hxxp://roblox[.]com

Analysis

user interaction
yes
max time kernel
59s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com
Sample260830-2sl6catwew

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326038620314255"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{8CE0737B-5F4A-40E9-BC4C-C4F67B2DC7B8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4292	3664	msedge.exe	84
PID 3664 wrote to memory of 4680	3664	msedge.exe	85
PID 3664 wrote to memory of 4972	3664	msedge.exe	86
PID 3664 wrote to memory of 4680	3664	msedge.exe	85
PID 3664 wrote to memory of 4680	3664	msedge.exe	85
PID 3664 wrote to memory of 2356	3664	msedge.exe	88
PID 3664 wrote to memory of 2356	3664	msedge.exe	88
PID 3664 wrote to memory of 4940	3664	msedge.exe	89
PID 3664 wrote to memory of 4244	3664	msedge.exe	90
PID 3664 wrote to memory of 4940	3664	msedge.exe	89
PID 3664 wrote to memory of 4940	3664	msedge.exe	89
PID 3664 wrote to memory of 4244	3664	msedge.exe	90
PID 3664 wrote to memory of 4244	3664	msedge.exe	90
PID 3664 wrote to memory of 1856	3664	msedge.exe	91
PID 3664 wrote to memory of 1856	3664	msedge.exe	91
PID 3664 wrote to memory of 1856	3664	msedge.exe	91
PID 3664 wrote to memory of 3280	3664	msedge.exe	92
PID 3664 wrote to memory of 3280	3664	msedge.exe	92
PID 3664 wrote to memory of 3280	3664	msedge.exe	92
PID 3664 wrote to memory of 1264	3664	msedge.exe	96
PID 3664 wrote to memory of 2788	3664	msedge.exe	97
PID 3664 wrote to memory of 1264	3664	msedge.exe	96
PID 3664 wrote to memory of 2788	3664	msedge.exe	97
PID 3664 wrote to memory of 5108	3664	msedge.exe	98
PID 3664 wrote to memory of 5108	3664	msedge.exe	98
PID 3664 wrote to memory of 5108	3664	msedge.exe	98
PID 3664 wrote to memory of 2192	3664	msedge.exe	100
PID 3664 wrote to memory of 4568	3664	msedge.exe	122
PID 3664 wrote to memory of 4568	3664	msedge.exe	122
PID 3664 wrote to memory of 4568	3664	msedge.exe	122
PID 3664 wrote to memory of 2652	3664	msedge.exe	125
PID 3664 wrote to memory of 1312	3664	msedge.exe	126
PID 3664 wrote to memory of 2964	3664	msedge.exe	127
PID 3664 wrote to memory of 2964	3664	msedge.exe	128
PID 3664 wrote to memory of 2964	3664	msedge.exe	128
PID 3664 wrote to memory of 2964	3664	msedge.exe	128
PID 3664 wrote to memory of 260	3664	msedge.exe	130
PID 3664 wrote to memory of 260	3664	msedge.exe	130
PID 3664 wrote to memory of 260	3664	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x2f0,0x7ffd397cc188,0x7ffd397cc194,0x7ffd397cc1a0
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9914555900329645282,10055646265281737903,262144 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,9049425765656935865,1863457982920970862,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,5876419108453714565,6367652208897265226,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,17666129102288416925,5571152320582577170,2097152 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3895601003381814641,64410183098992945,2097152 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1680,i,11161443166435116071,3878232867618728980,2097152 