNovhWHba/PZ/7afBf0Ncfjp:skI9/f4DlHbgPZ7afB0Nct
TLSH
T1E2A28493B5741ABB4FEA5535F045F72AD6A004279A904E866AFCCE0C08E7EED7401C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1884d5f181911039eccd8ab2fbb405b9bd0af8e6f48310b8b5d197039ee845ef
MD5 07826940e2f5f54400a0c4c4ae0ce8e0
SHA1 c3ae34a3e824d5692d8f788327f73251e042576f
SHA512 87b082a5f5627f7100c8a3d6be262ea23884e66995697a683bbcea67c255141ff20ab314a9cb4221529af26ad23ac772e27e73d308b72dc276cb97649cbcb9e1
SSDEEP 768:AasqZmO7pLuLnKlWvBDkT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJEx4Llhf51Yrod:AasqZmOEnKlWvBDkTu1jaIEx4LXB1jim
TLSH
T1E1F20A3B6C0CCB7E4F804E9CDC2A7E9E6DE8018B96D8895447F9881C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 b26783c7803d567a8d136dff0d6f7823802b86c7f60ee14998d2647d8881d15a
MD5 e54630062ec7d1a0be7bebf86cb3e2b4
SHA1 0f15ce6ec5ce8df97e0b3dc00603562135a56b91
SHA512 d7bf746e11e5f7982bb55c9a88bdee1c4f194313fb6a5d9f7a9b9293304c0e691962b14fd40fb3937ff90333e946f3412b0009e385ed20c7835e41672a3a9213
SSDEEP 768:AasqZl+7pLuL/BlWvBDkT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlvEx4Llhf51YrL:AasqZl+E/BlWvBDkTu1jaQEx4LXB1jAN
TLSH
T1E2F20A3B2C0CCB7E4F804E9CDC2A7E9E6EE8018B96D8895447F9881C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\8bc8eb9e-1597-48d1-a826-bcdb9f3fe04d\index-dir\the-real-index
Size 72B
SHA256 5926b319236e4cc326d6002a2f43b45fac2aa476881d1aa00b223f1c26764b21
MD5 93b075daaf364641e332643cc9bf6ab2
SHA1 11c5ff973719e987a5c8fbd100c960f25f645c72
SHA512 2fe94dd75dc813046205d279e15fc456cdf49cbad41fbfb0179c56b022a78db7b19f163ea4b3f46c48602dfeff9a28731a37b8efdf76b917470808dad21250b8
TLSH
T11CA0025841C0102BC445077422E116643338AA6503076B35599025649FB57804511450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b783.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\8bc8eb9e-1597-48d1-a826-bcdb9f3fe04d\index-dir\the-real-index~RFe58b783.TMP
Size 48B
SHA256 e2805b24fa069fb4247e5fc06a36ae1bb8e3a55e8097ad1a98c76b1e8a650cf8
MD5 b39ceda7cc7057a00447edc6141061a7
SHA1 555be0ff5f8b488bc29c65b32851bbdddf59ce77
SHA512 e309b856dc5dbf315b4919852202f32ae0201a7042cddafee5da726084d7b800bd3e8a4cf482539efed999181bac6cfec555b6e6587666c3c3155110177fe3ab
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\c8568357-764e-4bcd-b8cc-5f5d3b9c8324\index-dir\the-real-index
Size 96B
SHA256 e84363f347a3bf0706073f715cba94e5e5cefa286ec9774bc0e199ee2abeee14
MD5 8548a2a992f255e5ed80a2a067a02a17
SHA1 4847b67ea1fbd3836478937e327736cb6c827b3d
SHA512 97299fa865ad08c09a9ada0ef9ad882a63b3e743edaa9b8c1c23b870516ab7fb39b81bd7b35b9495a3f9d6dea3a30c761ea97aec979eea6943ef2d9d18ce657f
TLSH
T15AB002F1D192040BC1058B745DC79D823538DCAC0767F72680EE217CA7207F0960381D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bed6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\c8568357-764e-4bcd-b8cc-5f5d3b9c8324\index-dir\the-real-index~RFe58bed6.TMP
Size 48B
SHA256 588113542dad7c8e01541553b73110889037aa64cc5f695d3b5113fa53782fb7
MD5 262e7c2ef2d95389dde194e13fbb0852
SHA1 50236389d77880a6c2304d9a0399bf33ee614e36
SHA512 77d47683a3a20bdeed071d4e4d48b5d1e0902226f0c5ffcb011cc3033f51b9bffe527be97985d1711a2ec46dc5c32c1cf65cf2d93c8b2fe2b20f23ec60822547
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\eaabcd36-b580-4452-bf53-c9d345e9419e\index-dir\the-real-index
Size 72B
SHA256 b43390f0cf5b12f6c202d709a14069eb36c71d5349dbb43f5c91d6264155f5da
MD5 95f9aea2a1bde2a3a52dc435cd9e116b
SHA1 175eabd777c8eb89c8dc17e11b7e472a02657f97
SHA512 e18f93961fba21b32535b63ffb01bff5a76888512fba428643de4d7dde547814c9dd419805c0bff7750443dcb1879b3fa7e4872ebb9724cfefbe9b35a44e4cbb
TLSH
T102A0026C15550316D805437C1A4627D07634E814A9475E1D50A5045DCD50153423369D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b7b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\eaabcd36-b580-4452-bf53-c9d345e9419e\index-dir\the-real-index~RFe58b7b2.TMP
Size 48B
SHA256 f2f6a8a3e14d7ce4374bd12ff971d1471219056c31eebf06500fb321c113c465
MD5 752bf519a6b582daaf6ce0056af92e19
SHA1 0c514bfff356a1c3516dda4d0ba4d15a2be246d2
SHA512 2f3977a46c20b855e7b26ab33eb92b12aa64afb27aa73a284e5c8a220cdcb13184ef3349b4d7e3ecf42413c3c03e6677665f42cd294a3038019784d7a0e1e149
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\index.txt
Size 231B
SHA256 94c768646703a763b0f3ec2d66db001c3ec1844ff617629ce8dd81b18df0dcc9
MD5 50440252c3bd069d2009ceedd8012cb0
SHA1 c8cf35dce89175f62c2a7d68a743701b735e9edd
SHA512 ccd721db272aa12860e0dd97d41f83d9d1d468ea244ed8a9928d164030444f281fabfde3922c1a37e987fe2d9d81a28d8f42d4a1e456fc5cf24bb876eed70814
TLSH
T12DD0A75B02568536E79447C2C8B66BA8897BB90D49064930A051F00894F15438A40F65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\index.txt
Size 314B
SHA256 d8789331057c2a08fefe18e93d54b6e0715eb02e4cb6af6421d51af378f71525
MD5 a495fa19e9ac7c854bd46714bcc10920
SHA1 72ffb509525d20c0aae504a0e7786494a455ada6
SHA512 13d4e43377b64df3e1f523229d0b2e55c764d2c3f23f5347f05eba55967185b98e6f2c09ebb35fdb4f1d318f437d2f3d823194227f16cd999ed5967ab82ff13f
TLSH
T190E07D071BD68627F7D083819CB72FB4CA6BB84FE2168D389020A438A8F19535500F47
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\index.txt
Size 308B
SHA256 40d1990da2cf687321ece73ff56c1cbab9033b69f597453892bee4b26ac47bf6
MD5 fe74dca98cb61028322c56728b237736
SHA1 03f2bd693f94c8e2f7e09ad122d0c37181eb9532
SHA512 353ab6fc4e16da4be0fe8255e31785da090c92761d24334d0612717863e5dfde96bae57f694c46ccdadfae328d260d473428fa9055ff197e09095d116d5de0be
TLSH
T148E07D0B1B82CA27FBD083809CB72F74CA6BB04FA2268D389120842898E19525400F46
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586954.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\52f716d1023245888ef4dd88c8506c5887001faa\index.txt~RFe586954.TMP
Size 142B
SHA256 6bbe629888c88218ed3b1e352add9c4a1be6277c0b0dfca9623349d1afcd6155
MD5 296f912b4ccc09217f9202e11e4eb0e4
SHA1 71746e7910f4c053e56c6d3513fe47746ebc93b8
SHA512 8c7a5c4a31a801b7d37bf54ab495f8d4f50107fa86b161286f178d55b5e623c0fdde8a9083db176e4e1228df9854ce59cfa4d8e0509d685f058a84289ec6d1f9
TLSH
T1C8C02BAF0253843793C403C050B33BC8C53BAC0E47490824B010B40440B10134604F44
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 16KB
SHA256 d4ddd63f2580e3311345bad271b5a10a8ef35f121d9b85ff9dea627bbc5335fa
MD5 cf5a4242c75fc9bfaa455b0910dc6ed2
SHA1 e23a3b69a45f09f323d27a5a45a39eb6b311e1a8
SHA512 ad0c541f25158e86638da6861d25ea8b828c65eb43683497b7f1fb721cd10cce6aff2921c3707260feef86523abb1aaf9915107d6ac8278d23798b8891b37743
SSDEEP 96:F1m5HOlWpFY5m5+cvrYdO/ML7opFi4WpFYV5+cvrYdO/ML7sWpFJ5+cvrYdO/ML+:F1YH8Wv5Z4/o9Wy5Z4/sWd5Z4//yvuVO
TLSH
T1E772DCA69B51E09380C4B3EB1432F5D9891EE9477EFF8BA146EA8F2C51413D76324B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 6cd8c25377b6a1fbe29d500250cf4a62bcf003b15ef4c804c37e0a9696361700
MD5 8a9b2da93ab8315f03ff489c9eb360ff
SHA1 a26d3ee49d8afc03543534fdb3182b35d1fc0eb4
SHA512 b059d6e987297425dc97201eef2220c6309c3ed67c807285cb5e3cc77cf3545d770538f04e05bd1bc979ee8a486d68b5c92347265c8739445fbb315edb2d0630
TLSH
T15BE0262905C8C2BE701A24CB832DFF0CC3F5B42BD2C83EAA3F45CC446142704F19A292
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a3bd45e9ecbffba7db399ad00b815d0613e8dbcb2c3d94a9798de78823b0e89a
MD5 1c7cbb2ecfc325be2e1d7d6aef41cf00
SHA1 bef6c33177c6b085af3f1ff8ac845c1383ad6dca
SHA512 b8ef583309979e5d4c1dca848796fbd2508e097590d1c4b2da1f08483c34a00d6bc5778f9e9fc99b1983a66b9c8785fd724d65c915626dbb6f2f0b2e5e76c54c
TLSH
T181B01201C04AE101CC260A705668155A23A08D6C4400931144F9F0ADCC4304495D214E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 6647af5d42f63e08a006717030a3845e4844749ddf7e4ca2341e6d1cc68c31af
MD5 391388589e83cbd2ad5e8b42a7d13f4b
SHA1 0b9188b7b39479b39c8d6a5362103e65a742ae72
SHA512 a7bc809777ffe1e0f3b85064ea4f43785a2cad2bad460f0ba43d782688334474a921d4b8f12f692fd23a6c80369072925dea5b4b5b1c401c6548a268663b16b6
TLSH
T103B01280BF005511D4DD063241C0EBD0B250F001B000874FC8D95F114D461E93F00C99
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 f62f791f92994929391d3811e45d4985b637ae1854a91dd05954d5b8f4359038
MD5 95e90287f5ea3a7050bddf036cb23000
SHA1 a3f07f94a6ec58dfd0cd40dff3b1ec77a994fdd3
SHA512 4e1b83ce4c2a81bda29b759fe368904ff65937b11573e2c21791e20459acc54123e09fd94d52bac4f582d9dec9983c5572661ade6b44d1c591202c577257c156
TLSH
T1C8E0D83915C9C66A614D30CBD329F70DC2F37416D6D86E7A2B09DD8872063407647250
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 84629eb13e939ccdf3a4bc6af03c84c10fdb5bc3fbc65c1f0a5a194a65c5fbb1
MD5 3b7a8922d918186e5904c49bac2c1917
SHA1 6839d809a666d0bc873d196df750a1d16162cdce
SHA512 a90b0053d5b5738315e01d66f8f0b137ca50120bff0ea2a6c831174e4fbcac110187937cf0b69b5e5e90571e520e294be32b5cf3017275dade3b8175722b844d
TLSH
T1B2E0267945C9C679501C60CBC3A9FF1DC2F1B83693C93FAE5708C884A102200B2AA690
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 36c9c85be2e17aa0641fa482517e80ac738b9e448d5899dea7cbfd550d0150f7
MD5 3c3cf8a0d870ab12def10a7b807d3275
SHA1 b7f301250ccc270eace17c66a7ba4702284fa25a
SHA512 da395ae95341467c753d3d91035a4206233982f4268b9c424b47e9e3fbdb23f91dba4090bb39d3f5c8b8a137103db79aa9fe2caacff6639824240bd0dd6a602a
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnI:+BOVglYXrbtZqRvJjlC
TLSH
T1E4B25F11753B07803A7E298E9194B46E62C170A37098B43B7BB944A64F6BF20CDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 2576fb3a4bb5a6e17aad2cef542cd3704487e2cc1a9e425dae1e638b383d6e06
MD5 5e973f8a7989fcc3bd3d3e55d33c4c6c
SHA1 34e4645a428282d4fea15f884e825f4f092d77b4
SHA512 2048e2dad8e49d41fca9bd52fe7b19a38dc4c7a0e348b91e8befa3355f20400bd83341072694a7c3b96a85ca8e45ad3c9ee8b6e3b4fce18d91cfaae2d75755d2
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnG:+BOVglYXrbtZqRvJjleJom
TLSH
T19CC25E11713A1780397E294991A4B46E66C270A37098B83B7BF944A64F6FF20CDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 312a4100a30927e6c255bcbbad9827a405b8050938a554cbcc18ee40b7c481d0
MD5 c5fe89fde58dfeba81e75d7f3e727264
SHA1 09886898bf369ff5419d4454697d56e561fba06a
SHA512 46e155436978b7c751f26f13201d79522a0a7d32e748ab32bc3fa08c038d5e79b0dc81f19230ff4ea7185615f136b024d717d24c5d0cfb3c2ae5898bf69b280e
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBg0334sJDKMLUNW:DEtSyGhp22iSV4s1HL/
TLSH
T15E52EDEBEE24215AE8E592768E9011D47DB9403D4FC6A71314A91C331EF4164926EA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 c3de55cb0ea28e793d8ca778f2f985566f865e2e6f0eed52a1e4f8e8dca77889
MD5 1cef843304ff1b98e7ee9e07a122750a
SHA1 fd610a8c94372a500bf7148f11bce32bd22c0d56
SHA512 a72c35815c93c0a4904f65ea9a49e093a92c3b52ec71fe95b00fe27bdefd00d5874fa236caeca8460c87f7bd40370409ec424f4e9922da61dd835abb9f2195f5
TLSH
T1DA516BD293A564C5AF8DA981C21D7813B8E13E6B260E5C71336E44F95F888248F2FD35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 245767e44ddec10421123ee9e2176656044d3721fbf4bfd3475a6c37b8bc0419
MD5 7ce82856e0d579457232ef31037e274a
SHA1 d5fb746098e76cf252433161d03590d6fa18547b
SHA512 76ded7ac0816a9949b8ca86e363eecb3dacb93fa399bfbe5e53df895bddbf6d3739b0b950cad40e2f1efffca851018d75c0735365741e7576fafc06dd2af35ef
SSDEEP 192:v8OHKmAs2tlrHMrs2GFf+vlCQDIIIqb6MIM8RhYcYCrs:jHwsSsshvQDIIIqb6MIM8PBprs
TLSH
T1BC5271292A051B33E15E5F77036ACB965BCA88814572223E35211C1F9DF3F678BD92F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 147adb8cffb7a4c77380af7a6cee62affb7c5dfd2c04bfe340c77848e66e2edd
MD5 b6e2cb1a2cf8c867c92271134f45f8c7
SHA1 9e7d372c6efaed16f674b9ba1bb4692d66178f60
SHA512 cdf217b04c81fc3fe2f0d5fec47b35ea7dfcbf819b942f21c2da930ef47d07ee8d54fc2a9ed3e35b43a3efc55a2f5be32d8bee13df4883922560cca350d76f90
TLSH
T127E0207795C4C19EE01D20CF935ABB1CC2C13C17EEC42E5E1F01C45860412007249691
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 5894fbcf7b7f65980cf71695b8836e26d85147cbe0979c7b2935e9faf9f60ad3
MD5 a74b6dbea75bc7b6fef149da4e7c312b
SHA1 88f3b86f917f35c5f25069f3a909d29cc3558192
SHA512 54be49e5602bee87dac845fb79464db5291ee8d86d44decadcceecaa099d5d9069cc9d32054e7181a2c3acf5100676bde25f103e90133b8b36d52d407cf4eef2
TLSH
T18121BE41F320C149D18E867E502A9B361738E8169FFCDC0F84B964652E72F040E8BAE6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 e2e51bc02cf3886d6d41da63c346b39b5c734fdd8f7c09f7b5957617cb223b46
MD5 58189cd3dff72a5357b952f44712c207
SHA1 38524313804ae43e57b3bd1190bd3fe7de712b4d
SHA512 f84eb40471a9a2dc4da664a85c5e95b7dc4386453a8de055f5a7fcb9a5cb91e0e0eae8b8778bfab9b476c564996be6a39a7c8805cae7d08b3765435b5e15dfd9
TLSH
T135E0D86665C4C19F901924CB836AEB5CC2D23C27EAD42F5A1F01C8486181241724A691
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 868a8b7a87c7646dd34e0d2e0a4dc4949915aad791cf0d67f15cf3f73119e63d
MD5 f6f96c5570a28b2ffc05c53a04271c2d
SHA1 da46129af9d96b65ff79a405d078cafdbd8a45b9
SHA512 3ec889d780c7273fef5bb478c82222867d2cf55a41fbaab3118505d1c60235c69fb0b924eb073bc60438c3aaed752dcf495104cd5aed52bba51327b2c892dfa3
SSDEEP 3:MsEllllkEthXllkl2zEelgQ:/M/xT02zN1
TLSH
T19744040C7FC73445D71414304011C3500370DC100511FFC3377104175CDF5440C00051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f1417b1d2ed5c62d6223c02771302e9b4dcc437139cb543b53fbce04fbf35708
MD5 e8aa4e2cd522ea073c7eed4d5c2cf8ac
SHA1 aa1a169604fe673806b810ba3a79175771dd3d8c
SHA512 8c1dfd0613a1909b804d3087b882a989e879f090d56cd3aa2cc4d1eabb5bbbeece75ab1385e90b9ae099fc538363fe157ce4a55293cf608581bd21bc8026680c
SSDEEP 384:nPiFAcXqnGsN+8TUNTUlI4yJRih5bWCBu8vfDYY0jfzMq+lTnCU7S67sYY+KqXWD:aFiGBwg5PiVJYYqfQ7SzYXKqX6RqVZA
TLSH
T15CF23871E8A48DEBA9D6CAC99606F6126EE40233858C498CD6F97D3D309F4FD5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d60bd759f9f8c2bf77cba486f8b41db8ce93ebf02b4c7ced8367af4f750f76ac
MD5 44f077c8ea10970d1ec3c63e73856ed7
SHA1 075e78f54d8cce20bdb9e57f116cba905939a295
SHA512 fe5d285a11e720d6f9fcf7277ace9620c5a446545ad8577cf3ea57b5f2cc3c1f83baf473fada26be3ac1b198d9b201b75b855be7f185f661b647be8d9e1a6f6f
SSDEEP 384:nu6iFavqMg3sNV8TUNTUlIm2RihY52r8vfDYY0jfzuQvaS7o1dKuiNd9xprN1k+k:uxFayv3OwgTih8YYqfXvamo1tiFHyVNF
TLSH
T133C25A31EC98D9ABEDEA4FC9EB4A7B07DEE00297D59C4AD4DAD81D0D109319D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 db990223158dab1601af456b94bb90b1d37603559fa15fb88116aa7f634d65d1
MD5 de7dd32e630dee6f1f2eae24bc5381c7
SHA1 5fb88b4dc9ca4e6815eb51523ec5ddeb9d0d32f2
SHA512 f6102fa5a958a2bdf1341602ce5d38f6033d25a5b03b6a30afa0f180508e3c94287b624b2b35e0b7d44480699b5f2b9dfc00616859465504a92bbac84efcc6c4
SSDEEP 384:n5iFavqMg3sNq8TUNTUlIm2Rihm1PZ8vfDYY0jfzMq+ljnvRS7o1dKuiNd9xprNs:QFayv3RwgTiweYYqfevRmo1tiFHyVNF
TLSH
T10AC25B31E898DDA7ADEA5FC9E75A7A43DEE002A7C98C4ED4D9D44D0D10C319D270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a66cedc3895d6e0a26be2d5797f300cbca6ea9e2f07778b5affc46d40a461507
MD5 0ae1b8c639d0f9a75860ffebb94e429b
SHA1 c0cacc03b273ce368152406603e200644ed3a2d3
SHA512 9a937f9b76715b227959956e06300026e75228a848be6b9a3875bacad908dcb5147fbf7233f0871a64372b1c9db9f464c64d466f7cd17bd47a6e6c7bcc4da112
SSDEEP 384:nPiFAcXqnGsN+8TUNTUlI4yJRih5bzCBu8vfDYY0jfzMq+lTnCU7S67sYY+KqXWD:aFiGBwg5PiqJYYqfQ7SzYXKqX6RqVZA
TLSH
T12BF22871E8A48DEBA9D6CAC99606F6126EE40233858C498CD6F97D3D309F4FD5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dbf537007c69e0b911ccd5998f15bf00b9eb48f038df589897fdabf62c4e4399
MD5 ccdb0b311c794153e6d2e4b30b06062f
SHA1 4905310b1a0df2638102ed3fe8c6dc9f8e9533bf
SHA512 ddaab33f997d412fba0022f198b6fa53d4ee9511d4499807081f29a7fbd14e6652dabf3de5d4aaef9c32b3bcc876bebdaede03535752b3cc465cce683d4f0b8e
SSDEEP 384:nKiFrcXqnK3sN+8TUNTUlI4yJRih2CJBu8vfDYY0jfzMq+lTnvRqFvvfVrN1k+rC:BFzK3Bwg5PivJYYqfQvRqVZA
TLSH
T1E8C24C35E8A8CDA7AEEA4FC9E35A7643AFE011A3894C5ED4D5C45E0C00C75DD270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8ec7c3a69b887be98fe607806d6062f9a271d8d7562b9f2e4fd24d1ea91c28c0
MD5 9bffa4d6e73cdbe023b61bb56acbb215
SHA1 e9d3ff109bd291b19c1405b2f917518042103bf4
SHA512 3b68b9ae3c2d0b88caf195ec62f0b3d459e7ca4e83abeea80ec5514c5e638505c863c45b871caf4ca967e42ba9a0a2670b8d60d4ff094355ae9a634af3789bad
SSDEEP 3:MsEllllkEthXllkl2zEelQll:/M/xT02zNQ
TLSH
T18E44040C7FC41555C51414307153C3500370DC100511DF4334D10517DDC75540C0C050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d8aed0184d95467d7131481878ff15d1a90d416548faa7ef69daab439b926440
MD5 0d4949edf90e3a0ceae8a58f1b648d84
SHA1 ed7d6fa60691cd337eba29fd15b0ea0cdfa2dc55
SHA512 dc68a16e8fdf90768140a05337343761fccc45f3c784f369a82928a1955c5ad8be87fb85be5d019cb3302f5e649045a98096c4228dd8948b8a52eb3403ad5117
TLSH
T15341275CB6FA1148B3B3BE5A9BF6A46D447AB9772F07D45D00110D4F0A22B40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads