hxxp://roblox[.]com[.]ug/communities/86545256

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com.ug/communities/86545256
Sample260620-txwxcahs41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264464146202089"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{2D83982C-3749-498B-A7EF-70FEBF2600EA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{DF42FE39-7895-4BF6-A2E2-DEBD7E1E27CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 560	2396	msedge.exe	85
PID 2396 wrote to memory of 2696	2396	msedge.exe	88
PID 2396 wrote to memory of 4740	2396	msedge.exe	89
PID 2396 wrote to memory of 4740	2396	msedge.exe	89
PID 2396 wrote to memory of 4740	2396	msedge.exe	89
PID 2396 wrote to memory of 2156	2396	msedge.exe	90
PID 2396 wrote to memory of 2156	2396	msedge.exe	90
PID 2396 wrote to memory of 4264	2396	msedge.exe	91
PID 2396 wrote to memory of 4408	2396	msedge.exe	92
PID 2396 wrote to memory of 4264	2396	msedge.exe	91
PID 2396 wrote to memory of 4264	2396	msedge.exe	91
PID 2396 wrote to memory of 4408	2396	msedge.exe	92
PID 2396 wrote to memory of 4408	2396	msedge.exe	92
PID 2396 wrote to memory of 1876	2396	msedge.exe	93
PID 2396 wrote to memory of 3368	2396	msedge.exe	94
PID 2396 wrote to memory of 1876	2396	msedge.exe	93
PID 2396 wrote to memory of 1876	2396	msedge.exe	93
PID 2396 wrote to memory of 3368	2396	msedge.exe	94
PID 2396 wrote to memory of 3368	2396	msedge.exe	94
PID 2396 wrote to memory of 3256	2396	msedge.exe	98
PID 2396 wrote to memory of 3256	2396	msedge.exe	98
PID 2396 wrote to memory of 3256	2396	msedge.exe	98
PID 2396 wrote to memory of 1360	2396	msedge.exe	99
PID 2396 wrote to memory of 3904	2396	msedge.exe	100
PID 2396 wrote to memory of 1360	2396	msedge.exe	99
PID 2396 wrote to memory of 3904	2396	msedge.exe	100
PID 2396 wrote to memory of 2412	2396	msedge.exe	102
PID 2396 wrote to memory of 2412	2396	msedge.exe	111
PID 2396 wrote to memory of 1092	2396	msedge.exe	112
PID 2396 wrote to memory of 540	2396	msedge.exe	113
PID 2396 wrote to memory of 632	2396	msedge.exe	115
PID 2396 wrote to memory of 632	2396	msedge.exe	115
PID 2396 wrote to memory of 4932	2396	msedge.exe	116
PID 2396 wrote to memory of 4932	2396	msedge.exe	116
PID 2396 wrote to memory of 4932	2396	msedge.exe	116
PID 2396 wrote to memory of 2716	2396	msedge.exe	117
PID 2396 wrote to memory of 2716	2396	msedge.exe	117
PID 2396 wrote to memory of 3136	2396	msedge.exe	118
PID 2396 wrote to memory of 2664	2396	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com.ug/communities/86545256
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa1829c188,0x7ffa1829c194,0x7ffa1829c1a0
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,13523220616209118453,14272845006410074220,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,8339185914856339157,6687318004170340256,262144 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,1456489683890892415,10259354650108179193,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,7702694552551006065,16571957885498301026,2097152 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,17234723182666522114,33797933457096623,2097152 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,15576952150244898195,2119545181108723214,2097152 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,13396237813009419890,2885633060742621671,2097152 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,8098152755186022388,10303473004180964480,2097152 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,7872579104282608,15091815295073439789,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,12686144479517975643,14005642374152137041,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,4424806440719146291,16390195399442848322,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,4424806440719146291,16390195399442848322,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,5355972001113425234,13837127118874890523,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,10188405771443401755,14813129934361360427,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,9510556776278571894,6720423735563514890,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,3848069320076844553,11252678999463873307,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=992 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5296,i,15581205721869179084,15097640729229116579,2097152 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,9183380598401127051,344460269960739964,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,5163054452519071294,17662484713347754238,524288 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6636,i,3020396571046733653,13828048531158429106,262144 --field-trial-handle=2188,i,15834661507385304790,11388734217082169118,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 95KB
SHA256 5ad344da239b092046ca909b56230e3bef80ca36d596165b7b6803e0d7ab8898
MD5 afdc6101336a5c2cf9266c3438c3ffad
SHA1 c8a4fde75f5dad09e4830a2261b7a45c4895ec3e
SHA512 a12f1de803518e5d35161e97eb39ad46b008473b279742affde0c9c5a71b24ca5133f68078f1785200f4f7563cf8be862cff3964e83bd239c9025bd28aa7dbb4
SSDEEP 1536:EjMuGhyfdkK/88d+r9Qm08So3wHVuBuOq7p2YyyDVStrJQSTO/NSfpQm6eJ5yIcF:EwuGglkK/QQHOxn2s9QSyVSfugeEX/o
TLSH
T1A2A312CE59FB6430D4DA5D78BB2DB93D2F659989F647BE70A060CD684A0250C8B180FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 19KB
SHA256 9befb4747c661df6fa27dc7e7405b03738cd28e9837d4911d52346199c0ef23d
MD5 d65fb30526a7341133a0d8bd7a9553fc
SHA1 684280db36292ba7e989ad845ff10310b8bde520
SHA512 81bd9b426abc3609c6429f3856c51f009b9c9f6c38ece6d9cecafa95ca764db56b58f73d97aa0d6f12fab75ffdf944f92f4077c448ff8a19a2bc67fb96770f3e
SSDEEP 384:HoMHzQYqdCBKlpFkwBHmPEy0hge/sqemwnL8XebZQ7yax90hDyd2OYBVIh:HoMHzQxJlLXBHmPArUmwLX+yaTufOYk
TLSH
T11B92D07A251FB5503F7B016067A624E592CF22DEBFB485E116EF26AC10084D8B3B66C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 22KB
SHA256 4f822d3b5f7a7cee3fdf96b11cdcc536be716e6c8855d8ec83af8b90e0b1cdd6
MD5 03b2dc609eaca6a0163d0e003b0a378d
SHA1 ce397012d42975ba80fd94f8f2c0749f294c208c
SHA512 92da802b3ae9cba22d026defc4ff1c4b15060980b28c80c05e0925a0bbc17e7965e7e318ff712d52cbb132675148a86cb8c672e54996741c50a1aa41683bf48c
SSDEEP 384:jHsEM1RqRpF9JXJ8s7e4252HZA9msjZsQHs9vOGCzFtButon2tNA+GK+P6E3o2:wEURuPJXVq426sFsQMRCzFuJtNEHt
TLSH
T189A2E18991B5953820EB209B50333C62DD8B342E8EE38574A1CD35AB3BD3E74169EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000138

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000138
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 11ae9ba4de480d34fd591bff34ed82b21edb5cfa741beb1bb3184238ef18da42
MD5 65d06f8a1ec03513a9d913b9ecc8e19e
SHA1 b9974568766887a36cf793ff21ae73e07887af10
SHA512 ae684eb6d3e7fb4d2b8574b1189e9e5604d1aa699683007b9f3ef6dae990d402c79da44665f2ff9b18cefcc0f672403f20b77d1a31ffaaec5b803251a807275e
SSDEEP 96:KFI2Y8teesdZDzU71J/IO04SIt7g4viu7qMmLH7izfcl7p9:KmP/k71J/IO04SItGu7qMoiw
TLSH
T197D182392F934047EB5B89F2E4F98D0BB7E7456FB71B9A2E053838BD39467A64013018
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 63ca024eb3716e97607593eb5804f6dfbaeb0b236a2fa9a3c86b1fde5581d967
MD5 f4b548c432c7c99eb26d5cd6127dcd4e
SHA1 14f92c8a36405cb38f493f2bbf568dd05e6c1c42
SHA512 298c321baacbd09641633d78e38f5991d40199af5e7df8b7fe47f39bd77a8f6ad2bd3474fbc689c37da94500b4cdf1833d121ab8f6d90a4d0bb200a980b8d735
SSDEEP 192:3SCPGnuE7MLv1lOY5O04SISJm97LM+31aF:CTnZ7MLdx5O04SISJW7LMy1aF
TLSH
T174F1A4392F834456DF1B8DF2E4F98D0BB7A7656FB71B5F2A053A26BD38427A65013004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 97509964961f864b485f978b8658ec4e78b8b317b1700cf4e02932e63b993b81
MD5 102d2a64d196364d4a3fff58774c4841
SHA1 ff79e017f512cf455b68bdba1ddf3dc5d37cf1b4
SHA512 3a56de5471eba2ef7a9d8b130249ea51513320d99e5cfdd39bfa441c26bcd2bc310b7f05fe229b52317e3f713406d711c74ff69e98712ea47f3d8efeaf23b81b
TLSH
T1055167F743F1C96D9A1656F0AA19AD1BCE5C0520071C78BAC5E0BE17A3F35A2F101B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1bffe26df90ffb6647496ff1dc6348c10681620e33829aa16c4009bf25dc2fce
MD5 96e19fe6e4218d8e9bdc6ba61c82681b
SHA1 a7af13d6844b568e756651afc4f8241d6a48e35e
SHA512 2eb7a50eb9032245b6ad1f4d1c85b4c22dcd4489bbdc7dc4ea02224a34cb6bfa341af3bcbcc8f2bd3bb446c8ab782a84cc5da09d96be19e9836389f30f427453
SSDEEP 192:sxZ4RpyM/jK1Ml8MkC/fMsoGHIdpmWHW6+WNys7/YLFZsSIgrJ:sxZ4jMC/fMsoGIFHbV/w9
TLSH
T14352C7126A34A977CCCBD209F955BF53D6F51572E6910E48AAFC8A0C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 464deda387d71beaaa0bf7a5f657a2295c870727fae6818c0bdfe56acb552107
MD5 a9ad86c061dab0df202fd6fc0acc81e5
SHA1 941b19ac1f47f4afbe35aec9692426d92fe504c4
SHA512 a02a598b284a1e0638100034974d1de63dc990e2fe5aec6bd494d94c9beeee8d4ab7c252c7fe68269bf2257b960b19c27000b9ab22e2286b60f84537347bd31a
SSDEEP 192:sxZ4RpyM/jK1Ml8UQokC/fMs886lIdpUJHW6+WNy9SZYLJRsPtoeSIg5wJ:sxZ4jqLC/fMs886WIHbJZQRsPwC
TLSH
T16B52F7126A349A77CCDBD209F955BF53D6F51472E6910E44AAFCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 58800c042f53c20f306d72f8edb30e37ce62a0657255c9d0f7d679a64de8cba3
MD5 f8ea165bb18e88a3814088d107d9b166
SHA1 5515b1aaa58e000503587999bfe278da72c5c500
SHA512 dfac3af62c12bf391d1d4b0888fdf642e831aa068732a513dccb462229701d3af622fb21788553f06ad5e64172e73f823bd86ed023e434ee34e8e874d11232c6
SSDEEP 768:O8s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNVroDE:O8s6pD1WvxzWju1jahILIsNuDE
TLSH
T1ECD2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 46b89449fb6b3e1e63a0a1e53d353a58b30e93e84b1b1728edfbe0cffa016e6e
MD5 52781b64cbeb5bfb4cab5c5d53789828
SHA1 55107e9beb17e87819fefe5ad02eccc5ea31591e
SHA512 03bee547a6a61c65f90373ca0a4df460ea82bad881254e53cae4e682ad6a26b58922c1697ca8a4ad74bc0524ec1fc1c76ef7c771910c15fa4dc9abcfb38497a4
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFOuI3KvasrylxIhKq00KGZUwOW:KUAAKteP2OuwKvaCOxuKq0C
TLSH
T185A1321372BB03437C3E284C9795DB66474672A33018B42B3BA910B65EAAE344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\05df906d-3ad5-4158-96e5-8b3c10d96cd6\index-dir\the-real-index
Size 168B
SHA256 2e131a8d3a61333a67185b6ca8c3a9149c9a8c206d1e767522fd9af59c5f93bd
MD5 385ab3cfd446be55e5dfab1ff148c9d9
SHA1 5f4a3475e3225b59680b5c3634e9f608ff9737b1
SHA512 b962b45f48bc1d1a84bcd1f5a5c9dbe5d01d9708b66c39a7ff8dccad90452fbb5b5fb6c5b239f0d4d4d7285a81b46a704d67a27483a52f9c47773c078e550c40
TLSH
T16DC0921CC4A80204C02647FC18A623B536281E5FBA3A13B7A0C43A86B0860AA4A6A0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a15fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\05df906d-3ad5-4158-96e5-8b3c10d96cd6\index-dir\the-real-index~RFe5a15fa.TMP
Size 48B
SHA256 19617c074eaac74357ea5cf8028b78752f594819760c8c45ca09041b64089da6
MD5 8b3b17d20e86066133e9f870f68e9981
SHA1 3637f3b75602ba05aa8e0fef3b7182657020f303
SHA512 c3e02298457d03fdb96861263996072a3da6e5f640a9dc866103c2477183ac125f4c35820bd41e67afe2d5adb5a77a277279c9f76e92d8a669d5e89172e5917f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 94B
SHA256 e978c11ee9cc041b0d4b3325066d6cd6a7ae12cb553c454f96ba10e0209561d2
MD5 cc5215204b9000a990b4ca6a06fa3513
SHA1 4736218add7a44f165e576faa4cf705c56ac5d37
SHA512 530436a5e8817c17265c6fde68ff8b773a3b008bb60887f600f47ade48365da197e27697c11f80c3b807614b2d374faf6d1d90c0d702519feec1d675a7a0fa1b
TLSH
T14CB002BB1504C05F5A7055D15514715DE14F016D4CC5CDFCC944746531246772D01D63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 175B
SHA256 7c7a079e05c91bf3fb9cabc5a9207f25d634312385e9079e3df4ff3132363f8a
MD5 3c70e01499993b651071e7579d95c4da
SHA1 b00b8b92901de9be29ac25d163bf9be7cbca9a05
SHA512 0afb58727647cd6d5f51526be183d8a21c98192b5b70b0b1dda2d79a9b22fc0654c52ad293e7eeb61aacfea0df104d86d479a327cd73e11acb800720b7895937
TLSH
T191C08CAB2220844F277166D19410765CD31F0F6A8CC8CCFC8A0970623035A375E06A33
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 169B
SHA256 274d0cc2446224f14915e14eae1bc35da4d54bb8afdd25e515e3ae0d41fc48b3
MD5 fa8318a664755f28fe51e70e9a44ce61
SHA1 bd5de715ea2bceef5803798c108bfb0197bb060b
SHA512 5b9da8a00fc6ae5fe876cdc9c4766de83c200fee57dc6ad157a6ebfe5bc00581fb385a4dba51ed05a0b6832fdd7afa2e88cee3ad6661518397c3ce86b2c3d8d9
TLSH
T1EFC08CAB2220C44F1AB0ABD05400361CD30F035A9CC8CCFC9A0C606230B5A371E12A33
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a09f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5a09f4.TMP
Size 178B
SHA256 8cf6696b2632913c1b6325e24ffc7ad3def169efed825e7dec28f0993ffa4d02
MD5 9307c5af2bb6cd2d9de06084e54b251b
SHA1 ac71beb97b5d28a67203e93a2f119f2aee0f4b45
SHA512 b4b63ddcb33ccaeee0cca6eb5e4941c4c2f258a7720650a56adf3fb19cf19c8cc59eb001e2c67f7dffe68871b97a656bfcf2abcd62c904f2b4d503a58d523159
TLSH
T1A2C080F76D35805E6B2455D19811315CD01B1DAE4CC4D9FCC90570E1307C6137705973
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597d83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597d83.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 100721bc162788d6ae695972a63d89250ff4c5d21f36c1ae5c4392994682b007
MD5 7d6f9180389c4d765c3e80c52503d7d1
SHA1 4f3d27f6ae9189ed896b6c2b52d1ecf1c2bca57c
SHA512 66cfe0d3397779e4d75c67d5a2c2697982f9d9ba5a7b7bf11c50a688b33fb851b244691650bab616b24c9185b679987f011be9f074dd15612371f5ec2896ef57
SSDEEP 384:ptNn/s3n9SfsNpqvaWn4Fsck4a9DOMMe/7zJr5WUITGT0I7x9Y:pj+9UObkhJO+/fh5WUi+02vY
TLSH
T16F927D325938AC774DA29141F90B3A175FB441ABEAC62F85D5EC6F0C00DF6AC235AD0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d7bd566a843be168c72a1de7b68cd084f8b270de1a7de9d5967f3f3a02153fac
MD5 543c4bf607a469870cc15fb46480fe33
SHA1 31a0cf41e538e961758a24185de255253e46fdde
SHA512 58fd6f7faa73f73b195d9957c0839e371e0ae44d68ee3d03b6ab9b30f99d6e339ba3418d3bf2cf02568c65da783ca6df405fbf48b4ff23439cb9bd8c59eb2acb
SSDEEP 384:5iF1tNn/s3n9SszsNL8TUNTUlIlHvaWn4Fsck4a9DOMMe/7zJr5pUITGT0I7x9Y:QF1j+9DqwgsPkhJO+/fh5pUi+02vY
TLSH
T18CC219F248D79836D9AD4743A73E2E074EBCC0A7B5816A41B7D85A0CCC9A1BFD346D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 19fdec8f78c919559725e870eed5bef418b75e1d85230df96e7692b53f643ba9
MD5 5376f87189aea1fc87b5f53a4ef76d7d
SHA1 295ea16e37989a8ab8b573121f1d0764356a023c
SHA512 ef05db18c55d7821f4dcfa03ce7d8b647b8c82343bdd1c85a694756b6b66651f786e9e53af67a0b34093de7a9152eccda0870b1e9bd86975733215b31e6dc558
SSDEEP 384:TtNn/s3n9SfsNpHvaWn4Fsck4a9DOMMe/7zJr5WUITGT0I7x9Y:Tj+9ULbkhJO+/fh5WUi+02vY
TLSH
T10E928D325928AC774DA29145F90B3A175FB440ABEAC62F81D5EC6F0C00DF6AC235AD0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ffb6b072cfcf551ef4345c6374c58035450703f0674a0ff1d9248935e92a806
MD5 e81befeb7691e0a6996083b517fd1b76
SHA1 8299f605d9d5176a07df5455dfae766260caf717
SHA512 a7f0b696ef939b352d6db2b39f6a21a87b181c20c445bf9db0d6cfe49f503783f0528103b931d9f90cacef036161d3c1896ce8f5edca4ab00a5cffb0b0c51ca6
SSDEEP 192:qON8S6O7+3hQmiUyXJGttb02O2bbh2eQgGqoiU6:qON161+Gt9DOMMe20U6
TLSH
T1B402E8346D686CB78AF2AE05BA872B175FA5112BE9962F40D6E81F0C00DB65C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e61b50c185b60604c108faa8afb5254d8c9f81cac60da50ab6d4297183445d86
MD5 366e87c68b6d2f1e736bb7012673cf38
SHA1 91521ed6a39394e65331ef6a6436007b8c254a28
SHA512 e2fcff9562f72aff2a87e769d72e952196d0be73cb7603417c0f2c0904ee305e6262089ef8bf4215a9e6a41d9228cfa316935b41da25412b0a38dffe673648e3
SSDEEP 192:BON06O7+3FQmiUyQ1J/ttb02O2bbh2e/FF0SJr5UcNMqGdU6:BON069LD/t9DOMMe/7zJr59UU6
TLSH
T111122B316828AC775DF2A545F98736139FA5416BEE8B6F81D1DC1E0C01EFA6C234AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7c282519e3885d1689175f9a6e154cb09a51e005dd1d0b04c98ab3bfbbcfa4c4
MD5 91c402ff2c5d7e965528845af2b8f7c5
SHA1 ed7dc0f78efae6bb5a9595a1370e0ea9640b4f79
SHA512 2af89253a6c5fac89b6f31d32806076f740d94b2e584b9163f9431bfc499d287b9b2f197a6d26caf545ac98076c3efbe93f8100bcd549c37dd86142afd89c18f
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a1445.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a1445.TMP
Size 392B
SHA256 670df4ad6b41b2937ca8f63cf162bc94007782e732f452d4521f868b93efe6a8
MD5 4fdd55d46aef3821b3016dcd8f23b795
SHA1 52ad08f745718520cb01167834d12b01bf3ba805
SHA512 2be21ed790b0ffde9981abdb012367a9d063a91e29f9e77eb61d4278dcc8486d427a2102c05af40a563e7bcbd85c8949a5e0481f81767549c9cd366f75cf8b0b
MD5 SHA1 SHA512

Submit Download

9d6d3238-1b91-4c20-b2a7-ff70e9b1ad1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d6d3238-1b91-4c20-b2a7-ff70e9b1ad1c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3d93dfc3489719cf373d6828bdbc40ed35164c7ecffc0ca4448b6523de326ef0
MD5 548ef6c80257159aaca220533b9d05af
SHA1 cdc58b81d452b209f3ebfd177aa624ace965d203
SHA512 825b425459685dd2467794ca143037a55391233ca7ca61c0bd84a4d2141779bb38645374b2a31bb057234411d77906a22bae7068968d2a5b699b88bd231d7c7d
TLSH
T104411D58BAFA1148B3B76F069BF6686D487A7D772F06D46D40010D4E0B67B41C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download