hxxps://www[.]roblox[.]com[.]bi/users/857039033623/profile

Analysis

user interaction
yes
max time kernel
68s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.roblox.com.bi/users/857039033623/profile
Sample260916-bac7lsvbje

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134339937805095071"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{969BF15E-517C-4F00-8C8A-9114181F8E37}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1528	4528	msedge.exe	83
PID 4528 wrote to memory of 3732	4528	msedge.exe	84
PID 4528 wrote to memory of 2020	4528	msedge.exe	85
PID 4528 wrote to memory of 2020	4528	msedge.exe	85
PID 4528 wrote to memory of 2020	4528	msedge.exe	85
PID 4528 wrote to memory of 1616	4528	msedge.exe	86
PID 4528 wrote to memory of 1616	4528	msedge.exe	86
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 5068	4528	msedge.exe	88
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 5068	4528	msedge.exe	88
PID 4528 wrote to memory of 5068	4528	msedge.exe	88
PID 4528 wrote to memory of 5104	4528	msedge.exe	91
PID 4528 wrote to memory of 5104	4528	msedge.exe	91
PID 4528 wrote to memory of 5104	4528	msedge.exe	91
PID 4528 wrote to memory of 4384	4528	msedge.exe	90
PID 4528 wrote to memory of 4384	4528	msedge.exe	90
PID 4528 wrote to memory of 4384	4528	msedge.exe	90
PID 4528 wrote to memory of 940	4528	msedge.exe	95
PID 4528 wrote to memory of 940	4528	msedge.exe	95
PID 4528 wrote to memory of 1916	4528	msedge.exe	96
PID 4528 wrote to memory of 1916	4528	msedge.exe	96
PID 4528 wrote to memory of 1512	4528	msedge.exe	101
PID 4528 wrote to memory of 2252	4528	msedge.exe	107
PID 4528 wrote to memory of 824	4528	msedge.exe	108
PID 4528 wrote to memory of 2748	4528	msedge.exe	109
PID 4528 wrote to memory of 3644	4528	msedge.exe	110
PID 4528 wrote to memory of 3644	4528	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.roblox.com.bi/users/857039033623/profile
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff8589cc188,0x7ff8589cc194,0x7ff8589cc1a0
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,8049267388811701329,9503103087387986448,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,9543344581131883132,12289241943459870660,262144 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,10571123575998508516,9884009830910479534,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,7077845210379631800,1949465370337980182,2097152 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,11995233244185575038,14968924811280468892,2097152 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,9347760406888639486,16504242102809549052,2097152 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,1897896580078239511,14626025255461813699,2097152 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4188328234926647744,11538459765247726083,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,12464069231595138078,4270755430865617688,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,18313746545635110666,16849797466734422817,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,18313746545635110666,16849797466734422817,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,6835125957020840976,9495843363536013719,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,244146628730676593,13784662803536760068,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,12079331783742558307,3694501404237182444,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16683894346032046993,12567702006749816963,524288 --field-trial-handle=2324,i,7908519139722750520,714389177793582797,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 104KB
SHA256 c9aaaec5c3456da36e665a05db2053aa14f984cd64aa61a95fec52bc2c19529b
