hxxps://connections[.]roblox[.]com/share?v=v2&code=5n70mep0rvk5gq

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://connections.roblox.com/share?v=v2&code=5n70mep0rvk5gq
Sample260819-ense8sch53

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2080	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315859488076343"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{14A0F391-0F9A-4AAE-A195-0DDC25A767C5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 3720	3468	msedge.exe	86
PID 3468 wrote to memory of 2080	3468	msedge.exe	88
PID 3468 wrote to memory of 636	3468	msedge.exe	89
PID 3468 wrote to memory of 636	3468	msedge.exe	89
PID 3468 wrote to memory of 636	3468	msedge.exe	89
PID 3468 wrote to memory of 3628	3468	msedge.exe	90
PID 3468 wrote to memory of 3628	3468	msedge.exe	90
PID 3468 wrote to memory of 1656	3468	msedge.exe	91
PID 3468 wrote to memory of 1656	3468	msedge.exe	91
PID 3468 wrote to memory of 1656	3468	msedge.exe	91
PID 3468 wrote to memory of 1572	3468	msedge.exe	92
PID 3468 wrote to memory of 1572	3468	msedge.exe	92
PID 3468 wrote to memory of 1572	3468	msedge.exe	92
PID 3468 wrote to memory of 2300	3468	msedge.exe	93
PID 3468 wrote to memory of 2300	3468	msedge.exe	93
PID 3468 wrote to memory of 2784	3468	msedge.exe	94
PID 3468 wrote to memory of 2300	3468	msedge.exe	93
PID 3468 wrote to memory of 2784	3468	msedge.exe	94
PID 3468 wrote to memory of 2784	3468	msedge.exe	94
PID 3468 wrote to memory of 4292	3468	msedge.exe	98
PID 3468 wrote to memory of 4292	3468	msedge.exe	98
PID 3468 wrote to memory of 4292	3468	msedge.exe	98
PID 3468 wrote to memory of 2492	3468	msedge.exe	99
PID 3468 wrote to memory of 3384	3468	msedge.exe	100
PID 3468 wrote to memory of 2492	3468	msedge.exe	99
PID 3468 wrote to memory of 3384	3468	msedge.exe	100
PID 3468 wrote to memory of 1424	3468	msedge.exe	102
PID 3468 wrote to memory of 1984	3468	msedge.exe	111
PID 3468 wrote to memory of 3568	3468	msedge.exe	112
PID 3468 wrote to memory of 2756	3468	msedge.exe	113
PID 3468 wrote to memory of 4088	3468	msedge.exe	115
PID 3468 wrote to memory of 4088	3468	msedge.exe	115
PID 3468 wrote to memory of 2712	3468	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://connections.roblox.com/share?v=v2&code=5n70mep0rvk5gq
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2d4,0x7ff9e8d6c188,0x7ff9e8d6c194,0x7ff9e8d6c1a0
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,11984478920054811814,13785061777225743883,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8730840939944361565,14260312618186037363,262144 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,9504452543129513226,3406771125912222868,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8167502925748077065,778575212131698507,2097152 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,13601981923244744891,6504831199401436085,2097152 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,336364237003133211,10047845958885654214,2097152 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,4419608388865183248,12281725499101307649,2097152 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3600,i,16449465900494363773,12130676743269063830,2097152 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,15152352338394159695,5198462457422580849,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,8108212385122219571,1803782591891324366,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4698759305796500437,1181269366992399588,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4698759305796500437,1181269366992399588,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,4668570222249547033,9125781328156629681,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,8993066762471912580,17705690903899876375,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,12887852841539790469,2034869160179026402,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,15647620426248714310,2749905454455455754,524288 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3712,i,16028287598894669519,9474591520687233339,262144 --field-trial-handle=2316,i,6950257776607344565,7604015639795135005,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 12a54fb9fce9d1a3bc795eb71559ea66e51073c9147aae226d6d167699021c49
MD5 818d0ab51e1782325ac82231cf59f0c0
SHA1 989c582f12e4ec579deb05cde594b1ab47f9dee2
SHA512 e66e1b6ba49001e2ce401c041991821c2d60b12f1319b1ef3864aae88106700f1f1a8354746558bf1fb815c72fb131f79c3ee4236c5277993b4e340da22537d9
SSDEEP 96:xfkDyn3MTRxwJTw/jBjFeaglfeVZ/9S3sbYRO36:98TRUU/jBsqi3sVK
TLSH
T173E1E948C3E2148CCB4A29B9DDAA1D0976F766C65F860F0BBE345DBCD1433F248D16A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bb4c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb4c.TMP
Size 3KB
SHA256 860ac034efc9ff80993989e9acd65a9ae885d36a3cdb8c6b3e79e2828e8e0b2c
MD5 2c90f3216b1aa28973ef1ff060515f4f
SHA1 97498a6431136c64f8db9ff96c83c35bddbea5dd
SHA512 763e9057f3f16bc911e42eee6018ad0ac9fb4bdf5273172b663a9727e46bf5001b87a86f7d3d1486cae3fdcc86921e9bd16e90c74bdf5bb82f4ea60ea489b51e
TLSH
T17D711A580A96099DD3503230EDEE1F5A71318BC41F5B8E023F7488BCA5257F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 384f315e961a628557ff20fb4ba2c719cc41466cfbeb49d3650b7b4b08ac9769
MD5 23bd9cc9fa8b75728a3fe5ce68d3601d
SHA1 0a6f9b3b231aa460120931e558aeb49d39b391e8
SHA512 c17d21f2f760dc9ca3a0897fc897f432ee8ae994fd245af7871a44ec693ba74cdb745d6a4b8a2f40653561c8095a1746868c5fdb0b6596bda4a613d98d992f95
SSDEEP 96:DROGK/W9J1+la6iszu5QHZGm/a+eHxMfHxBdqsZHu9hf0QTwxV:DEGK/W9J1+lvisy5QHZGAa/HxgHnd/Zt
TLSH
T1AAC189F783E5C62D991656F09A08AD17CE5D0920431C7C7AC9E4BE5B93E31B1E201BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 10580ab1385b0fe205638aa58a565f152d99a0b44d47a56aadd1f92b228989b4
MD5 ca27b4236f91d784174b3b61e2599fc6
SHA1 d7840860d95d58a8264a03b2165c00ab581db226
SHA512 74a75bb053a0eedec6dc6d6730c11212bdc55e4d9766a59b55efb06ed71ddd153106562866654bc7893d9355b02037719897bb11d47b4a5bb6cd60b665d0548f
SSDEEP 192:sxZJRbyM/jK1Ml8Mk4/frso2I7TIdpeK1HW6+WNysC/YL5K5oIgrJ:sxZJJM4/frsotMHHb8/e9
TLSH
T14052E8116B34A977CCDBD209FA45BB53D6F9447292900E88AAFCD91C04E7AED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ed42143fe6a59e7a274babdb387e1a00a69fa1a6ae498a0cbc55e99abc57ef69
MD5 193e993199424d67b19faf49a62d8d2d
SHA1 9d19eb5f54083bac3079f7fcbd8f33fd1cc44a4d
SHA512 ded129bd5b056cc29ff03496f2172c3a0a6f9b0a902d38c2f18ecf5a5b2cb316fe21ee0f7846634e47b3944ba6819552a3622ac6fe19cf727c208e2082456063
SSDEEP 192:sxZJRbyM/jK1Ml8UQ9k4/frsB287TIdpsK1HW6+WNysC/YLnR5/oIg52J:sxZJJqW4/frsBpMNHb8/vk
TLSH
T15352E9116B345977CCDBD209F941BB53E6F5447292600E84AAFCDA1C04E7BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bae9335470eb18a11a972f9504edb7a76cc17eba6d56123029e333a374b8689d
MD5 cb6c44c10e52b6952a2a542e26acfe84
SHA1 f38a6997a3609fd7d8672da95f89d6e13be49d4d
SHA512 7095c306b67aad257d9fc5067d8adeeaf969a77c8c27ed20410190508cbe4812cba475e1898604898823391be89371d100f65722af41b2599a86d4127e702f1f
SSDEEP 768:WQs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNBro3h:WQs6pD1WvxzUju1jahILIsN63h
TLSH
T19AE2EB3B680CC77E4F841E5CAC2AAE967DD801CBAB548D9447FA484C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0a03d7132f867c5cb4fd5f15c4542ff0874b43e1fb4406525ae76ac4b6098fe1
MD5 24194043a33ec8a045c0410e44f29d41
SHA1 8cdaf7b7827f0306dd4f9786f154c34616137ab1
SHA512 2dcb384ec0158357dcad401856394c90bcd9b1ffd0906840a968e123db547933a97cf50b6557e376d804ac4a59cd244d2a9b81d069ebc682bf84770cc2b957d4
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD638DIMD:iiRlHWr3N
TLSH
T174E1280231BF0A123D7E6B189255877B4B92B563301DA42B7BE940714E6AE380DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5938d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5938d9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 71695e296f5bcafcbf747b180df9cee5d434a9fd037de7c7cd96286161279471
MD5 0ab6187031c1e785010171fd6b860b51
SHA1 56e38cce5099e2a7a1e67727d8371f3ed25de9b0
SHA512 4b6a0c253a4c64d6c6c2b9d80511e03b50997672096b309b19d3e407d84a90f87f6b890c1f1a0c657ba9e93d9c63522878fb7d06a202f3b270baa6b752029040
SSDEEP 384:PiFiZcIhsNh8TUNTUlIlXis0g4a9xOsHeuHQiYcewPBux:aFQhowgnhrOqeuHNYclBux
TLSH
T15EC229F219E78876D9AE9743B77D2D138E7CC0A3B5916A80B798590DCC971BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 42612ea339e8e7220d77be6d598341a7944cb493f8c0c04a67257af7ad8c3703
MD5 c41f8d08ac312e9609e0f0b783f5da83
SHA1 c8f6ef34ea699dc510510992690827ee2cb07eaf
SHA512 cdfbae29eea26810d63ac9573615b3188d7109e10a5fa291e95a2a78a05b34c2f47dae6dec7bb2f46f45917b7a54fc5e83431b41a470d17ccf58fc2ef9bc2a5a
SSDEEP 192:qONQ6O7+3hQmiUyrEGttb0sO2b/WgGlrU6:qONQ61rGt9xOsIxU6
TLSH
T10302F93579382CB78EF2AD45F68727279FA5103BE9962F40DAE81E0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8c904c61e36c058759db070b0318e5fc8f15af68d963121164a6f3b0e095fc8a
MD5 5e96b6a44bf9f2bce74e7e0d95f4aab1
SHA1 97f6b5bbf07dab1e495baf63d3c384058257eb9a
SHA512 3bc288db04042bdca86697f3baac50a4da8dc48e350eda9ec8f5adefe96dbc63729f83769dc81c8d8d2206e7ad97134e9803d72d293deef7218ae5e43965b62c
SSDEEP 384:zZcIhsN/uis0z4a9xOsHevHQiYcewPBux:rhUhrOqevHNYclBux
TLSH
T1F1826D716D789C775DE3E245F98622178FB980B7E6D52FC494ECAF1D00DB2A8130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 907112ddf8418f68edd33bafda57823b160a5c40759394f5abd37b598ed0999c
MD5 5d1fbea621704017fa20fcf7b528d43b
SHA1 b2bbf833d02260f8e476aaa6a6dccd98369cc4b0
SHA512 cf20d47f0634e2b6e9438f164f5a571de3797027c1f19930a907c2a3f1821fed5ca6c2555f784b231b14738577086f62ef49a5d47c718301d21a8860ccee6fe1
SSDEEP 384:JZcIhsN/Xis0z4a9xOsHevHQiYcewPBux:BhrhrOqevHNYclBux
TLSH
T1E2826D717D78AC775DE2E245F98622178FB980B7E6D52FC494ECAF1D00DB2A8130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e7cc085bbe8372e05c89397b9aedb56a9630ee6888200ebbc541e81829a821a
MD5 a657258709cb0372565f584e273e1bf8
SHA1 162d4e177874f1c352acba398645bc19cc4aeb72
SHA512 1ca1e3ec4d34185096fbce06cd0c239e8357ee92abf0df9cb08f0c4026ff7d0497ac50673d7c31907256a094baf29351aad14f6e6f5d8f58ed25c47df73f84a8
SSDEEP 192:YONK6O7+3QQmiUyyEIttb0sO2b/H5E3cN+qwaU6:YONK6qkIt9xOsHekHU6
TLSH
T18C122A3678786C774EE2A545F98736138F75412BE98A2F80D5EC2E1C00DF6AC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 41ad61abfed1a8e152b7e5dd00db3cc2ad132653bd167ff7da1650de9ba529ea
MD5 850bb0480ff631ab95fc19c6d3ccb8dc
SHA1 805df871e8040711896d2f86caeb51de98074acd
SHA512 adaaf826335ed8077f6a9fbbd37e3400e3d0ea15819196a87bdb3eb2a6d5bc6cf80d8b664a6df7222d30a2b428d57c33b42b96b4b17c6de8d1678ee128a0ecb7
TLSH
T13A41D499B6F91148B3B76F5AABF6686D487FBC772E06D45D00110E4E0A32B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download