hxxp://roblox-exploit[.]com

Analysis

user interaction
yes
max time kernel
229s
max time network
232s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox-exploit.com
Sample260803-zddvbabl7t

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2016	Bootsехеc=64.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
640	msedge.exe
3044	msedge.exe
5080	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302629529468152"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{610445C8-D387-40C5-A6F5-4293D32E7D1D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{722AD4AC-F67C-47D0-9305-8D6EC4E49F8F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{0A199EEF-AF74-4EDA-9B38-769FDDCE1029}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
2016	Bootsехеc=64.exe
2016	Bootsехеc=64.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
2016	Bootsехеc=64.exe
2016	Bootsехеc=64.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	3664	7zG.exe
Token: 35	3664	7zG.exe
Token: SeSecurityPrivilege	3664	7zG.exe
Token: SeSecurityPrivilege	3664	7zG.exe
Token: SeRestorePrivilege	1992	7zG.exe
Token: 35	1992	7zG.exe
Token: SeSecurityPrivilege	1992	7zG.exe
Token: SeSecurityPrivilege	1992	7zG.exe
Token: SeDebugPrivilege	3028	taskmgr.exe
Token: SeSystemProfilePrivilege	3028	taskmgr.exe
Token: SeCreateGlobalPrivilege	3028	taskmgr.exe
Token: 33	3028	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3028	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
3664	7zG.exe
1992	7zG.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3520	2928	msedge.exe	87
PID 2928 wrote to memory of 640	2928	msedge.exe	89
PID 2928 wrote to memory of 2060	2928	msedge.exe	90
PID 2928 wrote to memory of 2060	2928	msedge.exe	90
PID 2928 wrote to memory of 2060	2928	msedge.exe	90
PID 2928 wrote to memory of 5036	2928	msedge.exe	91
PID 2928 wrote to memory of 5036	2928	msedge.exe	91
PID 2928 wrote to memory of 2576	2928	msedge.exe	92
PID 2928 wrote to memory of 1716	2928	msedge.exe	93
PID 2928 wrote to memory of 2576	2928	msedge.exe	92
PID 2928 wrote to memory of 2576	2928	msedge.exe	92
PID 2928 wrote to memory of 1716	2928	msedge.exe	93
PID 2928 wrote to memory of 1716	2928	msedge.exe	93
PID 2928 wrote to memory of 1396	2928	msedge.exe	94
PID 2928 wrote to memory of 1396	2928	msedge.exe	94
PID 2928 wrote to memory of 1396	2928	msedge.exe	94
PID 2928 wrote to memory of 644	2928	msedge.exe	95
PID 2928 wrote to memory of 644	2928	msedge.exe	95
PID 2928 wrote to memory of 644	2928	msedge.exe	95
PID 2928 wrote to memory of 2512	2928	msedge.exe	97
PID 2928 wrote to memory of 2512	2928	msedge.exe	97
PID 2928 wrote to memory of 2512	2928	msedge.exe	97
PID 2928 wrote to memory of 4804	2928	msedge.exe	100
PID 2928 wrote to memory of 4804	2928	msedge.exe	100
PID 2928 wrote to memory of 3976	2928	msedge.exe	101
PID 2928 wrote to memory of 3976	2928	msedge.exe	101
PID 2928 wrote to memory of 4624	2928	msedge.exe	103
PID 2928 wrote to memory of 4500	2928	msedge.exe	107
PID 2928 wrote to memory of 1916	2928	msedge.exe	106
PID 2928 wrote to memory of 4500	2928	msedge.exe	107
PID 2928 wrote to memory of 4500	2928	msedge.exe	107
PID 2928 wrote to memory of 1916	2928	msedge.exe	106
PID 2928 wrote to memory of 4616	2928	msedge.exe	108
PID 2928 wrote to memory of 4720	2928	msedge.exe	112
PID 2928 wrote to memory of 2364	2928	msedge.exe	113
PID 2928 wrote to memory of 1852	2928	msedge.exe	114
PID 2928 wrote to memory of 4012	2928	msedge.exe	123
PID 2928 wrote to memory of 4012	2928	msedge.exe	123
PID 928 wrote to memory of 4452	928	msedge.exe	141
PID 4452 wrote to memory of 4420	4452	msedge.exe	142
PID 4452 wrote to memory of 2104	4452	msedge.exe	143
PID 4452 wrote to memory of 3044	4452	msedge.exe	144
PID 4452 wrote to memory of 2104	4452	msedge.exe	143
PID 4452 wrote to memory of 2104	4452	msedge.exe	143
PID 4452 wrote to memory of 1448	4452	msedge.exe	145
PID 4452 wrote to memory of 1448	4452	msedge.exe	145
PID 4452 wrote to memory of 4376	4452	msedge.exe	146
PID 4452 wrote to memory of 2500	4452	msedge.exe	147
PID 4452 wrote to memory of 4376	4452	msedge.exe	146
PID 4452 wrote to memory of 4376	4452	msedge.exe	146
PID 4452 wrote to memory of 2500	4452	msedge.exe	147
PID 4452 wrote to memory of 2500	4452	msedge.exe	147
PID 4452 wrote to memory of 1076	4452	msedge.exe	152
PID 4452 wrote to memory of 1076	4452	msedge.exe	152
PID 4452 wrote to memory of 4432	4452	msedge.exe	153
PID 4452 wrote to memory of 4432	4452	msedge.exe	153
PID 4452 wrote to memory of 3260	4452	msedge.exe	154
PID 4452 wrote to memory of 3260	4452	msedge.exe	154
PID 4452 wrote to memory of 1472	4452	msedge.exe	155
PID 4452 wrote to memory of 1472	4452	msedge.exe	155
PID 4452 wrote to memory of 3092	4452	msedge.exe	158
PID 4452 wrote to memory of 4684	4452	msedge.exe	159
PID 4452 wrote to memory of 4684	4452	msedge.exe	159
PID 4452 wrote to memory of 3168	4452	msedge.exe	160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox-exploit.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff596cc188,0x7fff596cc194,0x7fff596cc1a0
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,9208386875447581061,967375393462525992,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:3
  2⤵
  - System Time Discovery
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,3577004610230365538,8460807106563141872,262144 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,14712977566310545475,2894625783588875505,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,1355477479182990892,5989953099306645303,2097152 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,16704161926747463448,12760977947368462182,2097152 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,1762918672636318338,8761602187545269301,2097152 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,14427049515910973843,15131632389892671676,2097152 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,18092577760689001922,15868490939621000724,2097152 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,17864432140265492318,15206834048953482008,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,1341835525826355735,3693038908352053609,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6988658467660147548,14375370735665591126,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6988658467660147548,14375370735665591126,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,12360826737725915633,8357531205397369121,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4472,i,17029571905391077352,13801824398149089075,2097152 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,13957486851859566334,10890486614257266878,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,9301822506258979188,9655682970898086317,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,6937119784970872858,2422868097233667127,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,6550772611104869874,7858350952532481115,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,8405497741439052817,11397056267417888000,524288 --field-trial-handle=2940,i,13622450439999685349,12213348197181181998,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3988

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\uploads_Bootsехеc=64\" -ad -an -ai#7zMap3858:102:7zEvent29175
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3664

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\uploads_Bootsехеc=64\ReadME.txt
1⤵
PID:4232

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\uploads_Bootsехеc=64\RobloxApp\" -ad -an -ai#7zMap16981:122:7zEvent24095
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1992

C:\Users\Admin\Downloads\uploads_Bootsехеc=64\RobloxApp\Bootsехеc=64.exe
"C:\Users\Admin\Downloads\uploads_Bootsехеc=64\RobloxApp\Bootsехеc=64.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2016

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=y_giel.exe y_giel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch "https://www.bing.com/search?q=y_giel.exe y_giel.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x278,0x7fff596cc188,0x7fff596cc194,0x7fff596cc1a0
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,12503497702623811092,16606221693047332927,262144 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,13131479249516307502,17130640847767352632,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,5819889609099252564,11635889235512400030,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,4296542865164410760,490525065039281641,2097152 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,2850671848003071271,11858467748885783483,2097152 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,9809922914986670703,3107314610614871782,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,11202446392617480995,15623550919695379706,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,1208187769757921156,12861361907797680625,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,2013555462924159185,17570467008619817721,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,14069124528273756541,16354810849141841445,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,14069124528273756541,16354810849141841445,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,15650634005168185110,4671102171559092393,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4011258719871724012,5592293446539344832,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,17749889177148818988,5966902975823514133,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,4706686285169526884,17269881348397269390,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14636598282333290244,14398181732867258364,524288 --field-trial-handle=2432,i,12374019179119834662,10958408710796496035,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7fff596cc188,0x7fff596cc194,0x7fff596cc1a0
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,10622909120948482445,15767966184949169815,524288 --field-trial-handle=2248,i,9088266104832776425,15280583829084342060,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      System Time Discovery
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,4408931706602631515,3787134449903050612,262144 --field-trial-handle=2248,i,9088266104832776425,15280583829084342060,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,14011081464146594721,6909071002559908699,524288 --field-trial-handle=2248,i,9088266104832776425,15280583829084342060,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,7904266573960968856,17214954211794500164,524288 --field-trial-handle=2248,i,9088266104832776425,15280583829084342060,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
      4⤵
      PID:380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,7904266573960968856,17214954211794500164,524288 --field-trial-handle=2248,i,9088266104832776425,15280583829084342060,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
      4⤵
      PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b1918b6704ae6e4663b37e4093445e7354aa890ce7b1f05700f8421cb5595ab7
MD5 597dcc6fd12c28cf01aa5191c6f8f634
SHA1 448f2f1a3fe7f5ecc97ad07c00f91d4c5464f6c3
SHA512 ed67c6bce4248388b7bbaf87a721b1a31a66d78a17b56bae9fafd1f6e84b85053f37c34ca7d9fac3222e69d7cb10e914a64d247c405dde9e4b7da8258462ad7c
TLSH
T1E5D0A770B7159650C60E4030A816A65027AA8174309F8A639095540D6D99088D2DF585
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b8ffabfb85bd5921d57a7afe6be4c0e844f0c022ad8f230a9d510656a7299a13
MD5 7f04b0311252ca1f7d38abb921d396f8
SHA1 9ee9fe48da966e84646840685cb7f617fd9c2df8
SHA512 8aecb9c96d34a3817f02c69265a8e1224ffd502db1fc8a61ebc608e4f69e1066ad3c2b4cede7031a436ee0364f8ceb58a1071f20a88a052b7bcbf7fb7973a779
TLSH
T142D0A770B7159650C60E4030EC16A65027AA81B4309F8A639095540D6D99088D2DF585
MD5 SHA1 SHA512 TLSH

Submit Download

74eea961-2174-4fa5-b6c9-82025db769a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74eea961-2174-4fa5-b6c9-82025db769a6.tmp
Size 414B
SHA256 f2e865d8f7d656df6c8083dbffea31115aa57d3a143f287be0a70110e4245def
MD5 c734a9f51ab2f07da76ad00b3da1f599
SHA1 236889b879be928146d86f39c16c6141e55dec3a
SHA512 34af0463b68d471ded24311209a505812466ddc12a812a2ded8fdc83baf31fbdd964df7264a8b88e9f8a454f66d7cb70c5d4a61944ce9d25d9522350f746524e
TLSH
T19BE061E5C872EC375CFE075C91650645EB5823472E814A5B3B3C820C8FB96775185A5C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a84ae44382732cf82e23c123a4dd13b605645d59b27631c7474dd58637eeffba
MD5 f8b82222a5f0577788dcfdb5cedc1f4c
SHA1 59d77f75b4710b75d94db3141a10f75a09c48bf9
SHA512 209f3c4f8cafdb98a74c3cf42de9adbdbf6c3f35a921514ca91ddbd7b41c8f7ab11951222ea28f7d5d3b1956dd0ce63eacfdb46af4d84789e2c9379c1a15d58d
TLSH
T1E761703C09410465F3620132AFE16E0A7BB383E9F61F6DF195906BB417F6BD3C15A428
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b8732e652b3cdbb7238cb07e37140972cb8ffd5421d3c5689a8bdc87a8c26daa
MD5 49ed99d8f30b5a1dcdfcf1d846fb844e
SHA1 718828b58379d4d01466a17b453392d21db07323
SHA512 682128903b5332d07e1eef05f0cbfef60ec28de61e9f138c605ebd628aeeb38d176709b96d6adc7839b31970a73bc8f9bc606085caf25954ac710129ce337c9e
SSDEEP 96:kNOHVVLH2vbMReilzl7lKlL6Y0hChj5L164q:uOjWMRFZKlWYA+1Tq
TLSH
T164B14D38084104A4FFE188F2DBE0BD06FABB43D5F50F6EE591A0AEB217A6793C165435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 dd12df14dbeb6159f3b4f805d495e1bca619dbd1f90a8ebbcec29a7d5e208a36
MD5 c892e501cf3819606753904b593f2e10
SHA1 969e03b2c22058f0e79bbe2d88336fed9200cb54
SHA512 0fae8f9e140c499e1b049f1cec679397be3692f7b82d61798e588a7f072b4d11bee5c08c73bd0db9a75cdf1a283993e51bd170f16b33a8551913dcf9cf35957e
SSDEEP 3:MsEllllkEthXllkl2zE/l2g2:/M/xT02z3
TLSH
T1DC4402046B910406C5001170906183A01374D4101A165B43345108629C8A6400C20000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 d8a183e7c3139113aa6dc81f68c50ffaedb658a3e6ad455dfc7ea5d7a8309dca
MD5 2f7f99b66c02669ea185224fde264dc4
SHA1 6df18a21c251b2d472fd21c9989687d36fd77331
SHA512 f9db29a984df527b8ff028e3e3de3a1c7d4bd7b93d053f34840258b5750e2787c59719df3574868bc5c2ed10377ba97423e235b86e714e0f2b8300cbfea2512c
SSDEEP 96:6BCxVzU9UzdWqryw3V0wnOGiArYSRYJVnyL/UZ4UcuWC:waeqT0wOhSRayc4C
TLSH
T17E92E79B093D3C02DB420E7E2A9A0032E93FA07C9F97EDD8F16464554CB584562269FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 63baabbeb2bdd5be771176e4fae2ce8d2c4009004a3c4e0b5546be7fe913e642
MD5 baee1f7da3843a1bdd55e053159a320a
SHA1 fcb75b83938fc5d8494ff5deda44794784119834
SHA512 50cc8c3be65536ddac16a3c7eeb13439c5779bfd8a7de39efb82ca9c8576e32ccdf976cd46bc9f4cf7b6486ea9d4ea2c6223a25f5e5c3f0c11afa3f7802a14ed
SSDEEP 96:730UuUeMdDjNwIU+bGz83uy3+u4tgp4DLjGQLBze9z3PhUOUyjBHMsDEuspU0wbs:Of+G83uy3Ct7XBBK5H7DXspU3if
TLSH
T18614415E4F302711CDBD817669EB44F35D7DF03F8B1266DA686114B4CEE2A52A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 60c22d59fe9583b59b45088d1d6f5fe086b7254b48a9b775d61ffdf33e6d4d13
MD5 de1a3004eacb79e107029807c0bb983f
SHA1 f1d586bccd1f59b96cd47416e8c28fca19ab786a
SHA512 4b09e44b022218225e3dcdcd943b987f2830a42161b8a627c35b0ddba9c54388262a5373937d78a6e019cb58dca720adcd4f018197439b8467af596a8aad0f53
TLSH
T1F8E0D8A055DDC21DA654245F922D6748EBE03407FB8CAB411F049D8AF101044E2C59F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 5a327616cf5621694803d31a4778417b25d179a1d26e0ed63347f16a28fd5093
MD5 a06ae2fd8856338d83c02fb5afcc7e7c
SHA1 110a8227cc1c28d7f0e715827428a6108696e943
SHA512 6e70aaa5f68eb39cffd79957bc5050b4f51de2f421f9475a4021a2d67fae765a579a20b783ae6ad6fe98c1e7b081d2bae56305a521a1b1e26deda92e8e3056ad
TLSH
T190E020A055DEC35D9504258F53196F4CC7F0381AFA88BF412F159C45B1C1004E3C57F1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 17feca8bac3d7c9d44e02124e82c6b9a3cda132af2000ad0762c7cb4af984b03
MD5 18ce404e231070a4605077e5f3d6d616
SHA1 7a57a52dced83a7d583bfc440b8d49e001c8f5d9
SHA512 9cbbfc549f83f762f031c5a076b619cbe4b8fce2e08e5b6d8eb04395512aba78055101a08e2c8402feb4159848130e664f2fa4aceb81fc29af042d0cab8d3eba
SSDEEP 48:TtLopFMatSaw/auUOt8BY+oNwxwqiouAwH:9eMatUaAKqaTiTAA
TLSH
T1D8921D4E5F34A211D0B04B76EDE484633F7C201CD3A76699EA1460F3CEA25ABF5065AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 19f818e18a4a67521a345a19382b292b6da8ee9950f528d0a41901489f070462
MD5 303b87b114234057db471a1c33884e35
SHA1 35ad2a9eb6d8e82568d8e727bde5b4a5e9b43e79
SHA512 d08737910a528a8664ba7d8f0cb0b6241345bfe8e53313b69b4533a06a51975475fc66305f3e7f0b6cf76f7e2bb1d531edae70d87b17e366608fbc6eb1ddf979
TLSH
T157316BF3D2E5856D8D1216F0AA182927DE1D0920431C3C6AC8E4FE9F97F2471A10198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7bd28f4f9553f6a37123e69044fb94c67b0a56bb6e681e8715e58669d0b84ab4
MD5 6e6951e671f4ebc82832c1b035fdb47f
SHA1 8347c070ac359671f77aefba4e5b914066e2f7a6
SHA512 d9a4745a64d0281096f57c683862312fb184f2ae609302c8df3435a304af5aa3f057909067274546b8b94450922fd560f67465dc1db72fe3a7c90f9d88d07e24
TLSH
T1E3818DF7C7E8866DC91156F0AA183E1BCE1D0954431C3D5AC4E4AE5F97F2470E281A9E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 46017535829c921ba8f595f8bd8d2efc264207c8632a3e0e24eab35a8af07828
MD5 f29806c78ad060991fd1d4339b203908
SHA1 2275e6aba2e960f1c71a306c288b2de6aa539942
SHA512 7f75276cd8034a599180f87078661c2cdb9573b9bc68f6611f0ac15f32f8c377d4917942bdf186b2b2ea20ecc36e2cc34535c3fb5e0083d2e25e007fc5b4b28a
TLSH
T10FD02263221170B6A9AD3E8680AAFCCFC73740200C02EDE422D09CA8563646C454B288
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 95c5ae9f377e974373c3eef2e19924a79facc30d57025e1020a8c0462104c60e
MD5 119e21b74217a8e6acdbe96c909b0583
SHA1 100913dcf8744bc1ef6b6a48829f92359d06b931
SHA512 fd15e3cb1f2a7f93ca0c00cedbe85c350bfd62cc17f980d16e03498377fcdfc8205b0d9fb9cdac5aa69029ac1c1cfdca3e5136271e485931a7e82d57da4d0541
TLSH
T166E0D8D381BAB47610686D7E0D86BC816A3DD431018699F8DA9AD27CE0951B76A0603A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7920d1d510fef84f72e392dcc475562a648266caefe17c2cfc4ed375e83bcf79
MD5 564aafda1fa28e8dfec68c4e0941b07a
SHA1 1ff214f51ffe28f31201a6e08fa572b1d143261c
SHA512 0c918ef43533d26a479d975800f33befd54221309ed677ff8c7c774e1bcedf02c0b3b541c13f921d626cf080b3275d93024522ea52a300acdbdffa65fa6f4f9b
SSDEEP 192:sxZjRRkB/fvsOQmcIdpu6HW6+WN9qQ/YziG1GIgrJ:sxZjMB/fvsOQIFHbj/Z9
TLSH
T18922C7526E38A93B8CC7D219BB15BF13E6FA543395D11E58E6FC961C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 16ff42bc2b4d9c8cea583c61eaa8d7b60266002ffc0a9cf4b04d90ef51b78b52
MD5 eca2a61bcdb3751f9b0484616df00016
SHA1 6213db5ebfe20d6ce3d7270d31f56445c4d90dee
SHA512 c9fba16a67e8c2589d1817f6e2d26a6a8c48aa085838d30a7985046555b6b5c08240bdc5c5b7d9ac8d0b449096186a2478fd3d1e64dd54ee231c9c90fb2e5452
SSDEEP 192:sxZjRRkB/fvsOQmcIdpu6HW6+WN9r5XYzPG1GIg50J:sxZjMB/fvsOQIFHbbXKu
TLSH
T13A22C6526E38A93B9CCBD219BB15BF53E6F9103291D11E58E6FC961C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4a251322e6d2994401bb8fbc894a6a32f64c097c0976be5eedd8b68336143196
MD5 d4620f2372e86dead98ae20ef18043f0
SHA1 ec32f75f788a85fa69c4f673bb849148fa2fe963
SHA512 3f82e3ab77a32006ac6709abbad6f5402a6c69445796f65aa341ad69dfbe61bef0a15e4165b7b3e66d51e664f9c49818e32bf33118c6e5002bdfe76a0391fdf4
SSDEEP 192:sxZjRg9B/fvsoWpVs2scIdpE6HW6+WNQrr5XYTKFZMIgbWJ:sxZjQB/fvsoWvs2K7HbgXO+
TLSH
T16D42E5126938A87B9CC7D21DBA15BF23E6F9103390D11E58A6FC9A1C04E7BCD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7eea3a5ca745ff86e6a4a5aeff35e4299443a867c2c7d353f65e88bd05878ad4
MD5 c56770c2f8c51a3ec2a4422090c2ddb5
SHA1 c5942978b2afec995a3394cc5372bc40a2c73344
SHA512 73f4ff7082e27ca77f2670a4c9e7cb663619e9382cac3eefafa2fd0c9c0c40ad6bd5bf8ed399a14f4dc74b5ecffbc57ab24d9dcb85c3cef1a821d0eccddde1cb
SSDEEP 192:sxZjRg0cB4B/fvsEWpVR27/OModp96h6HW6+WNQrr5vPU/TfIkTDhiGIgbNvPdkQ:sxZjBm4B/fvsEWvR2KdHbgE/j9PdkP4
TLSH
T1C172C8526924D9778CC7D619BE35BF22D6F90023D9920E5CAAFCC51C01EBAED220791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f440bba753b47d2f24c4060898976e97090d332d15ee7f44989087152a0087bd
MD5 0cd484ebc8c6567cba0d94f01d07c4c3
SHA1 9c9085f08a165308d3074b9dc206106c87e8b898
SHA512 8510984b84201ba9e769d0d904fd24dc46965f1c8d434fb1b94d042050a92acfbc1eb29fa6e3a13921367b577e803a678ddaaa8bf34183a6ab3402b4fd803aa2
SSDEEP 192:sxZjRR9B/fvsO2mcIdpu6HW6+WN9r5XYzVi1GIg5WJ:sxZj1B/fvsO2IFHbbXGc
TLSH
T1C032D6526E38A97B9CCBD209BB15BF13E6F9103390D11E58A6FC961C04E7ACD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7ed80cab7cdae72da03d86bb4a048b313cd8961194479f607c022ec923785e54
MD5 eb87d69ea54d72fcfb29e8950ac346ec
SHA1 16edb29129abcd8ba21295706286b956886eb23e
SHA512 b5f00c8f8076b1c8b09a62a19c2f8df76543074b3ef31552e51dd9a7099acd5bdfe68ed7d330cfb5fe77710e441441ac7b0ffcb62c439b515601e957a98ea2b1
SSDEEP 384:sxZjjm4B/fvsFWvRKi4NdHb2oX9a9PdkP4:sbjm4B/f2YRK3HbX9ISP4
TLSH
T19C72C7526924D9778CC6D619BE35BF22D6F90033D8921E5CAAFCC51C01EBAED220791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f53b9752759f506bbc3340a332c4ef044ecd707c133d3c56b4b00b127f6dc302
MD5 3706657e9ce14eb1f08714628fc81dcd
SHA1 b49773a30a9973bda48a212e1631748116e456a7
SHA512 1043ed2a3eb9ae59724003f78d97b77cb2aa20e413d842413756e4bba7e65f23d48cbd993fba3cbaee8a9ce6635ff163f2f6c4708ce3c2ffabeb33843d982515
SSDEEP 192:sxZjRW0cB4B/fvsEWpVR27/sModp96h6HW6+WNQU0r5vybXTfIkTSz5GrMIgbNvZ:sxZjjm4B/fvsEWvR28dHb2oX909PdkP4
TLSH
T1DA72D9526924D9778CC7D618BE35BF22D6F90033D9911E5CAAFCC91C01EBAED220791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 df276a784cec0769fce2f11185cb9d702b0a3688a525dfbd8ff8bf8aa72b7c49
MD5 508c315e23a125b2ae859aeb5a27a986
SHA1 155e4d39e3cf9d74186916b7f5569ce4b17d59dc
SHA512 7ad9694e4e2b7ad5cfc4fcffa21d3d829bbfdb49697e16524170288c6067c4f282ce36a15e78b89657fe2765248029cfff16d454c2d972d20c9f151f9a6edb4c
SSDEEP 768:VBk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBgroyqYe:VBk7u70WvqiEau1jai5LA3Br0e
TLSH
T13BC2E93B740CCB7E4F801E9DAD166F977E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 b2781a575ffeb1a9348706df6e7d1f10334f31038a731d21904b46b9e1affbe5
MD5 aff29d9d53b50a0acefeee4cd6c4b4c4
SHA1 955f4eb8050ae3b7047f0aee5c261b03106e3490
SHA512 8924a9653ec8566e85e988f1aff120e31d9c4c04897c225fcc1343996e3b379f92267810bb9af3aa769cdb699fae86bd991712e672a3bb7e4bc439551fbebba3
TLSH
T13CE026D455DAC27DB11660470329834893E57537EAC8BE073F01CC406242504F2E75F0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 730B
SHA256 2ca090d4a3b49890979e49ba58181bda41349ac9fdb8a9c2387996fcdfa23683
MD5 c6c9e012cfb3a43c8e8b283c22bbc1ed
SHA1 f9e5b23da9de0475dd41c2c23bab3a1379c63290
SHA512 bd4219dd2851efe10f9882b0832e40629cb66de8be98e5a06965d8732615633816fbe6fd370e5956212fbe03e13128029eac21eeaad4d66f4787ac310c686041
TLSH
T1090149E78D1C5867ED1E86B01CC93364AB7741DD05C8C9C6A7BC92839511232B83A89A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 19db54bef0baa252f7a5641e35ebfa643dd5e4ea97ee8e8b9a42b4e323b3d94b
MD5 3c5dc4af63fd2136e7d8beb933c835df
SHA1 6ec4153d0e9b3144e34b548051e48bb6bafa6c4c
SHA512 8e3c88e63c3890e610c8ed070fe595215f265cd7042f2c7a9efe070125d90bc68f0574e6d292e3084cadb4d484d19341ebf641d9a5a11a0f3d4166c60d4db4cc
TLSH
T1E7E026A414CCC3299920659B0236574CD2F0350AFB98AE422B0AC4806345101F3E6AB1
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430263016556435

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13430263016556435
Size 976B
SHA256 da813476b046f4b301d0d820ba584229e27aa2fc9725183c23bfdc2204d31200
MD5 faad37fbaa933aba4b8dcd9ec629c392
SHA1 9ce4d09be8a454fbf45b2758960d2af3da81a88a
SHA512 b8d59e7dde0d73c4588caaf572e0bdda13b974d8b542c968ebf5d2ee8536b04808b0966c9db4688ffeb0d935de5f98db72cc23689c55eea103cf4a38acceab51
TLSH
T1C71128746DF00076E5BE8934D89A04F665BD6E403681C97F8131B20C4D5270159A0FDB
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 78bc449525d5d6f247da679c400ba85712d532e2012b8e9c2e71c3552254b771
MD5 4b6bd556c987b532db9bf26ea49dcae3
SHA1 5c9787e39085b943d1cbd99c10137b4d5be82334
SHA512 5fd6fbbe5249b50e74ea45da464574e8592b4f69a6f17cdd1071363968407e6e5482a5a0f7f9a6b45b9c40bcb7d6018e492b9031c147d4e34e5ca364532b5f39
TLSH
T1DAB012987F414215D4C9083209A0DBC09321FD0A041049379C885F644C083783F00DCC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 acaaf891c3f547708e1479f00ab4ada15577f6eb7fe3649d52ae85cd8f7de686
MD5 5ebf8fc21e018ebcf336e3e6709992f3
SHA1 dc459b919e65a4531e856d9ad4fb4892f47fa34d
SHA512 0af46a9afe6a51b9965219945b0f21184eacca60f2fc9d69afc015c80c5f97fbfd8aee66aeb2e0c84dd7357bba67357c8c76fcdf753649bfe271690c8de5f7b9
TLSH
T163E0D8A465DEC72AA145209B5329D348C3E27402EBD8AE177F0ADC406306140B3975B0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 67402d1f91c29d118131d25a0b8a622aa8004ee3ef1b4c6ca93aed1ca54e4f9f
MD5 b5fb62a60bdc69ad92ce7a8a2526dfbf
SHA1 8ef460cf012c0ec8ad001c36dd468a872f5c3482
SHA512 8b8d356f55999f9f55cd136b6a17acc671e7582d350ceae498f3a56969f55b98ac1dfcdf3fcce7688e7e68c7503bfe4ec457a38d442428d528fc8a0c3c15f264
TLSH
T167E086F496DAC339945560CB43A5AF4C97F17806ABD8BB4A7B094C85A201184F7FAAB0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a327b7ee897dd869f8bdd79a63eeb59ae9c03c302751e0841ebed102cf784f2a
MD5 f18cd7a8474b937d749f4e8cafc3ee80
SHA1 098382fda3114960f3453cb65ca6980560502b1e
SHA512 306f15ddcb3c5c8b8082e2c3d479fb3c267955a0ecb5ab3af804bf6daae5d72f6efb8759034b8bb8a8571fc377f5519246b9a8680ad44c399be48a5a3062c0fc
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT3MIXKZqYHyNlIJKek8iCI/Kr1:KIbCKc3MIKZqS2lCKekdCsKr1
TLSH
T1F491FE1A717B06013CBE2D8DA296C5365F4231A33454A9AF7FB904A24E66E124FFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 36463f8de7796072fe3b4c4344f0e29a0b98ad40f88d3d5f47e0091cecb99b44
MD5 de6bc83e655853e80e46eb8b3efb5e40
SHA1 16dc148e7aad460f91fa03c4b39b2b450d372e29
SHA512 12e99eea58bda892c5907ab57f75908cd6ee5d8c6790798aa13775fb3771746537677784fd9c9b2de96f117c7a9fdb3c833440bb15b1c894a179217426c8947b
SSDEEP 192:P+xWjMjq0Wq5HfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx0eHfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T13824630A7B747001EDE6D9725CB080771E3C716ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 100KB
SHA256 a553ade19b08f21ecf8cfa202de5dca79b6e15c0633db9b2c290316bd3568aff
MD5 296b5c9d6be8356f758dc20c50173428
SHA1 00d5b42e5bab5537b33a22feb9310bced91b6c53
SHA512 5f3498debfef17ee2965151d9bb2fae6d9761e59124dcdfdcd7015da4fe2841ab383fa445972a606fcfff46a4352232a966991b909d2600f912b5279dbe6a7fe
SSDEEP 768:p6gK/0zLi841O2K+ApUowVk/W6jVBysg0dMtGoVF18yLx76TH70kJDTEJu8POD+P:XZIbkJDYNCHCi8Cq
TLSH
T1A8A31EFBAC0A92A6DDCD91B8D41BFF45407306218624D8E5AD3D48C33BF8A06BE755C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 14KB
SHA256 97a159c98e0c4a2c5121f4e6f34c2afe6309719ca6297f14691cb9173106a7ae
MD5 080a26c48c82c4d62f3ae1488dba9b75
SHA1 b5206436cd322596de202606cbc9a3fe2956806d
SHA512 87f4c65246ca389e6127335936181be7843c40d04a7306e028454e850d3fcb54a60405e078f6d7de2660d1f0cf140ea71852813ada11846eccc807f2aeba2195
SSDEEP 192:jQ2IIIBb5MIMbmYcY6tO3gAsKFlrw5Q2sK3Orvw8Qy5qkL:jQ2IIIBb5MIMiBk3psKfz2sK325L
TLSH
T14C62D7AA13200B7BC1AE5FBA5A5AC5B426D9CC414D20925EB061384FCDF7B6782D53F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 b9e8278abe4fe7ef68f46e8441747a07c8cd56e32e00b84f4e599be24cf45856
MD5 477a3f573dca3cb9c4f5327a8e90e2b7
SHA1 d11cf7f8d5597a3ac72bc5a3834c2db50cca4260
SHA512 5e69ccb1ad0e20701411e9954bbdd2a77fd0c796f0017087195fe18a2cac044174c3c5aae843593552b4eb61511d34443c29e45c58b4ccafa7c64d3335d16dea
TLSH
T1C9E026D0B8CAC36EE41524CB2335838883C03803FED8EB063F19C884B241100FBCA9B1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 becc3d2d4dffddd3150ae9531a16d522a9a9173a4250bcdf55c921bde207157b
MD5 309f85957ee31dbdeb22ebae088a9d8c
SHA1 17104b22a12634168351d31e6e808238cad8b8d3
SHA512 4216891d5e326eab776b1c156f093a0ea1e75bc5f7058c55ae46098bbf92b5973b44e7a544ec50e1ea8a8868474ed784bd0f1d0a00a2282e4a8764cb1eb30b38
TLSH
T1AA2164A1F334C104C29A4679147E6B261338D8568FF8EC1F15B960A57F76E000E8B2E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 af163f805cc2a6a0b7feb826718f2f64d406bd6175e873213ae029d99333be44
MD5 6a25d94927b862048607396d535bf098
SHA1 8e66b1522ebd6cc48048af89a5e7536172d15fc7
SHA512 a89ffde034ad846bf0474fb500c4be0a5180ff500eba8bb6c6db6970db65bfc0bcbface0ed35c62b617f3c97dc8daefbeb8fb1786d963237b11b586e1afc6c3c
TLSH
T120E0DF90B8CAC3AF901124872375D38883D13802FED8AF023F198C84A241141BB8A9B1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59301e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59301e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 18156d9ef8025cf5becb414f0498dd3b5dd56b0c8b4a3d837ac771d6f3da1a92
MD5 46bf6a8cbd02cd1c8f861246405a82a0
SHA1 468ef410a2dac9e480e8b1da8ee1db11d4d6e28b
SHA512 8a7096cd69ba509a37d42cc9efece95ba5dd1c21a58fa5ea8d66667a8c4f243b980d83159c645617e737347aece9279c4522178dfcec840293ebdadca828c7c1
SSDEEP 3:MsEllllkEthXllkl2zE/lLt+:/M/xT02z0t+
TLSH
T1744402056B851807C5181570805183902374D4100A136743295104229C85A400C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 caa487c44321aa197c422fc45d3712e6cf37170e6053d6947110fb26510deaf3
MD5 81b1662f57e8297d556d8aa389b26508
SHA1 64884eddd7f7f42ff706ebfaa1fb5eec09abdcbf
SHA512 ac8d8220b93399e356a0dfcc7a3cb74b5936b2269d7b52ee17195c1e80f783596eefe1836b75a099dc598818b2b0b957890c9d5c5a35545d2e87003ac01a377c
SSDEEP 384:UZcIhsNHSywbwBtdn2VZ86HlytEDq1wKD/:Sh8wuV48oy6DqCM
TLSH
T103929E309CB45E3AAEB7F150F48A35074EF88067A7D86F84B5EDBB2D01DA6E41307516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 7e37e5555473c4d0f71e1e492335175de5537e5467c32ee340ab714dc6ce35cb
MD5 4c8fb65102141556162b228abddd86f8
SHA1 018ca914862d1761c5d67207b5302acd3982aff9
SHA512 75c3e122721953cfa1c0ae416f01241913566a469d1bf3fc084bfa7345026caf7b655e152d166bb5bc4ad8a79e1848658da40d600c252961fc41d750562e19a0
SSDEEP 384:8iFvZcI34sNu8TUNTUlIlSywbwB4dn2Vk0CvKASBvAdoo9aK96HlytEDq1wKD/:nFnIxwgXwpVLztS5o9a0oy6DqCM
TLSH
T107E28DF088E759B6D96D9BC3A37DAD025ABCC077B4945908B3E4A62CEC4B1BFC312411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c29decdcec8d4d8f182ee6efc84cae2041a73330e363dfb662f8671c8b1fee5f
MD5 d2d14045ba9d7caf4c340e69ebdee4df
SHA1 f5f87be9fa2f6d81a3e02baf7b2431975a14aa39
SHA512 e343b8e1637788768d7d921ef2692a29bdbe89e2a308d1d3b753fbb3db02b3e47a71945b901e5f96aa35bea8c96f91a93786b15078783be2b0b846d8de6779bc
SSDEEP 384:VZcIhsNHSywbwBtdn2VZ86HlytEDq1wKD/:thOwuV48oy6DqCM
TLSH
T140928E349CB45E3A6EB7F150F48A35074EF88067A6D86F84B6ECBB2D01DA6E41307516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1d3c760bf40cfc67dfde871a9bf6a3c0361053d34152b8d695a10def2f4bd25c
MD5 f3e165da5e5c4c081fd3b6d9c194075c
SHA1 5658540628136f3a5830135b635801c8b001a68a
SHA512 5a6484bd7625344d0e599024c836e9ba5a96692ed9285658d2d047a024bd277761b5d1990b6490c7bdaa66db18b19e08f2ca9034008e2e5b6b2046e10caa7d0b
SSDEEP 384:nviFPZcI3psN88TUNTUlIlOywbfqdn2VfurP6HlytEDq1wKDFHx/7IzI:6FH5fwg/w2VOYoy6DqCa
TLSH
T11BD228F148E78936E9AE9703A7BD2E025EFCC067B4849A50B3D89A1DDC461BFD307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5c0a43f78bcb26eb1e273afa5a744ed620285bcc00c930df0eab0402cd7fb64f
MD5 60b98ec55f8f7846c3dacca3d4fd1a9c
SHA1 af43271e5571d75ed8a5b6d6dc1476333162189e
SHA512 33f8ada6b51e4180bedc704f61357e13779cefa1f3d29587957dc14cc74e45d07efad03ffe15a01911e41bc1f8d41df16bd299ee805e02c714882a2034a81597
SSDEEP 384:nviF1ZcI3y3sN88TUNTUlIlOywbiPdn2VfYGVSbElsw9Bqo6HlytEDq1wKDFHx/n:6FNi3fwg/wAVOhSjw9Bqooy6DqCa
TLSH
T1EEF28DF098D74DB6D9AD9BC3A77DAD026ABCC037B4845958B3E4A52DEC0A0BFC302411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c82ae2351f3786b7e18eaae6d41002ffb142067e3ed9bb56ff89a4989ec4f7ca
MD5 d93fbea2ab61c6af032bd2fcf3c7033b
SHA1 edfeeeae9a46e4afd27a5d07d018d8a48918acad
SHA512 900d9f62408301d0ac722c6f85201c4fb69561619ee76911f50281bcf4077313123e54f84678fdb5b2193461bd77d9452e0f8d73826a334830a2b62788e3dd7a
SSDEEP 384:8iFvZcI34sNu8TUNTUlIlSywbwBDdn2Vk0CvKASBvAdoo9aK96HlytEDq1wKD/:nFnIxwgXwqVLztS5o9a0oy6DqCM
TLSH
T119E28DF088E759B6D96D9BC3A37DAD025ABCC077B4945948B3E4A62CEC4B1BFC312411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 02a012d7eaa0f2ec8b71972a584401d741261636590041c1dfc7a6eaca928945
MD5 5968e1224dce37002050507a36da4e90
SHA1 8c2923796ddc3b574e442ccb096f374d5a92c219
SHA512 ac689e1c234852beb9c12e34b5bc8dac460e728a881fbf2b389837fc1448ad49253ffb6d6e63bfb71a58222ef507316362c8ab5cf80e4d960d13d19a91cbcf3c
SSDEEP 192:MONa64BAQmiUyMY1qW5GBPKScC2567aDfphU6:MONa6eAEoWE2BPU6
TLSH
T1C2021B396C796C7B9EB2AD45F48737175FA4117BE6955F40EAE82B0C00D768C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb2bd16085a10e75c82dc55ebeb96cd74a73ce346790dc5d956922a51fe00595
MD5 f17ab8b0202b36bd861b817105553314
SHA1 8c8606df605f9af11091fd5d546a9819cfe72920
SHA512 7928ff0c96955252b8e126ea233278d514d7ab4994cd0db1b7602f9513cc46a9854216a0a8e11b7d424f88ec5a54ffe903dcbafc0ce1c63bff38eabd44d4268c
SSDEEP 192:IONa64BEQmiUyMLq/5GBPKScC256bePNmWwyqsU6:IONa6eUa/E2VE8U6
TLSH
T14B122C35BCB96D2F6EA2A550F08632075FA4416BEA85AF40E6DC371C01EF79C6307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 4fdd26377ea6efaeac7accb73ee084bbd35ae5b9898ec68d9a10c8da720d8836
MD5 ba6d4c1fe1aeebaeca7ec57458ae76ea
SHA1 95d3435c2d58f13b01257fcc5057c65ac7a63db6
SHA512 221b44f66661b44b34723ff86f3ee8c2eafeb202cedba4413608ac1c6b84b457fb3cff58db88eafadb347b2770335818e57047705f83c923cbec98e7fc929c8a
SSDEEP 3:MsEllllkEthXllkl2zE/liDta:/M/xT02zzh
TLSH
T1A94404047FC00407C5041371C053C3F01374D410071357433451D433DCC57400C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

0b560764-0190-4c81-90b1-1d6ce6a94434.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b560764-0190-4c81-90b1-1d6ce6a94434.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a108407a5b491efa7b2df8c5edc7dbd3bf0fbe616518f52c00d45b867960323f
MD5 ebe1f7367a858f415c8698d478f2e01b
SHA1 dbf283c4bc1423644a57a1ac41d411660c3ca86b
SHA512 78607d47450490669e7afbb6076923def8fa80dccd31604acecf7611aefea6cdbac416d495a36492d2d58f298e0e28b05b8d6f1fb9c346e56cc5f51b279ad2ee
TLSH
T16D41069CA6E90148B3B7AE569BF6B86E447F7E372F46D45D10010E8E0A22A40CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download

014f8ba3-b494-4ccb-b80a-e6d10497cd22.tmp

Path C:\Users\Admin\AppData\Local\Temp\014f8ba3-b494-4ccb-b80a-e6d10497cd22.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7249f053-b11d-408f-89f2-f74de2787ad4.tmp

Path C:\Users\Admin\AppData\Local\Temp\7249f053-b11d-408f-89f2-f74de2787ad4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4452_1877077581\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7ae3d3e-5a86-4f93-90d0-85d02c1c1329.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4452_880061025\c7ae3d3e-5a86-4f93-90d0-85d02c1c1329.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uploads_Bootsехеc=64.zip

Path C:\Users\Admin\Downloads\uploads_Bootsехеc=64.zip
Size 6.2MB
SHA256 0ae4c6180bc24c0c9a02b180e241ce3212c0a920d1e83eacf739ed6b08c8c7aa
MD5 597cbfa1f6e05561603b0451653505c5
SHA1 46a21008eeadc989ece01a51a5c4aac609a45bd1
SHA512 32ceedb30f3105c457008ba92746da622ed022daded23b7e5831c5f561175df28f03b58ed91f3eeec05ef3c2a8d0fcb0533ef4e4e3dce8dd952da641b81e65d1
SSDEEP 98304:OY1ArVL+7RH/IXozAA3vmAnel0TI2mEn3fYMYzrL/n/YrydjEAZLrx10Nc6Z1S7Z:1CxX4m2e2TPD3fgrL//YryLrT0K6ZaZ
TLSH
T17D6633BC5E542D60986BB6B56D2413E7CF7C9AF1BBA33E04292E38E5101A7BB17D1304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadME.txt

Path C:\Users\Admin\Downloads\uploads_Bootsехеc=64\ReadME.txt
Size 98B
SHA256 517ad37fff3b852a55aa7aac2c02dfbb5f1116fbe3d74c1a4ab3ac2132fd91f2
MD5 26590565d252e1e56a5bd55c6723d051
SHA1 42fe98bd6415cf3431e7e6e17593ca27f80aad6a
SHA512 62d58f3d421b0d17ec7bd89896cae4f4d534c4babf435cfea61a0ab375caf3610f7cf8b7c5b178f05d2e28c8e45060e12f8d841f525a768a270fa49a7eb73d27
TLSH
T134B012D3D20A843223C0B4403B0921E0954B480CB147C941FD21D07D138408C8961ACE
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxApp.zip

Path C:\Users\Admin\Downloads\uploads_Bootsехеc=64\RobloxApp.zip
Size 6.2MB
SHA256 6faee0358fb5e56a9dafd114c32f98b961968a1102aa20372dc2f16482fe73c1
MD5 09fca3b11a959194ac6dda33f9e01d0d
SHA1 8cf1ee7885229e8e50deb7ac305eef8256bf4582
SHA512 db7d0a991c96dc85e421b8c37e3d0513618e17220ce8d4a8df5827a1db234157f036f9f769128821be5be7a85af25023d48b3e72c43b5a96cd7c2b800fd7b98a
SSDEEP 98304:tz/90lTghFn4D0+dSRb27yKzKiSiMz+OGQC4dxBK1hUCAQl7xJAqyNu3eVqUmyAi:VWghFn4o+MRI2ilOGQ3dHpxHdmtdK8St
TLSH
T1E1663355D6DF2AC0AF05C8E56EE1E680CC11051B44C9F7DD6C7ACAC2ADEA7ADB087321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3028-389-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-390-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-391-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-401-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-400-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-399-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-398-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-397-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-396-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download

memory/3028-395-0x00000216A0780000-0x00000216A0781000-memory.dmp

Download