MD5 a433e31cd25b9d66740a4606879c362c
SHA1 4a25291ce58cc1b58d29800b845a1de62692d52c
SHA512 2c263e7d9df810d2997830fd825f612974a4da8418979a99657c49c8ec9a9335220ac60667f36df823c041c1610f29ea2fd26195af0f37145ed439b6c5c4cd75
SSDEEP 3072:/LPSfAJ81LbaPgkIioygqlgVeiKXRcUtTLyK:jqT2P9oKl6KXmU1n
TLSH
T12BA3129BBA3564E7E02F89B35FBD098070AD03D1CA963257B1C21956B2C8F66F032F45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 218b7dc867df6b37dec4a06a08112a5a65a24ea00cbe46e52caff779be68349c
MD5 a781660993e7b1e2ce824fba71623d22
SHA1 ff9002e3d86dfe6f72bdb1061a1c257c8df77179
SHA512 fbc2efa8b4b2d150b052f1279cde3e2e47b6ae30011655d5514bd759c45cf2e386fcf57efddf48b83663cd0f64060058db8f10ee428ff7fe1f280e2f4ed2f00c
SSDEEP 96:/RmlCOK3fIKRq7uw72EdNMWXfVfLQiOI4YuxkgCm4FWLmFhRe843AEIu876:W+vLUqwTLfV8VS4LmFfe8ZQ
TLSH
T174E15FE358C81890FFD57AF472A5AEEB25AD604C0AEE9B5B31F5D42858473D8D304F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593eb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593eb5.TMP
Size 3KB
SHA256 1fcd20eb786b3cadfc712c129a99cd4baa4f709b672518cee612b8ca7d7d678c
MD5 82682332980d9c697a8f0b9c3dbd9ee1
SHA1 3871ba5f32aa92e1bcb15c66a5c9acfd354d7a0a
SHA512 c1ac8620a78764a869aef41fb1c72b4e921090c57a8bffcd2debc7e3d14fe1f0f0776fa9e1d5192871ecad29c015489e1b2b0eced3367f8f879d5ac6fe3aae0c
TLSH
T1C361EB806C408E64FF965F78A3F622FF35B6F0815AF3AD9E31B8C479A466759920434C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d2c9f3887e2a2c3ddc3fd2d0877ede1cba619fa4d6d7d87cb0d9707d35448356
MD5 0e74d99208391792ba17d466981d2e84
SHA1 135ccf0cc9707ee300363cd424adb5ebb6e97b7b
SHA512 b03dbe8260094ec091ecfe7fc9e1fa5d89a7329a7d3baab8cfa4b5253a803501ed7fc06f6550ff0f510558f37d3b676fbd14df6abeca9d7a13173b20f805433d
SSDEEP 192:sxZpRuWQ/fJsC4Idp/0HW6+WNZh+/Y36vrFIgrJ:sxZprQ/fJsCJ8Hb2/X19
TLSH
T16F22C6526E38A97B4CC7D20DBA65BF13E6F9507265D01E58EAFC961C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bc3eb9aec4356ffa0e61101ed5bc6a6665dd13fd06bf294d7169290397c0cda0
MD5 53a0cbd39895cd88f478facc0db33872
SHA1 5dd554bb156fb1b5e1b35f17812f4573ae94a060
SHA512 ce7b781805d1897222db9aa69e41868fb8119d0d8d6af86ef329ed363a963a0b0e1406e31cf7f991f24e4a8b049123fb4daa9a2a9610a1142fbeb7f18d643b27
SSDEEP 192:sxZpRuWQ/fJsY4Idp/0HW6+WNZdaXY36OrFIg5uJ:sxZprQ/fJsYJ8Hb+XXIY
TLSH
T16622C6526E38A97B8CCBD20DBE55BF13E6F9507265D01E58EAFC961C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5de94948052726f3edee32ecf0bb43b440e5f3eb1f5ea329f624f8575e20443c
MD5 bff2500c9a070bf859583f75e987a62d
SHA1 d1f9149b92fefdb0ffac2e2e0be5a99a8e8143b2
SHA512 05f063c854b3bbbca8afd69e101b1bbab4992f1db4822a7d3015d70116d5866ce2ea5c50bd975786f4b4902f81c0eec161890b26278bce8d6683a55632021718
SSDEEP 192:sxZpRFWQ/fJs54Idp/0HW6+WNZ8yZY364rFIg5EJ:sxZp+Q/fJs5J8HbZZXyC
TLSH
T12622E7526E38A97B8CC7D20DBA54BF13E6F9507265911E48EAFC961C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4465fdb888dbb0855942df425f41f225a066ff0bf678ae62314c1d8bcbb7bb68
MD5 3f4ae569162215b3c47601c804451bdf
SHA1 7c28cc7f6fc1fa312174b840ff65c503dd5d9672
SHA512 a373d6d03011239919821c19b02ae9e227ff8e4225d0ba599e6536a460eb6e4aa8ab0bb2abe5102162ccebaeb017f4eb0f174f4b8c8e568b0374ccda60950b74
SSDEEP 192:sxZ4RFWQ/fJs5rIdp5/HW6+WNZQ/pY36FrFIg5EJ:sxZ4+Q/fJs50xHbWpXTC
TLSH
T13922F8526E38A97B8CC7E60DBA55BF13E6F9507256901E48EBFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e62aa6747c2014a5a5816c3f2b965f3cfb4b2b51625e352fff1b0b586e1747e6
MD5 635ae8f04039e831c4c7a36e48a4c23e
SHA1 f24645d4ce7695fc35dc32f0b4406be5ab137896
SHA512 73d1655ed58ce23507c1c31def4b21f74a235b844e27f4a6230ee997096a002dd6a06b2d5788b847dbfd00bb5edbdc04d2c175759f71fcdbd6f0ccb5b63d1d9b
SSDEEP 768:R9Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/aroCr:R9Klm7QWvUYe0u1ja8/L/E/RCr
TLSH
T106C2FA3B640CCB7E4FC05E9DDC5A6F976EA802C7A6588D4087FA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 a2f262ebbe4339c8e53f81e3dc4a8517f3609aa0f4f2239c3af0fd7e62ba9873
MD5 7ff766dd207694e5e7a382c5e82e5794
SHA1 cfbdb9f12489c79e45c2fa55f0ca22e6f5d829ae
SHA512 d8c7426b07f795c1c77060013058a70cb12d5d5894c843bb0b8f46139aaf4d8efedc5b8ca920e63e213ae0af28f5009d3116bef24c1db794d7889f255b72d3b9
TLSH
T1F2213A61B9BA02003CBD260C81588F6B47513167321CE76A7AE89076CBA6F8D59FDCC9
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b5ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b5ba.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 c5166aec73a7418cdc114e17e2b0663ef7efd8b4eff8f5a888c528b52d5cb78b
MD5 7817bd5c99ba184787f087611747bdb6
SHA1 9b01b2c13c4079c5be1fc78d2292b7f953dfba64
SHA512 ef2a95e49b8b38ba06cccbd266b776165338a1ecb281ba87ed111d7f73f2156cec49cc38986205286202eebb211dc73757e38ba842c3b2a1733a751c0ab194cc
SSDEEP 384:WiFiZcI3AsNa8TUNTUlIlOTIIbt/Gh//PepNq+E/7O6R2Feo1SKoR:9FQQ3wgWI6W/eUz/7TRvKS
TLSH
T1F0A27E725CA4D87EADF7DA55F98636139EF480E7CAC5AA50E6CCAB1E00DB19C1307C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b5a4e517c048ea228ba599cd7c6946b86e53e55f22276a6ce8ffdc632575e35a
MD5 1a2aca41b564ca8f661f2c7aaaa32517
SHA1 f98f1ee3fe69af94b1878de1b6fd186f27b097e9
SHA512 ce13834b468bda6a38737479a2cad5510573437f5e30fa38f468a4905fcdb1f037a6c970a78bc0dccf9a895ffb33701d9d19f6c1fddaf3b36111efa8ad68b46d
SSDEEP 384:8ZcI1sNCzTIIbUdGh//PeL+E/7O6R2Feo1SKoR:q1pIhW/Kz/7TRvKS
TLSH
T100828D716C78AC7A6DF7D555B88736135EF880A79BC92E80D5DCBB2E00DB5981307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 00a8bd866626877c5ab40d65281932053b0f22b83af3dad80fa89427c4d3ae3f
MD5 d40364e764d0283014d90d37251fc172
SHA1 749dc9884eeadceaa077913fb5384ae060e56053
SHA512 57df3a572bf1a8d82b9e760821d5b88d01b9bc1fc36ff66e1d3d8581d0bd5f2ffa660edacd762367ce1b6e39aaf8bc3e508acd1aefe36f5eaabc50b9322894d3
SSDEEP 96:KqONkPQsjpfbUmjH5ih/cIPURHl8h4otop5XaD/BKP4v+Y1xf//ojdexBywvBC9q:BONX6JUm0QmiUyMJso//3ywvBCp/VSU6
TLSH
T1F002E938BC687CBB9EF3AE45B48777235FA4106BAA952F80DAD81E1D01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7102c9b455b15f6778e3bdf80cf5ac6868ae16ea57b9e5d00ae0b263a13cc512
MD5 9237f3d7db541455c187b0443b049e31
SHA1 aad87034294ab73061e014e001bd378df13f6355
SHA512 23a5af728fca4d72f9f8af4e0b977ee4b523dcf784b84d7deeccbf35193c0010e2f57d350393267be2e4c0f314b9a7b5d14ae07a9d5dc03c90893bf3cbc0e2b6
SSDEEP 192:BONj6JUHQmiUySJSo//3ywenezxNxtc/TE/U6:BONj6+pPSo//Peg+E/U6
TLSH
T172120B35B878BC7B5EE3A994B48736235EA44167DBC96F80DADC2E1C01DB19C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 571f64ecc0fdf6de80684e57b9e30e43fc4221ba46e97c9a62ab0763b61e3771
MD5 fc69d7207dfd0d82998b2c5c532eb1ee
SHA1 8c70246cf27fe3376a6779a8b1cb9cc0ed4ea779
SHA512 57515d6f9b8e1925b1a49e9ed139820355f5437e9f6c18ef64eb7fffbf4adb375e1387869a115fc3f6508a8fa203049aa5e8354b84fa53fa366c767268150cf2
SSDEEP 384:jZcI1sNCOTIIbjdGh//PeL+E/7O6R2Feo1SKoR:71uICW/Kz/7TRvKS
TLSH
T13F828D716C78AC7A6DF7D555B88736139EF880A79BC92E80D5DCBB2E00DB5981307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

532baa17-e767-4979-b5fb-f042a6aee4af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\532baa17-e767-4979-b5fb-f042a6aee4af.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e8fa4f605ad79f55a54394490d4960e4c3bd2c1f324b5e4322e246ad5d19c798
MD5 940278669c9e7031ab07609370e26845
SHA1 d5a974b562b48c989e7f5823cc9e54bd72c8eb8d
SHA512 4665755ff612a9d870edc3fc36d9d368009386404c8cd2587d4e2cc337b2114596d7a9816a736985e4da7ef432ae111359b8c86435bd8cf66af6a6e5fe9d6737
TLSH
T1B3411958B6FA0008B3777E4AABF6A96D487F7D772E1AD05E00110D4F0923A00C962B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads