hxxp://roblox-exploit[.]com

Analysis

max time kernel
898s
max time network
751s
platform
windows10-2004_x64
resource
win10v2004-20260513-fr
resource tags

arch:x64arch:x86image:win10v2004-20260513-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
30/07/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox-exploit.com
Sample260730-vp3wcssgrh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3596	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299057327038331"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{E6BEA01E-0380-43FB-95AB-DC41872681CB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4396	5056	msedge.exe	84
PID 5056 wrote to memory of 3596	5056	msedge.exe	85
PID 5056 wrote to memory of 1540	5056	msedge.exe	87
PID 5056 wrote to memory of 3340	5056	msedge.exe	88
PID 5056 wrote to memory of 1540	5056	msedge.exe	87
PID 5056 wrote to memory of 3340	5056	msedge.exe	88
PID 5056 wrote to memory of 3340	5056	msedge.exe	88
PID 5056 wrote to memory of 2628	5056	msedge.exe	89
PID 5056 wrote to memory of 2628	5056	msedge.exe	89
PID 5056 wrote to memory of 2628	5056	msedge.exe	89
PID 5056 wrote to memory of 5020	5056	msedge.exe	90
PID 5056 wrote to memory of 5020	5056	msedge.exe	90
PID 5056 wrote to memory of 5020	5056	msedge.exe	90
PID 5056 wrote to memory of 3776	5056	msedge.exe	91
PID 5056 wrote to memory of 2300	5056	msedge.exe	92
PID 5056 wrote to memory of 3776	5056	msedge.exe	91
PID 5056 wrote to memory of 3776	5056	msedge.exe	91
PID 5056 wrote to memory of 2300	5056	msedge.exe	92
PID 5056 wrote to memory of 2300	5056	msedge.exe	92
PID 5056 wrote to memory of 4572	5056	msedge.exe	96
PID 5056 wrote to memory of 4572	5056	msedge.exe	96
PID 5056 wrote to memory of 4572	5056	msedge.exe	96
PID 5056 wrote to memory of 3932	5056	msedge.exe	97
PID 5056 wrote to memory of 3932	5056	msedge.exe	97
PID 5056 wrote to memory of 4756	5056	msedge.exe	98
PID 5056 wrote to memory of 4756	5056	msedge.exe	98
PID 5056 wrote to memory of 2044	5056	msedge.exe	100
PID 5056 wrote to memory of 752	5056	msedge.exe	104
PID 5056 wrote to memory of 60	5056	msedge.exe	105
PID 5056 wrote to memory of 1680	5056	msedge.exe	106
PID 5056 wrote to memory of 2108	5056	msedge.exe	113
PID 5056 wrote to memory of 2108	5056	msedge.exe	113
PID 5056 wrote to memory of 2908	5056	msedge.exe	115
PID 5056 wrote to memory of 5000	5056	msedge.exe	116
PID 5056 wrote to memory of 5000	5056	msedge.exe	116
PID 5056 wrote to memory of 4304	5056	msedge.exe	117
PID 5056 wrote to memory of 4304	5056	msedge.exe	117
PID 5056 wrote to memory of 3020	5056	msedge.exe	118
PID 5056 wrote to memory of 3020	5056	msedge.exe	118
PID 5056 wrote to memory of 4728	5056	msedge.exe	119
PID 5056 wrote to memory of 4728	5056	msedge.exe	119
PID 5056 wrote to memory of 3940	5056	msedge.exe	120
PID 5056 wrote to memory of 3940	5056	msedge.exe	120
PID 5056 wrote to memory of 1740	5056	msedge.exe	121
PID 5056 wrote to memory of 1740	5056	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox-exploit.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffa21bc188,0x7fffa21bc194,0x7fffa21bc1a0
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,6131012082280967063,13432975575165988331,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,8112674004544593793,4050252084485634211,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3632994533715931050,9415979257168768444,262144 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,5039125034622093787,1433117184154609734,2097152 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,11911778563608119164,3713605753617665668,2097152 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1561928656611991639,4648800091168586387,2097152 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,13915928130429093628,3983243111572855233,2097152 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3588,i,12954806027783702626,6387922820346397369,2097152 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,5152773524750682005,3249385853810544585,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,651934278417195965,16929304403228263114,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,14644106916774820930,17584925006633801872,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,14644106916774820930,17584925006633801872,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,3907050835702048275,5358648837848321042,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,22544525894941740,9648512222753269670,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,15637995998892530232,11890025746682606053,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,2931023503112880740,18197146201324691552,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=768,i,733348585244820227,2268464740007884421,262144 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,627543826674566618,1487779499255137408,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,768552985770032082,3178076027489740342,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=1660 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,5407469317897496335,17183486614422461274,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,6274539548407225988,16786890241354556871,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,17662492259878621517,8335112724007654400,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,3843750728216643647,3085361334637723125,524288 --field-trial-handle=2448,i,5755748208356856216,15776824203283395624,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 00fa48fabd730d933fde85e0e887ad033b848a32ff25bf7dc880a68b3fd2c276
MD5 33ed73099ac248bef758e00a6feef557
SHA1 36dae1acfd7a2c6127d3b8b90e5cc68109f043ad
SHA512 70645aef1fe2100ed0ea118fb84dcce75127c72bbbcd76ad5b1f56dcade78dd395d990277408aa7cfd30ed91c57dfdb5e8d0fa67f2a3e642c6210cc3c7b054f0
TLSH
T158E026C544EBC33FF648788B417CA38C83F1374A93C87D8A371098A87409880A7E36D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 93f6b41bffa91dfda55b842b6a61ac688bb1ca843c5f8ab669a417f917511d10
MD5 b8c432969576db727d6dcf1a6f884e40
SHA1 b1d93aff06c416274f8dc4125715de18e595f6c3
SHA512 22569c2a9bc01967a85ab8d50acfa1a4fa4349ec86339dba546397ff17bef238521644e44243b5c135e48c5ce92b35f6bb5e508883c63d163ba8fcf3b6259d51
TLSH
T166E026C454CCC32FE6087847416C538CC2B1374A93C8798A5702CCAC7C02888A7A26E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ae80ce79a37755d77857f24427ca0031aa2eac694dba9423022448f904d52adb
MD5 5b34fed5da0a85ec22ab31e853bc4227
SHA1 77e97828062e47a5890d1dfaffe17a20b08e4f34
SHA512 9505f064d5e1ed41dcf35ca200585eb9ea1681bb9e363ce5a0586df7cd7e48efbf0b9f8b9680407b6cce9834b96d862bf422976b902e4b18fa7eb1df0dd92723
TLSH
T196E026C485C8E32FE608A557826C538CA2F0360BD2C8798A2B1485887481AC4BB83ED4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4748309e1ef662982c88a3112ccd6025d690eb6072245464a83158b419e95633
MD5 e444f292421fdcc63b0e70fa60a32265
SHA1 fd8becd0aec4098f26359efe0882840a8f02ff68
SHA512 8c1a9e292ce4e5d94af291af8577aeb5c75a3f28bcc8c901c2ee9034d8ce0a810002ac03171ee47ee42498c0cdc6d0aee2944e28fcb8c9d4ceb5c5024eae45d9
TLSH
T1D481C53003493DA3F3151DB5D1D1010276B08DFAF56F5ED60670AA3A2317F91971DAB9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585c44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585c44.TMP
Size 3KB
SHA256 a9cdd1cd17697f8bee091f7fe536249af52a5f18785479a08165ddbe25ccc02c
MD5 63053782a058cae73201c50d589624b9
SHA1 679af634580cf74c0c7f8e44b4e1b26ab1ec9e8d
SHA512 7ca2291b0f9de0a5c369fa06f4f4591d9f6e5e1ac628a51b211ddbade746b362e18013a5059b97b6c249a22db68fe5d492185b502a87b855244ceec31c2224b7
TLSH
T17381E630038A3EA3F3151DB4D2D1010276B08DFAF56F9ED60570AA3A2307F91975D9B9
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 aa7d49fbb0979642c4ca64c081ba7cc7298f70ba1ea964ef45b0d512a4b8b299
MD5 6fa9feec3aa12d08729b4ad134fb0b60
SHA1 097e476e8a48992a2c090531a489a5c0bbdaf7cf
SHA512 bf0d191d6138f80f1f48446ad67d2eb932ec9a05673483ab45317901a3bddd8c8a83256a0a324fd9767ecb815ba2fa795b886a051984c4cb940c7983ee2cc812
TLSH
T14E215BF3D2E4856D9D1242F1A6282D27CE1D0910931C3DA9C8E4BF8F97E2474A20198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 562e9b87047567d4cd8c7e9669e32754dc3b2b11a237127400dbb6a9b866f97b
MD5 798035d5f3e77d63b7d8558184bb9d4d
SHA1 421444daef28c1b24f3be9bd58b7f61e9a434eb8
SHA512 009766bc07535a3726bdc0b8ec4217bdfe5516b5f4a859d67ba3d72d551e0bab1b8b09f924778a4847832ef0d47e3e3bcd9810c3946839688a1fea0c5a97585f
TLSH
T19F2169F692B186AD9D1252F09A186D27CE5D0520935C3DAAC9E4BF8A93E2070E101EDB
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c273a7878cf1daaa71c9ada9e602c0b077bad28dd6592e84766e8727b71ce6d6
MD5 7adc0137bc4a6c569a9ccff89287384d
SHA1 24ef7f48cfef4335cf3f35f62f800367b6da0de2
SHA512 7c3f16576f130c16bb8b4c6815850d95ec0585c450b6cb1f0db4768cdf8f585fc1086912f70bbcedb5445b4f81c8e9d9bf80e3f65465d968336370b7fc700fd2
SSDEEP 192:sxZl/yHkKOMl8MkQ/f6sBMeIupuRHW6+WN9Ju/YIdxEzIgrJ:sxZlEMQ/f6sBM2KHby/a9
TLSH
T13242EA566B3499778DDBD20AFA557B53D6F50462E2940E48AAFCCA0C04E6AEC3307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 70194c1f35cabf7aa3d0dab5e0a5a803a30235a189556eb1057fa3c1cca809ef
MD5 5fe807d2236e0fc6e0c98002f76a5633
SHA1 64263fa2277ccc5b9718ad3cc2cbfec690cfe3cb
SHA512 5f57ded22bf2cd14bc6aa31a777c6dd373c08d4fd56201c7540d41e5811630540351a59763ce9e7464aee770816028e3543b8f293849c41e337927c597b302ba
SSDEEP 192:sxZl/yHkKOMl8UQhkQ/f6sUneIupERHW6+WN9Ju/YIEoEzIg52OJ:sxZlEqyQ/f6sUn2MHby/u9
TLSH
T17952E9566A3459778CDBD21AFA457B53E6F54472E2940E48AAFCCA0C04E7ADC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7535d1786a36ca24d82cf48d99a242b6bc3b7d72520b4f8973516d991f7c4711
MD5 cb8226433f08b4739df94551126db3dd
SHA1 d08c319a670e8010af84820d3715a2c941139f94
SHA512 b3a685659f36a1460d7954012d4c1cf4949465e3272d497fa32427c2d144bde3eeb30f1fa4ff977776dbcd388700ae3cdf6172ee7d39def5fcad3ca826008a93
SSDEEP 768:yWsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR95rof/OX:yWsqxXlWvJD6Tu1ja54LAs9y3Y
TLSH
T11BD21B3B694CC77E4F840E5DEC26AFD76ED801CBA6988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 1c13a00e66ffca8253b20e790155b2d97c308a013b9c7e606ade41e64f473447
MD5 39c8977971d4b0f99b1f0acaff704e83
SHA1 d7303a51ad04df6018ce49c1d38d730fc9edf34d
SHA512 b4f4c5c4c721522ead3a9c69918829b19acd800c637feac9cc70eff08dea43a49e21eb366aca64f8891eaa1e9e1c9670c804e482544058fae051f522a51e38e9
TLSH
T15031F0894EA0995FF86584B30176A4B07771C9CCA722EB235D6C31721E2139D3A5B1D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca252.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5ca252.TMP
Size 1KB
SHA256 a60050d69dce1ad9844f2e998ef0ddd8d2732b4684a9ec137116093c0ea9083d
MD5 4ce7562dfd26fb1afd70ff42da959f4f
SHA1 b9acbcc48691025dfa9e3af5eb104d20e2db92bb
SHA512 acd5383c39a709d3a3baf321c6dc3d2c44540741be21f5c2d6e7906c00f83898e4e62f8888767a6787e0e6978b61a09e0b26c5ddf9099a2ef8c31598080412c2
TLSH
T18A31358546E1890BFC8050770A93A4F47331CC005323B793693C25394D317CD1A0B0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 aabe02514a022ddd245c3c92a19cf5f7b4eec35a6d2037168853236408417a63
MD5 8a0a54c08d6c337d610b28a2203b6603
SHA1 90b50b295968e12d140a2ed6b86651c1a3936669
SHA512 0dd33609e3d75bb57c41b0e2a4856d345cfc9b0de15b97e3413ceb19d7210a345315a2d47948dc1e5d4b9165feccbcc991388ca091233d9aaa356bf81789b668
TLSH
T1C9E06FBA2AE70820A8BBC3EE087248A60405F868CC91EC4F002D92C310622B03832C26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 08fecd32d4c4bc221faea1b1eae9ae3ab788722c9d854a239691192c6e3738ad
MD5 16229cf513975581cdd3f28744840dfb
SHA1 c6c2129c9f7936032f9303a97d98547df8ecc9ba
SHA512 7792c8b8742f66d66f975a9f3afa383a473414dc35688097029184ed962e9278d2fbb6e3a110b33e111e5357f80035bc8c161fb2ad0fe68a898293e98d64663d
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyNfItK4EYykocnPInykKGBe4kia0hHAQ:KYbaKYIK2fKK4EGrmKUAWK0
TLSH
T1D991280672370602387D695DA2AAA63B8E4132633418B5EF3BB854B24F7AD154CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c42211009beaf1d00d191ce57bc68dec7819786427ea965fc540386921cb08d6
MD5 34672bb042ba427b984de441878236e8
SHA1 93c8f26b480f0bcca4ee7db0b9bb48990e81289a
SHA512 27551ab62a7d016282af23348481d88e48df8342aab66205c518ac0f9d8378e7676eb0f74b5206a8eff802e88cb37d04968be37ad684e667d2de8fd82bb3e266
SSDEEP 384:PZcIhsNA+2FBbabJlVRNHdQxOObjI9G6w71r:HhxyLHHCx29Mx
TLSH
T145929E32AC345C775AB76512F48B35135EF89077E7D82F8491EDDB0D05EA56C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7bcfe1ef3e210fa6259af4d2ca5e4abf6785445fe01751f5095b273b93fdb00a
MD5 9bb35c7ecc45d7cca6a9ce94be10c8f7
SHA1 9d1084be3f9db03de66e0687fbc43141b4f44c44
SHA512 abb809892b48dcae58dd03cd666d63675cc2e9b1420dfa9a97286744e90079240fec198591782b6e702ba7fca0a3c2a29b326cdf5727c178a39bba8e6a78cdbb
SSDEEP 384:QFiZcIOzsNA8TUNTUlIln2FBbabslVRNHdBxOObjI9G6w71r:QFQOJwg8HLHHTx29Mx
TLSH
T15CC229F258E74836D9AE5B03B77E2D134EFCC067B6946A40B3998A0DCD9617FC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a4b44e80a768b8f531b95f4f00ccca82b89605511cb3eba3718e40c31ca450a9
MD5 5568dd93a48fe07f1f494c054f76a3ce
SHA1 89e8fd865b9241d780aae8e8eaa578de2986db6f
SHA512 cf1e34f95a2c0c575b1b8d671dab79ef4b86dbcf202e9baabb32f1a52b1dd712a1e4b0e9f410258bec77a16241c2c691d780140869f3189460475ea0948bb418
SSDEEP 384:2ZcIhsNAn2FBbabJlVRNHdQxOObjI9G6w71r:kh6yLHHCx29Mx
TLSH
T1A0929E32AC345C779AB7A512F48B35135EF8903BE7D82F8491EDDB0E05EA56C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05b0ec658bdedaf6fa9833b2013c818f99db6d314b7db65005aebef0e238e5f6
MD5 abe5a15f69d6c0e12fb5fc7c339d5e59
SHA1 cce230b47cc28ba32a54184d336599c2cd63e47c
SHA512 9e4075689ac2c75ec0f5ccb1ee20de65b0bfbaff567133d9d09245d1512ce0559c78953d0146f28d3e41b540522288856629cbc60c9052869329087879a232b9
SSDEEP 192:JONB6JkRmQmiUyMnX+RNM+Fd10hwaKnVcFq12U6:JONB6UChX+RNHd2xU6
TLSH
T15012F93668386C7B5DE26946F48B36135EE45127EEC97F80D6DD1F0D01EB6AC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3380edd865dfa6d952091a8e63d8de466257b67c38e3186e81ce7aae0747300f
MD5 b4870ab33276fe886119d12865adc238
SHA1 dc748d904bd1e98d8c78416fd458f7cc8831cba3
SHA512 12530c4ebadbbce06b746043b83f577c5f3110cada5949bb25ce2a7c7791626c306dd257062a041daaef7d76b8269cb2daf9fb575113317c666a0b4cfdf4aace
SSDEEP 192:tONr6JkRtQmiUyBnW+RNM+Fd10hoh3yRyU6:tONr6UrWW+RNHd1bU6
TLSH
T1E402D935BC386CBB9EF26D46B58727175FE5212BF9952F80D6E80B0C01D765C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aea524c0-0621-4231-8000-552cc81399bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aea524c0-0621-4231-8000-552cc81399bb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0812008f822cf78c38cd14b3dc19113f7cec0a40ef84f9a318128d8b2f4269b6
MD5 7d148d37bbaccb2bd708c541137716e2
SHA1 7ce7320f301e9399334925663b2e79b789a311ef
SHA512 8079c910fb0847d74564dfe39db7fcf1e5147515da85f3c6490637bdda3ab640905635fab869b84791a064588ac151e38f625006dfbdbbcb59fbd75b28ac2b48
TLSH
T1A7412858BAE91048B3B36E5AAFF6A86D487EB9732E06D45E00110D4F0A66F41CC61733
MD5 SHA1 SHA512 TLSH

Submit Download