hxxps://devforum[.]roblox[.]com/t/ubuntu-macos-and-windows-in-the-browser-roblox-and-roblox-studio/4823594

Analysis

user interaction
yes
max time kernel
329s
max time network
327s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://devforum.roblox.com/t/ubuntu-macos-and-windows-in-the-browser-roblox-and-roblox-studio/4823594
Sample260916-tk9mns1vbx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4396	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340485230341096"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{A1D2F7AE-EF00-4F55-93B0-66B9666AC5FF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2544	2920	msedge.exe	88
PID 2920 wrote to memory of 4396	2920	msedge.exe	89
PID 2920 wrote to memory of 3980	2920	msedge.exe	90
PID 2920 wrote to memory of 3980	2920	msedge.exe	90
PID 2920 wrote to memory of 3980	2920	msedge.exe	90
PID 2920 wrote to memory of 1864	2920	msedge.exe	91
PID 2920 wrote to memory of 1864	2920	msedge.exe	91
PID 2920 wrote to memory of 1312	2920	msedge.exe	93
PID 2920 wrote to memory of 3712	2920	msedge.exe	94
PID 2920 wrote to memory of 1312	2920	msedge.exe	93
PID 2920 wrote to memory of 1312	2920	msedge.exe	93
PID 2920 wrote to memory of 3712	2920	msedge.exe	94
PID 2920 wrote to memory of 3712	2920	msedge.exe	94
PID 2920 wrote to memory of 224	2920	msedge.exe	95
PID 2920 wrote to memory of 220	2920	msedge.exe	96
PID 2920 wrote to memory of 224	2920	msedge.exe	95
PID 2920 wrote to memory of 224	2920	msedge.exe	95
PID 2920 wrote to memory of 220	2920	msedge.exe	96
PID 2920 wrote to memory of 220	2920	msedge.exe	96
PID 2920 wrote to memory of 4380	2920	msedge.exe	99
PID 2920 wrote to memory of 4380	2920	msedge.exe	99
PID 2920 wrote to memory of 4380	2920	msedge.exe	99
PID 2920 wrote to memory of 2396	2920	msedge.exe	101
PID 2920 wrote to memory of 2272	2920	msedge.exe	102
PID 2920 wrote to memory of 2396	2920	msedge.exe	101
PID 2920 wrote to memory of 2272	2920	msedge.exe	102
PID 2920 wrote to memory of 2052	2920	msedge.exe	104
PID 2920 wrote to memory of 2688	2920	msedge.exe	109
PID 2920 wrote to memory of 2688	2920	msedge.exe	109
PID 2920 wrote to memory of 2688	2920	msedge.exe	109
PID 2920 wrote to memory of 1724	2920	msedge.exe	110
PID 2920 wrote to memory of 1724	2920	msedge.exe	110
PID 2920 wrote to memory of 624	2920	msedge.exe	113
PID 2920 wrote to memory of 984	2920	msedge.exe	114
PID 2920 wrote to memory of 2468	2920	msedge.exe	115
PID 2920 wrote to memory of 1204	2920	msedge.exe	120
PID 2920 wrote to memory of 1204	2920	msedge.exe	120
PID 2920 wrote to memory of 3960	2920	msedge.exe	121
PID 2920 wrote to memory of 3960	2920	msedge.exe	121
PID 2920 wrote to memory of 1208	2920	msedge.exe	124
PID 2920 wrote to memory of 3616	2920	msedge.exe	126
PID 2920 wrote to memory of 3616	2920	msedge.exe	126
PID 2920 wrote to memory of 1768	2920	msedge.exe	127
PID 2920 wrote to memory of 1768	2920	msedge.exe	127
PID 2920 wrote to memory of 3396	2920	msedge.exe	128
PID 2920 wrote to memory of 3396	2920	msedge.exe	128
PID 2920 wrote to memory of 1884	2920	msedge.exe	129
PID 2920 wrote to memory of 1884	2920	msedge.exe	129
PID 2920 wrote to memory of 696	2920	msedge.exe	130
PID 2920 wrote to memory of 696	2920	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://devforum.roblox.com/t/ubuntu-macos-and-windows-in-the-browser-roblox-and-roblox-studio/4823594
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffece34c188,0x7ffece34c194,0x7ffece34c1a0
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,3732810662660689837,703353230293949567,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2239425506701404117,16408803839035317510,262144 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,15113287288314190743,11587843570087442527,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,18211399279616657535,3208985802517808140,2097152 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,569564976961359895,2317090843221234755,2097152 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,8476872491365366785,810984729290848232,2097152 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,10140249830891392609,15836438034839936807,2097152 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,672809198053058997,9424237744003859139,2097152 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,9092634018480461770,17973354741279144725,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,6758913637617498142,335088480303906128,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,2053728306864267415,13399831090874947905,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,2053728306864267415,13399831090874947905,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6484,i,15148123424962633046,16304405661369871554,2097152 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,15141633043613645076,3716536434107931040,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,12092617936863287100,4939692713547451259,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,17144850514274831224,7464020181605661195,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16971721395323360079,18179271153005772612,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,15949786755365891841,5766002148537920469,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,395486254977484694,8018611737078791872,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3488,i,5320063301731550119,13943769818669157451,262144 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,16488314792841463190,15298449967062187743,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,6405062380751612236,4945105349836064683,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,8395753219591174656,9790397639068140909,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3204,i,10195605580953750656,6822546116517191439,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,16884451682776753934,10990296349757495639,524288 --field-trial-handle=2212,i,13098636244993227475,5616377151851923486,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c918d36532d86e1e0db13b24470bcc4504ad10f387c616777f7e9a9660ef2833
MD5 baef65ddd2494df3857a9b9d27b46e32
SHA1 4606ece95706543c7fabbd2cc6d9026a646cccbc
SHA512 4c19a4e1aa4b5dcd52b863ec9dbbf43ff54131b7511e8d1b9a60c69462b5be2f263a79b5e2792ff859a70263768cdb45fab8bdadaa443aa98b72b486fd433fd7
TLSH
T1A4E026E615CCC22EE68C75875278B7CCC2903BEEA3CC7F1A2700D4897282340A382790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 258754f06471e21081e8ab3dc7fa002fddf479e1c4ecbd950f0826ff0973c086
MD5 eb4c4344e3ceae893aa47b264d9975d0
SHA1 404d8d83bccbe5cfcccf4766cb68e18f6d071765
SHA512 192939c494b1d2aaa4d945abecd8561e01def33783664d3a43593ce0c448799823519633c620cc6df3bd70f211efa3c2db70c0e8ab67920c6d84fc43a4a09274
TLSH
T158E07DD80FC8C22EA348749BC2685F8CD280370BF6CC7B3A17008684B281A40B7C7790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fc0fc713be332758a90031e703e5efd270d62ec2aad1dc48cf8e10c70b2a3ace
MD5 6751a5a5ba004f0ae39b5f7751e6917e
SHA1 202dc0bf6791e00e536d070ecea90c1a52ca9af9
SHA512 721a1bd1e9f206e4716a4173b8d0ac445c570a7011ceb69e24ce6b33679186ec53aa4ed4801df05f1c937ed127ed245ef28757a9f10b0d3fcbb588a845fa23a4
TLSH
T13AE0268C06CCC23FA3D8B58781A85B8CC391774FE7CC6A2AA70185897243080F7C2A91
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 811KB
SHA256 f21023e3a3095b121b7d6bd542d1fb33f95c366c5cba20390e226cd45ae96c10
MD5 7f6d5badb820a620f67062c5589ec513
SHA1 b0a66a25720e60b0754cf3baabbc615eb97d3b47
SHA512 0dd56389495f2d55e71ca610ba30fea77bbbec977e0550e5112430d2b876a33bf7ddc84cd801f8a6a465bc9eea84579790bc869b9059faf19140d7339eec5876
SSDEEP 12288:CJ6qV2DbGbMwp74V8093sqXRMlQVxVbwKMfAyfupwtNZwEEW71OOgx/J:CJVMbGbTp7PIBhfVx3MBfjtNc2jgr
TLSH
T1F205CF18232066D6CD700274FFD557F2323DD09C2387BE87686813A41F6A7966A63EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 a6ccd937be1f67de951afa273cd5d96037005fea9424a26accca52130fa0f4e5
MD5 e4827ff88eaa93d382747cef6000914a
SHA1 ecf614deeaef27ec9065e022683414de50404063
SHA512 daca0e1753704392f5a3fc4927324be1a925d979bfdee0dbb0c570b73e3e5b1c907a1df4615a69df063476a79fa710ccf9943de2d5129122cfd4679b855cd912
SSDEEP 192:QTY9jCFNgU0W6bQRoUYB6C0pa+WqxlMF9sUL5PX1hZB2ILAne0vjDzEez:QTgOFNoWCQRoUYEC0pa+WqxlieUL5PF+
TLSH
T108E1274006B34626CF9434B855D7099B763409FD5C8B9F72F297F8BDBBD23904A2449B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593fbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593fbe.TMP
Size 3KB
SHA256 8a5593262c10363a7e9bb9858bcff3c6abbbc28fa8816effd6d458d56bf3549f
MD5 13b0b38f3c79355f8ff05fb2ff37897f
SHA1 26339a39b6ec37ed7c14d4c34978112d816816f7
SHA512 3c5f87997a5b365a072f489b68ebda3da23c83983aff2a67125216b59a208fb631307c0f37d539b461fbd0b1634177699f990a055f7654d8adbc124214f609ff
TLSH
T12F612C81077054B9CB68617895E509CEB6684CF5A583CF8223A6FC6FEF063744B640E2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a51e919760bad6b237aeb731cd291b5b25ea255325399cf98020a7655d99c362
MD5 cefd9fbe3d65af04980e628a029b23f3
SHA1 ba216e2ec771b5059cd1240ce810f6774ed2cea8
SHA512 b85b6e414b5efae70a6306d76b799d9f5278a406179e32d548b11dddf6ffa70690caea174ce111db62b084945b1fc5e39d55218fd28d96ec40c6ea9ec2a53a7f
TLSH
T1E07117F743B1956D9A1296F0AA08EE1B8E580521471C787A85E0BE27D3F3971E1027AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c1f2d293381a13ae366d77633612a8be590990515306e75b0e196c8e66bbcbd7
MD5 d8d0fdeb6ff93c3282bc19944a45b88f
SHA1 5babe5587e7612063f0c4853697cfe34e6625532
SHA512 a5123cc549537ebce1cb9fd346a7368cc6032e7dba443bbee398f36386cf157f38f70d5edd0c130c40c40c064c71fee65694c0a95bca287a09f56a36e0b3030f
TLSH
T1747118F743B1956D9B1296F0AA08EE1B8F580521471C787A85E07E27D3F3571E1027AF
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a676401b74d0b741191973f1cd65b9bb17fd37cddb9fd163656acc46c6c68271
MD5 13f35aae0b2923ae5f7b6551f44af89b
SHA1 aaa04b5817d11ff6154f1cddf51d00c1a29c90fa
SHA512 ff32a08f28ac03c9bcbb7f42fea1debe570c6530c6a0c818ea9457ed2bcbdfa628db5c145e79df91ff2065fcac2dbbdd566c796525bacdafbf145062169c5f64
SSDEEP 192:sxZvRAWh/fGs0sIdpsySaHW6+WNX7M/Y348hIg+J:sxZv1h/fGs01/xHbY/GK
TLSH
T13022C6166E24A57B8CC7E21DBA557F03E2F9403195D11E98EAFC962C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 02c2e162fc63a217ebf49fa313f7dc8aa1588b3a07e372f28f0043285f1be008
MD5 40e6b32b417b524ae02d0eaa83a44970
SHA1 9be4df172a47ff337f9fc1ce7e758dc3d836740b
SHA512 1aad7ccd02c1146e51ea4b03aa3267ff76a5355d813229b8298c385dbca2bad8b0b1b3502e637a6321047177d466e771173e9edd731070530a24f7d038104156
SSDEEP 192:sxZlRAWh/fGs5sIdpOyNZfaHW6+WNTh50TXY3t8hIg5zJ:sxZl1h/fGs51x+HbkXp7
TLSH
T17A32C7577D24697B8CC7E219BA55BF03E2F9403295D11E88EAFC9A2C01E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 387169940be171006010e62a030b6241349c4af48fc09b8a881bb8a010809818
MD5 a0c585b58a630d68f8cb3313da6e977d
SHA1 aaef08ac27e0a3b5c191735d5d91448c239b7879
SHA512 d4d906d9e8461b35654a3c82dc3c60f08caa90bc629393ad948093c03bf95f4a1693b64334b5a6bc3955ca1a91ddc102e64adc852df6d25dc6abe973f3d13019
SSDEEP 192:sxZlRAWh/fGsIsIdpsyNZfaHW6+WNTh50TXY3N8hIg59J:sxZl1h/fGsI1/+HbkXPh
TLSH
T11A32B6577E24697B8CC7E219BA55BF03E2F9003195D11E88EAFC962C05E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 40fb55cac89ec516c9b1e509ee18d207f925688c06697a7b359088a91486799f
MD5 e0b718b168f3a927302af8cfa4634e41
SHA1 08708399264a13d66a1cccc551b663cae7f21164
SHA512 d2935427c6aaad474893c422de3ac5f96047d61b0e605b89847199e3c57e0faf9bbf928520356b26e8373482574d50932391feb92a09893d2047f6a137b9b199
SSDEEP 192:sxZlRAWh/fGs5sIdpsyNZfaHW6+WNTh50TXY3W8hIg5zJ:sxZl1h/fGs51/+HbkXq7
TLSH
T1EA32B6577E24697B8CC7E219BA55BF03E2F9403295D11E88EAFC962C01E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 b9ccaa062e64f55962db15f0dd99b1908c2e1daa98f54440164f2591a3b39d97
MD5 d293704d038e2a7734c6168c54b842c8
SHA1 aff044a04c8bfa99cbf598501a7a68307fe48d71
SHA512 e37813d772629fe9a864ce88fcfe120f949646b115f2e9f0c301a2a84849af822f90467732e9a0676c3d33c737403060575bef8db3c36981e021c0d1e85c3b61
SSDEEP 384:sxZl1h/fGsr66s8qMpRiYnazAW8pZS15posJWeT+Pu1x+HbkXHH:s91h/fB4Mnc7WeT+PuCHban
TLSH
T1DFC21906A824C83B9FC36D28657D7E33EAEC405251C5CEDA5AECCA1C019E1FDAB47817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2f13b800afdc4bc3107f13eee8ba227c9bfff041612ad16b8b828ce069f259c0
MD5 539de6c2e761bdaec7a8e73c9c0ca6c0
SHA1 00d9345c236231c748036f791df791ced8e20e7c
SHA512 0a3d19a7d33b515a153edb50afbfc3aa5e17b3534c6298b49d8cfdd2a50812a177204ad8da8e214b1c40c3cae0da969d17f6c40b99b949b4fee95ca7be37fc73
SSDEEP 768:Io30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72LrolZMrU0:Io30AbSWvS2l9u1jaLmLZ124C
TLSH
T164C2EA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4047FA944C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 576B
SHA256 138c2ef0faccf0664c889550b319f6a208ad5f7dfc5930ecd47620b8efe15211
MD5 116d6dffbae0156e543b532828883d08
SHA1 395677d92c5e2bd7fc9d1e65283c7e6e941902fb
SHA512 72f3fea993345ba791cc4c53958854df309f85d9de1470abe6b361726ce1f7094142f5b5fcae61c15b1aceb7177c3fa919197e6d725ec4b688008839b774ba3c
TLSH
T183F0A3D92D134949FC184174747D645565B111EC5394790BB1FCD0169C567809D416E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d5333.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index~RFe5d5333.TMP
Size 576B
SHA256 27a9bb6718d735c61702c0fe8a361db7ef97f2413fa1e69194332cb6aedd6b91
MD5 e9968b736dbfa33d514f805134f77e91
SHA1 0203f48ee370211a427f9686fe9060658f6bb0b3
SHA512 08cb481ec0912047986fdda44493a028f7b8dfaecf0451e4ead436490f92f04764196b433a66fd6a9758c53aaad286e5abbf8f2eaab481865536c77b967dc80e
TLSH
T17DF0F1D816138B46FC080131E57DE56972B550089368B90FF3FA5029CC53BC0DD42FB1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 89f4570992e819e1a0cffa33a3bb378ec7c914d61f1b1be980a79b4f97e64d3e
MD5 7a44933b410120bd7b06e276e06c2c64
SHA1 9ffef7932c7b8cba244789fdffdfa243f1d84f99
SHA512 b0f11422a78097c6f88b80c93b51efd5ec5eb5ac9e7233eeb0ff5c96bbab9d15d5f41f3b86142f07e51824a2bd12173cbe9ae95ade2cdcbebc1c72b1dcf5ef98
TLSH
T13DE0C0F26DF71C60FCAF83D4147089B141057894DA0CFC4F10AAB7C7A4703113845C50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e55fadc3af2372d210541407aae519e3d4837e9147b89f044ed9531ed623ee68
MD5 85c7de5d952616217deeb3d223d77145
SHA1 97082d9b1dd32d5da6ed98eae2d8324393b48c6b
SHA512 b271301638085f6375c97d8a053fdea3ef2f2b07d6a7710c524a407bc1ce5aba6c34e65091d114ba87b85c6a796c36285d834ac8748472ed6e826a687555a843
TLSH
T181A0025102F91041C9A40671504F12457350595552452A968C9DD0DAACB1B50978725D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590ebc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590ebc.TMP
Size 48B
SHA256 34e294b8b6e1386ef73c9edd1ea57fc421fd05001f561c888d4b837a76471394
MD5 025c2ea5df1320ef990601fb548e49f8
SHA1 19836457628e87cf8af0eed183b0c75cdf9a9211
SHA512 0c6c3b9a0186b1cf2f1618a6f8a3bfad54e6547b9ed77042d172e07bc61b97362f66e5704d331a3162f206d473168ce4346f3fc554254800223588648c890278
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1dd4b37d787a3e63cb6dd1451f832fede5c4a34010a0ada4ff744b83e8a2bac7
MD5 a0ea5e190b93a6356b25d2eb7294ed24
SHA1 577f89f6c4485bc7f0a95dde6f5e86e11e42a9d8
SHA512 06e901f0bacea6625aa5c1babb360ac56ab1b4aa5ba63be87678db6d34f4dab87e2604437def770a0f6251ef4e8e89a19bac0f142d900ad635825b0a90a5700c
SSDEEP 96:KQN2K+g6bt7tCtXtLtdthtFtk1thtMtP3tTtkKvtB3tltkjtrtLtstdtrt5GFqKn:sZgDBy
TLSH
T1B691561031BB52017CBE698985A48B6F428136F33459F52B7BA84197DEAFE040DFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a02e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a02e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f159c87f16f2185f223b291c99ce968798cb8105538da669c3ba4440b1bfb573
MD5 9e91f8ea8295a601e7b49747ebc5869f
SHA1 098849f6c59a941a65078a2e66dd3731380eb074
SHA512 38ffed804f2a51867d8fa02ea440f3a20c258f1e27ccca1557e24d28c3cc64df299e1072e6ab2e40f8fb444a88cf0408ff93516a8a33820ea86504e03fd66b1e
SSDEEP 384:uZcIesNrC64puX289iX5Frn5asa+VYad7UNoR:MeD94a35ahgVYC
TLSH
T136828E36ADB85C7B5CE3E2A5F4473A038EF8416797C82F9489ED6B1D05DA6980307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cae877f875d70cc76b5e644bc5d2575b0e047f37443819b9c1f5a8e204768e1a
MD5 2377fafb5a164e37e1fd0a0adc37bc02
SHA1 7008db8ae4e368398b3f0c1cdfd9f742ae301694
SHA512 f585a86a76fcd9917a5c37cf14e220ba21d74493cc70ca692da34124a1e21d88dde08d98b9d977c83397d735a8c9922d630abceae5734872a29fafd63287b25c
SSDEEP 384:jiFiZcI5DqgsN18TUNTUlIlv64puU4IezIL89iX5Frn6asa+VYad7UNoR:OFQrQwgz0IezIL4a36ahgVYC
TLSH
T112C229F658D7983AD8AE9753B77E2D028EBCC053B5846950B7D85A1CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8754df0fd0c4982ddb3f981e3bce5378027d9d3b69526a93f12632865f9abf76
MD5 9c09359d41d9d0602211618ec40585b7
SHA1 e09dd1110bae052795bafe87b80aebc621aa6dd2
SHA512 d5169007b2501a57ec074a863b692377f6f0125829db39afb53837425d0fb2c2b99116e506bac850434aa0d4b8b1c1f0e2964a84982b844a517fe78db7f49a82
SSDEEP 192:LONH6AmwprQmiUyQk6siX5FGyhaJig5BU6:LONH6ipdg6siX5FrRgfU6
TLSH
T1BD02E939AC786C7B8AF3AE19B58736136FA5116BDA941F44CEE82B2C01D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 297d63a578289936d8454940840fe9d3cbbe369c5c2ee70726d520e068439ef3
MD5 f5a6ed3d90168065641c3bda841ae8ca
SHA1 fc813e34cc21c01ea3fc7c7f0dc4ce43753f76c6
SHA512 d9e347faab823b7d6dc6f387b0d34d2d5fee87dad34d500bc69d0a32e6c3bc6ffb686be7cf9c06f978567f7c16a3e63b6dd389fd8d781bbdf2005771acfac5d1
SSDEEP 384:wZcIesNrv64puU389iX5Frn5asa+VYad7UNoR:Oeq74a35ahgVYC
TLSH
T1F8828E36AD745C3B58E3E265F5473A038EF8416797CC1E9485EC6B1D05DA6980307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5c5296e8f62dfb47071f1cd6fc61afd31fbabb1237f924db457e0b4f68dcca4
MD5 ef6ea56b6b7159146fbb99f0d2514520
SHA1 9bda7276ee959d8b5f782f9afb5dc03c261f8179
SHA512 38e8f9eeb5d2ed8795eeeeedf9210174bd61bc9e17f30675304c0b4a64abf80176ed5f07769d46291748f93807449a8b48781e363840e64a7df4103717bb9cb0
SSDEEP 192:LONm6AmwpDQmiUyekssiX5FGyhdjlRh/F+U6:LONm6ip10ssiX5FrnXaU6
TLSH
T108122B36B878AC3F4DD3A555F08735139EB5422BDB886F94C9EC272C02EB598530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8afff5d1caa10a77acb08b0448404bf047db93dfc4f4c417d4cf204755175558
MD5 72dfa903ff19d3780bfda1126e37326f
SHA1 811df47f88f08bf4b2dd8e5c95d41d628e0e0ed0
SHA512 70883ee2282a1163c3aacaf03a164f42542076dce58392555bafc778f55f5b3143ccfbf07aedb406b82b766e435a308c8f7382a729921bd2b6da5bec3d4739e4
TLSH
T101412B48B6F91109B3B76F56AFF6A86D587E78672F47D45D10110E8E0A32B00C8B2B33
MD5 SHA1 SHA512 TLSH

Submit Download