hxxps://dosya[.]co/j4ztz6mn785x/roblox[.]py[.]html

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/j4ztz6mn785x/roblox.py.html
Sample260808-relbsastds

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
884	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306715964691903"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{2B2EA70A-881C-4541-93CB-7EDD08F8CBF8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4032	4648	msedge.exe	84
PID 4648 wrote to memory of 884	4648	msedge.exe	85
PID 4648 wrote to memory of 856	4648	msedge.exe	86
PID 4648 wrote to memory of 856	4648	msedge.exe	86
PID 4648 wrote to memory of 856	4648	msedge.exe	86
PID 4648 wrote to memory of 464	4648	msedge.exe	88
PID 4648 wrote to memory of 464	4648	msedge.exe	88
PID 4648 wrote to memory of 3456	4648	msedge.exe	89
PID 4648 wrote to memory of 3400	4648	msedge.exe	90
PID 4648 wrote to memory of 3456	4648	msedge.exe	89
PID 4648 wrote to memory of 3456	4648	msedge.exe	89
PID 4648 wrote to memory of 3400	4648	msedge.exe	90
PID 4648 wrote to memory of 3400	4648	msedge.exe	90
PID 4648 wrote to memory of 3976	4648	msedge.exe	91
PID 4648 wrote to memory of 5100	4648	msedge.exe	92
PID 4648 wrote to memory of 3976	4648	msedge.exe	91
PID 4648 wrote to memory of 3976	4648	msedge.exe	91
PID 4648 wrote to memory of 5100	4648	msedge.exe	92
PID 4648 wrote to memory of 5100	4648	msedge.exe	92
PID 4648 wrote to memory of 2004	4648	msedge.exe	97
PID 4648 wrote to memory of 1880	4648	msedge.exe	98
PID 4648 wrote to memory of 2004	4648	msedge.exe	97
PID 4648 wrote to memory of 1880	4648	msedge.exe	98
PID 4648 wrote to memory of 1804	4648	msedge.exe	100
PID 4648 wrote to memory of 4588	4648	msedge.exe	103
PID 4648 wrote to memory of 4588	4648	msedge.exe	103
PID 4648 wrote to memory of 4588	4648	msedge.exe	103
PID 4648 wrote to memory of 4124	4648	msedge.exe	104
PID 4648 wrote to memory of 4616	4648	msedge.exe	105
PID 4648 wrote to memory of 4272	4648	msedge.exe	106
PID 4648 wrote to memory of 1140	4648	msedge.exe	107
PID 4648 wrote to memory of 1140	4648	msedge.exe	107
PID 4648 wrote to memory of 1140	4648	msedge.exe	107
PID 4648 wrote to memory of 776	4648	msedge.exe	108
PID 4648 wrote to memory of 776	4648	msedge.exe	108
PID 4648 wrote to memory of 776	4648	msedge.exe	108
PID 4648 wrote to memory of 1088	4648	msedge.exe	109
PID 4648 wrote to memory of 1088	4648	msedge.exe	109
PID 4648 wrote to memory of 1088	4648	msedge.exe	109
PID 4648 wrote to memory of 2000	4648	msedge.exe	110
PID 4648 wrote to memory of 2000	4648	msedge.exe	110
PID 4648 wrote to memory of 2000	4648	msedge.exe	110
PID 4648 wrote to memory of 4592	4648	msedge.exe	111
PID 4648 wrote to memory of 4592	4648	msedge.exe	111
PID 4648 wrote to memory of 4592	4648	msedge.exe	111
PID 4648 wrote to memory of 2672	4648	msedge.exe	112
PID 4648 wrote to memory of 2672	4648	msedge.exe	112
PID 4648 wrote to memory of 2672	4648	msedge.exe	112
PID 4648 wrote to memory of 388	4648	msedge.exe	113
PID 4648 wrote to memory of 388	4648	msedge.exe	113
PID 4648 wrote to memory of 3196	4648	msedge.exe	114
PID 4648 wrote to memory of 3196	4648	msedge.exe	114
PID 4648 wrote to memory of 3196	4648	msedge.exe	114
PID 4648 wrote to memory of 2736	4648	msedge.exe	115
PID 4648 wrote to memory of 2736	4648	msedge.exe	115
PID 4648 wrote to memory of 2736	4648	msedge.exe	115
PID 4648 wrote to memory of 1312	4648	msedge.exe	116
PID 4648 wrote to memory of 1312	4648	msedge.exe	116
PID 4648 wrote to memory of 904	4648	msedge.exe	117
PID 4648 wrote to memory of 904	4648	msedge.exe	117
PID 4648 wrote to memory of 3524	4648	msedge.exe	118
PID 4648 wrote to memory of 3524	4648	msedge.exe	118
PID 4648 wrote to memory of 3524	4648	msedge.exe	118
PID 4648 wrote to memory of 2964	4648	msedge.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/j4ztz6mn785x/roblox.py.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffc5769c188,0x7ffc5769c194,0x7ffc5769c1a0
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,8781025956863512680,13602709688213928412,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,3141573594591404020,11919105452721998725,262144 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,12915934803506082558,1814935563464810938,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,17678821360156520859,1737322653586323324,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,4623954825468214198,906632034386005791,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,1090971178470641284,13648162377655907166,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,11472610401654201197,8880295568746938593,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2895760841499168706,6436102805991514476,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,660591942056417808,12398181085634955605,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,12878182728578304936,812401086061079020,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,12878182728578304936,812401086061079020,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4472,i,3561149009315944394,17830195038933701702,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,14837608993421545259,6125880259144390165,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,13781221470839098420,325218277751753463,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,11243617659939310208,5318490892293566423,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6228,i,3877167941828026130,18364743093527551324,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4472,i,9981196045953607997,14612296162470006522,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6452,i,11649262967715038320,6613598078815659370,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6612,i,13692782106041459288,9832931006907773788,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6740,i,6258382382266198716,16273857222502568500,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6932,i,11570328598525602885,8451772643157490483,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,13514867580811555476,11575415895430588182,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6800,i,1846702705112209250,2792089635525630239,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6952,i,1546041725569777772,12637608280602159217,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,8914503130808943895,11572860467887925649,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12676536026040124127,6488026408208093233,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7516,i,16437803366672538315,6358090721037355080,2097152 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7696,i,1246611625090566966,5061269453503844238,524288 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6912,i,10960779151892025608,12987583309114310540,262144 --field-trial-handle=2300,i,14348301380361635397,1011333606327412451,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a1e1f35f1105d6e94f9fef99f3cc10cfb491fc5acc7e8fac7058363563aff2ff
MD5 0ba2216771eb14978cf5c0e246bd3ebb
SHA1 0652c7a1281fc53b37b91c34dc1ba8d1e99c7f45
SHA512 47c4d1df9aec67afe99971fe993378e616138ed26788ac31096ae5452bacb3ba6ea5daff1f7d2eb68d42448c9fef337f1de3d0e087908ce461852013ee88e4c5
SSDEEP 48:CZppZmjCmyRZK9h7magw7UzxnxVWIjt/Njvz4dUW6bJvzm2GJo8UCGjo:XCRZqdNgwWr7/lvz4GW2vynUCp
TLSH
T10091DB2615C684E2DBA0C3B3B4C90959F4384BF6668FCE431A54CF76B26F3E1D496784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f1d6c9e3438a3fea4a9f52d609304e8511441f7d410bb99bb7aaaf8fae44e30
MD5 24e5ab505c163640b8b40a0d9be037c4
SHA1 7d727736d6b51e8eabdb7e425a5e6edfb21ce03f
SHA512 7fd1f1b2a7e39f578c7f5c215243803f046fa19f8228f0717ee9ecf05e0bc1354b9496648333d7c2119995869668cb6250b8a09fe93f115e89bde2d6e3fe1ef8
TLSH
T16671A11212C588E0E7A0C273F1DA0248F4788DF5A48F8D4625A0CB797B5F7B1C1D6BC4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 1059b26e6663f9933ec028c518380c73a429079bf6e6a624f22e054244a71706
MD5 6e094b7a33de5ebd41d2687c9029974a
SHA1 efb977a4c831f881aa7b2a6b2cc2bed5c9db9444
SHA512 ffbe4b65c4e763d9bb28390d82a74be7ee5221e0d5f334cb28bd9ee4e598403a7e4d07fb42257b65ebc6214e47f4aadee4512a14d717e15bd3cef679d802b267
SSDEEP 384:DUcbckkctFCQesQXELGJBBebeBKmuOJ4Pej65J74GMUfZyRLMVJ2u9abEtQqHvD8:ornGKQdD/7AfdD5p
TLSH
T1FF72ADF7C3F4862E885252F4AA246E1FDD190A1A426C3D56C9E5AF8FE3F1430E251D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 07bd35ae8da31159b94f7edb35d0b4ef352a43184f2b5bcad22ab3d6be039a89
MD5 b4ccb59be76dc3f0828f107b8a1a9416
SHA1 a3c586c257e43c19061d703ff5e5215cdd150680
SHA512 6067f86fc06a8bc2354a89652245bd137065a7202ffb4c9a136030285a00226cc8c63d89b9304633a7194c3dadeeec7176bcbe65d364cadb10426d3ccfa84acd
SSDEEP 192:sxZIRcka/fsshnSeIWIdpRl1HW6+WNIMC/Y4/XFXf+uIg5bJ:sxZIta/fsshSeIXZHbS/nXft3
TLSH
T1DB22C9916E38A97B8CCBD21DBB25BF53D6F9503291901E58B6FC961C08E76CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 735f3c586498f9172c6a18309d39578c54e3c957c87abb70432fd3ea68149523
MD5 e97f58ce82eee081aba2b2f8634a0654
SHA1 57b361d11ab71e566acf60e3cd782b37622054cf
SHA512 8ddfd7797b8c695cedc8cb9e35d296e1873056ca9d3ddd516a5783e0827efae223fd07545b88dbaac5fdd5d60569f35acfa291e69b1291c19744f88b1c2a5333
SSDEEP 192:sxZIRcka/fssInSeIWIdpRl1HW6+WNIMC/Y4/XFXf+uIgrJ:sxZIta/fssISeIXZHbS/nXft9
TLSH
T16922C8926E38A97B8CCBD21DBB25BF53D6F9503291901E58B6FC961C08E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 94440d28daf5b831f9bf848a28bc4700b64a9c3fefb332e3facb19f74d239545
MD5 88614ecaf00850c7bcdb2f55bca03ffa
SHA1 3e5ffdbcc22a7cf8b6e4dd874ae4e83fa9614b55
SHA512 b686509fc9617978161a4c3ae37f2da1cbd5e0d330fe5301dd695517e9f587f0ffa23d59853caf8394dd7bd0257cd12c3b9f249ad85ef42559f5fd0a58112872
SSDEEP 192:sxZqRcka/fsshYSedWIdpRl1HW6+WNIY/XY4TZFXf+uIg5C7J:sxZqta/fsshVedXZHbTXhXftwN
TLSH
T13E32C8526E38A97B9CCBE21DBB14BF53E6F5503291901E58B6FC961C09E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a766e6955c66586ce9158c6c671a4bc896a15cdb90d210fc43b86d0924026538
MD5 3ffd5d6dabf6db18a108c4fc7b3d8ee1
SHA1 46ac7c7eef6bd786c1bfd82e107eeb2f5c86a823
SHA512 6fef6b022e61ccc55c69cb9bc32f72bd32fe7e9e236a8692177bdd23597602b780680f3c952d5b07bc66d2195ae2932e320ee318d15a73a896fe9caae96bb3a1
SSDEEP 192:sxZqRc9a/fsshYSedWIdpjIWXxl1HW6+WNItaZY4mZFXf+uIg5C7J:sxZqAa/fsshVedXjBpHb/ZmXftwN
TLSH
T13E32D8926E38A97B8CCBE21DBB15BF53E6F5503291901E58B6FCD61C09E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6db3268c4452ebe7177dcbb5819a5000901cf5b3e273dd49372001f279efe9fe
MD5 e82ef802d78a8e12dc0f302a038f03ec
SHA1 949e3efb440dd1825a814c2a9592bd28a1078de2
SHA512 057528b6dcca01fd0b1a35c09a16a86ad7e2c637bca4db4d641049595978b7471aa68021722f488c5e6457e313f5f1c722a2486b3df863aeb6b1afb680b646e8
SSDEEP 768:mmqPALKWvWep58F1+UoAYDCx9Tuqh0VfUC9xbog/OVqqLlBHu7Rrouaoe:mmqPALKWvWep5u1jaHqLXO7qie
TLSH
T102C2E93B644CCB7E4FC00A9DEC5AAF972E9802C7A7584D4047FA954C02D77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ed3dce67be6ae6a319a3a99f215682279f3bfe1bb9d0277ae72006d9aed0afef
MD5 8169e9471fb569bf06e97d209727343e
SHA1 c0dd0948aa68368ddf4cb6885d31050010248555
SHA512 5ec781ac80e6ad8317223059ade0ad9d86076781de20310a918b8f4c35d9b56239b4f6fae269cbcc2186361464b26f205ca58629b6c0d5c795a70cca70566b6b
SSDEEP 48:KQTIFKkcwryNDIVKcEIby1NItK+QgenIpKJ:KQTqKkcO2DaKcEOWNmK+QRnKKJ
TLSH
T111A11682313A02473D7E280CA6E2A73759813177301DE6FF7B6A45A61A66F111DFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

094ea8a0-cce7-481b-bbd5-9b342a4d135a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\094ea8a0-cce7-481b-bbd5-9b342a4d135a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1497333d55c67ff1b68710ccbd287b092e23e5522ff95372cf38dfa862758f17
MD5 5c349c6b0f10ca3e9be6d7b2d0cac0a6
SHA1 5b4c22166fd6a0f4d0de42bf57b0594d77728753
SHA512 b43f49bcfe72ce4646f40546dacf5cd6376c35735b66bc271945881c18cbd7e7c9ac65de14d6a90c6f1f4d8868b795d3ad78c589206c92c095c14b4f32275d5d
SSDEEP 192:u/LsNc8UkJ5VQJf9vqRSjQmiU1y064hC4XqMB/1j6jzoyMFXtxMHbBqB0+U8:2sNc8UkZZwVBlVXq6MfKXqkU8
TLSH
T10C32FA72A838AC375DE6B689B44735135FB4552BDA883F90E6FC2B1C01DB29C431A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 79f45d9ce5213a1c417b512a26a714b700c560db911441646a31c3ada32f3ff5
MD5 9522e92e676297c7fee6baf9b036b453
SHA1 270de4ea81766339b7b2cc7115d6c7764110fb30
SHA512 3f60b23ed786399878f8f9743650662dbf1318b011fa52c9becac5a69ad74b924950a2526f9cf2abb7a457ec8db865d5fdfc346fa5d34230d145c48f3760f9fe
SSDEEP 384:D4iFiZcIJzsNc98TUNTUlIlk2ZwVtVO2VXq6MfKXlknTKwBODNZOCUKDW:XFQpXwgOOEplknewBKZOH5
TLSH
T1DCD22BF248D79836D9AEA747A73D2D024EBCD067F5846A50B79C6A1CCC961BFC30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 72e11738d45998f3f0a704fb97f0d43120cd60059f9143336d84ef95bda302db
MD5 8fa7dd4896873942e7b8775f0b9bf1d7
SHA1 8ed038f2388529c8e8b0acf8b8fb9bf5da9c8064
SHA512 426ad9bef3e96d6d0f140f2add325ba3fb86dc50882f9ba04a3b7659031d1dc9737d0da1967a42436428c9bf827d5db03c303d4cbec7d707f17ea885748aa1ca
SSDEEP 384:aZcIhsNc8Uk2ZwVBlVXq6MfKXqknTKwBODNZOCUKDW:YhQvpqknewBKZOH5
TLSH
T1CF926E715C38AC375DE6B649F44635034EF89567E6C83F94A6FD6B2C00EA698030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 884e75955472fb42fad0f738a497a68ddfe9ad480ff844ed2941919f59f6f6a2
MD5 5087f10a57d14567dea4e89c7244e682
SHA1 ca1b401fe1b7f9ae43b178f4832436fa5ad2e32e
SHA512 7697f366c0a7c4adfd53ec9fb6668b49f061f84edc8f26bd571533f525ce1fa46420a8d2f0bd8e72ab1545be67922e571381d87c36487cbf0c03ca50e6a3fa2d
SSDEEP 192:mON76rvoQmiUyHKBDrKhD4XqMB/1j6jzoyMPExv3U6:mON76cR+6Xq6Mft/U6
TLSH
T1D602F83568386C7B9EE7BE49B4863B135FA4202B9A946F84EBFC1A1C00D765C1306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d849de63d432dab53b006535237e7f98a55c124c603bd1b628f090ac9be6b1f
MD5 123c38163fe2cc114c89fdc96ea79428
SHA1 1e00b75fdc4734e84cb608b4c5624c36df062fee
SHA512 1de092d0cd12bb0ece7af06871205fbd693e4c7754d820fea832f61a76c1c0747e5c92892b90582fed2a4bd6fd1efaa3f529e3b38f0f3ba84fbeca45a5668388
SSDEEP 192:QONoi6rvnQmiUyoBDXhD4XqMB/1j6jzoyMFXtxCICBqB0+U6:QONoi6NxX6Xq6MfKXIkU6
TLSH
T1FE12EB32A868AC3B6DD7B685B48735035EA4511BDB897F90DAEC2B2C01DF65C430AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 39f7505087a87507e3f9934fe02d34fe6b53e6e9769b001bce10ac833115e41d
MD5 9c2edaaea8f7be1cb43bc60950a92305
SHA1 4117807316c5bb549759513352176373c2e6ccdf
SHA512 e0d73503088fc654d3bfcd7ad453d72e82e7c4c7129e10a157ada5b3f88bec154cdddf3bd21300cf0eb9078eff66f1b3f8bc7eaa081dcae7666b586abca06fcc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58f509.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f509.TMP
Size 392B
SHA256 5030268d9519524aed5837e2eba430d18efaf9769bff5fcb40f1e1d828735a9a
MD5 87845b2f4afaecd6e914bb267fd348a4
SHA1 8a6473c95641deefc5cb05d388ba2e8388e2d8fb
SHA512 2b856eb7f0ff3286d6231363130b4a30e0f362205e72f4581a2d5b71239a456d95e56076c727265ff42f435d7671a4135e7580e2381daed7ef589b84e7f3f199
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef687dad22689d7aaea0585665a5a40d2faa8e17bc62d6e3b634a772230291a1
MD5 bd17200e8d7d046675d70be2edfa1621
SHA1 536cf75e1e8c2b7f2a94a8690e2ed0f94d5d5850
SHA512 e1e0b394934d83ddd71badf6aa207c9cd47801eec5f875d95edf4d3592d31b9d9ec93916721b7ad76ce7d671c9a2129a19c4256f6ee434ac7edfdb51a3c88ed7
TLSH
T15D41175DA7F92148B3B76F4AABF7A86E487F79672E06C05E10110D4F0A62B40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download