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,13166089428418862760,14340650133370004946,2097152 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,644862424521316119,4969105051482860420,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,7876879163666725591,17070086956909681254,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5208,i,16956624032655847208,13474335400533691277,2097152 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,12529229335869861440,4279432198917705992,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,12529229335869861440,4279432198917705992,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4368,i,1259839768559464416,15717537979989772037,2097152 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,2212401492015750048,18144971420231450921,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,6184858919119305411,2368861090954292810,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,14101978131506885651,18391291669312282305,524288 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7012,i,13119007827188819033,7068088313290358510,2097152 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7160,i,8678517701098176228,1260437901627960248,2097152 --field-trial-handle=2044,i,3172491782550269184,1840354454372547116,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5930ae6358d4329029ecf1c01ac4152c83289cc410a324c5967d8793bcbd8b2c
MD5 78ef85bc0686dc4ee6313bd7b43e9c11
SHA1 0986f6b281a43d715a08c757b46333f0119f98ec
SHA512 dd103e629aaa3e1a7a38e2661161ef80006a3b80f040b0e27bf0cbb173c6c01e3fd042d6d37c0621038ebff4144939a9a86de2593eca6adf16a638f3ca2f8fba
TLSH
T1A0B09269A4616CAE074A83A41428A453C3BA104642188AAAAA3872AD42A21AD4828847
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 f6884ace7a3f56f42140c65921c91c71123856c3153f7aa06bab39b7b3308f18
MD5 5a658a5f12d1d55780d7010f7aa34efc
SHA1 3180afb2772ab8119f061fd37525f3816ef65a63
SHA512 042f5132445a2fdc8b4523b847f3c5d5578c5dd745c7f8ec5bc9e1e8231114c746cfd77bc29460ada214fb045dc8d8fe38243dd7f9cbb70b154eb8ae8c08fde9
TLSH
T1B5D02223620270F5A67C3FC6A06AACCFCF6620780903DDD854D0EAD809394AC0E07788
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe595058.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe595058.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d92891d8b939506617e0a48d3136f08a1db9b490e2127de96a8801582a33ee5a
MD5 aeb116dd4190b4a478171ec1e50c0589
SHA1 24493b400d40c90f98fae7b53d1cef9798f8160e
SHA512 1ca46cd0eedfae22e446340f42e9b4db7c8e5eab34508600473786537ce74880c1b8baf79214b1b3ebf1fd171945adcb25bb90134f5bfe16a58b6abcf30a7d79
SSDEEP 192:sxZf+RWyM/jK1Ml8MkR1/fcsG8nmJdHIdpmZHW6+WNy43/Y9IcqRoTwIgrJ:sxZGUM//fcsG6m8iHb9/WTM9
TLSH
T1FD52E8126A34A977CCDBD209FA55BF53D6F5447292900E48AAFCD91C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6f7857904c6564725f321c9b283689b0c736e73f245b14376c73bcbcf12b64df
MD5 65bcc99952efcba12c5be26840bc811c
SHA1 4ad6033223cec367fab1de25062e8a013f6e177e
SHA512 132dac139d295e63efa9313588f8c573e21f8600c0005ca02a7a4b3ecc5aac7d80c6343df6d4a81b5fdbd289f9db5ba3c1d59cc6bbe54b55b67e4a1ab990b36c
SSDEEP 192:sxZf+RWyM/jK1Ml8MkR1/fcsh8nmJdHIdpmZHW6+WNy43/Y9IcqRoTwIg59J:sxZGkM//fcsh6m8iHb9/WTM9
TLSH
T1DF52E8126A34A977CCDBD209FA45BF53D6F5447292940E48AAFCD91C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 fc6bc58dae50ed95ee60ac9b25fa05dd29669b89f7a5112b16509dc6e0240c19
MD5 9aca4a20bebe9ae01773597da4b1dbeb
SHA1 eac9ac3f29554d034340feb641a071e0c95366dd
SHA512 70d096cff320f2004eb7e30e2fce5355f675e2d796d4ed9fe987a760ddc98670b93e9b3a710a215626c9f39cdbaa0cab116c8ce258bd60ed063128fabf14840a
SSDEEP 384:sxZGksmz//fcsh6nLHbHbHgg/1TMqHP3PQ:se9mz//fUnvHbj1pPY
TLSH
T12C82B652692499B7CCD7D609F931BF53D6F544628A910E8C6AFCC91C00EAAFD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ea0ad6788b80d00aad187ce8915b0066ad3fed84e8282be64bd70bcb355483f1
MD5 e7ada692f050ec859ef9b82af522d575
SHA1 0b4f53fd90f5a115032c6da57177f3f41f306d96
SHA512 8ffa1b241d9d1d31d9c0821dfc7facda4d32893d249c39d873a27196e42fd2076896d7c55d2ac0ebf0298e7134c1013ac89541b9b1fe2a39416cbe1cd952370d
SSDEEP 768:b0cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNUroeg6N:b0cv21wWvu+Z+u1jaeFLeRN/ed
TLSH
T150D21B2B280CCB7E4F841E9CED2A6F866ED801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8022524-60c5-4fe5-9162-aa67fcc6eaf0\index-dir\the-real-index
Size 504B
SHA256 c61a6d88615bcff2ed5086fc3b59e9dcd1c32aba148fbe30310239b1e07db5de
MD5 944d10959c31f7476bb327d2887e14c5
SHA1 ba29b32228997952b51b4cebdedd915f58eb47c1
SHA512 5d377e46331b6ce9702bc2fd640df9091da205ed32c6fff014026a2f8cf49215c83d15505d61be6c965d834d5ade3d047e9493f83b9bccd51fc0bc8b9d898f0e
TLSH
T18FF068254E810D2AE96006BB26F69968A27159ECA334E867582C556ABD2438831661DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fecd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8022524-60c5-4fe5-9162-aa67fcc6eaf0\index-dir\the-real-index~RFe58fecd.TMP
Size 504B
SHA256 c967ed2345f187e4faf2eb6aefe8dedb2a0084d709f27a77acb1514f17a96643
MD5 0a9b5b930c156880c149d0ac3a4e7797
SHA1 e28e6d6302ca3773624615ac484c3e74c462f8de
SHA512 96b694158d6f35d5171cad4a2ffa44548c5a5aed75f41d7987b81fe656a556e875871eff5854c7ec8246ad1c7ed976ccec3ee8b8182a738fbbddbf0961183ace
TLSH
T14DF0C0558BC10D02E49001BF3EF698ADE2714C40D261F6A3342CA56EAC35AC81A160CC
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 525f9c65d8b4222ffd58cc985b93b6d2737f4c5c8292f9f334c3ebb4cf20c1d1
MD5 09fa87dee1f02c52e688d8b0ff8e2a7b
SHA1 10257c0c0ff89529a122a844df5173debb06bb06
SHA512 f978429b1788aa85209f42c5d4fe3c011f6a2ddfef6da6c8d0e663b360b0350e2562312ac4cc67c5ead6565c02c83bba26e91b7a1ca108d7cbf405e9a76bd052
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+1eKe0CeP6KYMg:mTJlRT
TLSH
T1F2914E01707B06522C7F684CA7A2953A8E8631A37418F9AF7BBC00A14E6BE151DFE4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a193e58f-d7e8-4222-8ec7-dc533a3c16bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a193e58f-d7e8-4222-8ec7-dc533a3c16bf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48a4bed175fedd626f223af0de47c050bb00e18fcd831f8424a1612edff32374
MD5 7299f5cc46482a58af4d02d24b79d67d
SHA1 42993907dc1a7199659796618bba0964256ee25b
SHA512 428f431310903100038053d5a9ca067c86a55ed8c936cb6bb8029b5af24f44303af8a4735c6b82ec7f8181a3c0005ba7210d3d19018fecdfa561a03048f9ca2c
SSDEEP 192:JONr6v+YLNQmiUynCZh+CGN+FdeX9oEusliU6:JONr6vz/TZh+CTdIe6AU6
TLSH
T1B302E935AD782CBB9FF26E45F48736135FA82177EA912F84D9E82F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fb5ef14f19954cd0f7deb34fab642ff976a91197f26f0d9c24e8847ef6249418
MD5 38b5643b237c7ec6d281f9ffde739566
SHA1 994efd2fe7e8a8a36d168587145201ac6f497f5f
SHA512 0c8d6a6a06d0bdc72839133ce9121869c2ad004ddff910594803388b0cea8b656f8131e64ca8f68525581e970ef1bc85ae2c213310a543aff62cf486e85f3e4a
SSDEEP 384:QZcIhsNlfTj+3ziR/d2e+CTdIe9JrrlHNv+/ZOOIM:uhfydBrV9hrltv+xO+
TLSH
T10D826C315CB45C779DE6A646F4873513CEB89177E7CA2E80D0ECEB1D01DA6A8230B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2ef1fd6d91c87e90f83b3d2b2e723edc52f7c8310b521b4cc5bd1e1770613ae3
MD5 badc21400586635c8f61d51bca0dcd5d
SHA1 b11285636d619955635b2eb9d270b6dcc204326d
SHA512 21d447d4b384226065c75f8520d6d1b787c153151d4ae6216cbb4050c44d59b7df788b41157e64315f4b2cbbfda44d064823a5a40f84d90275f802360e5593bb
SSDEEP 384:qZcIhsNlGA+3ziHDMe+CTdIe9JrrlHNv+/ZOOIM:Ih9inrV9hrltv+xO+
TLSH
T104826C315CB45C779DE6A646F4873513CEBC9177E7CA2E80D0EDEB0D01DA6A8230A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8deaac9809186fdabfa5324fd2b97d843be96e6a8d45f17f24cd860e0edfb5c1
MD5 50b22e7e3813bd7b045fa8fe98bd48bb
SHA1 3590a1a5cdec7068da9a3cfa3ef08ef4c5234f16
SHA512 e6e545ec0ab5b4d182cd6d3b624930bc60f52bb67f22144f70e27710c2f09e05641066c019ddd0617ab665c0f7dbb31bb9ab51d595b4bbaad6225817f42bfeef
SSDEEP 192:/ONo6v+YLuQmiUyrCch+CGN+FdeX9oIHSJrZx5CHeq5U6:/ONo6vz+9ch+CTdIe9JrilU6
TLSH
T113121C35AC786C6B5ED36541F48735139EA89267EF863F80D5EC6E1C01DF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 45818cae76532a11237d7b56ccc485e3f89f15984369e5659108be23eff30d22
MD5 8dffd6b2293c109ef3a93283b9917b87
SHA1 e0edfbec97e5d13f6205ded9222d7946957a893f
SHA512 640f8be8e17839e26614f5f93e25ac5ac9236ee9c195cb46b8ddc741f403bd1ff32bbbc5eff3eef6b7a72ee4eeb9600623a22fd489e40cf064aa755af904fb26
TLSH
T122E004055100007DD07C433000475530DFD5403431F5014C551101C54C133101731FDC
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe591841.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591841.TMP
Size 392B
SHA256 9a6a3d597d3e0532ff2e481778e4bbecc41d155d2d5adbc07b63ae6ff7de945c
MD5 f247be0b6089673a5074791516401aca
SHA1 9672c814939a732877d1d99de5f28fcaae37fac5
SHA512 f5ef81ef8bff21148b9e8fa1b49475d0f5293cbc3030a3a1b593ae80dc330baf287c21de98a4a41433f3a8db19516fd7280455302c2097679d9031f278620912
TLSH
T1BAE004045000003DD074433000475530DFD4401431F5014C511101C54C1131013117DC
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 61c320093f74897e0cb605fa1fcd0730f063633a5c44338aef04f09fe6e0737f
MD5 f6b632982c6165eda00ffcbd4590dbb6
SHA1 6373cabe38e75bb13629cb26682594ff9bfc2dac
SHA512 a24ecbdf34e99778ac686cf62e88616d1e05e15fb58aa380bd218e09461b7f2d0e905124918ffab67aefa737802ce34e741c5da80e87517dba40abd0fde22a78
TLSH
T1DE411A58B7EA1108B3B76F569BF7A8AD587FBC772E06D56D00010D4E0B63A40D8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads