hxxp://Roblox[.]com

Analysis

max time kernel
899s
max time network
733s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Roblox.com
Sample261110-vcvdfsgh45

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2804	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{83E8EE59-ACCB-438F-AB21-C2AFDE2AB28E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 1800	3688	msedge.exe	88
PID 3688 wrote to memory of 2508	3688	msedge.exe	89
PID 3688 wrote to memory of 2804	3688	msedge.exe	90
PID 3688 wrote to memory of 2508	3688	msedge.exe	89
PID 3688 wrote to memory of 2508	3688	msedge.exe	89
PID 3688 wrote to memory of 3124	3688	msedge.exe	91
PID 3688 wrote to memory of 3124	3688	msedge.exe	91
PID 3688 wrote to memory of 3348	3688	msedge.exe	93
PID 3688 wrote to memory of 3348	3688	msedge.exe	93
PID 3688 wrote to memory of 4044	3688	msedge.exe	94
PID 3688 wrote to memory of 3348	3688	msedge.exe	93
PID 3688 wrote to memory of 4044	3688	msedge.exe	94
PID 3688 wrote to memory of 4044	3688	msedge.exe	94
PID 3688 wrote to memory of 4924	3688	msedge.exe	95
PID 3688 wrote to memory of 4924	3688	msedge.exe	95
PID 3688 wrote to memory of 4924	3688	msedge.exe	95
PID 3688 wrote to memory of 4896	3688	msedge.exe	96
PID 3688 wrote to memory of 4896	3688	msedge.exe	96
PID 3688 wrote to memory of 4896	3688	msedge.exe	96
PID 3688 wrote to memory of 8	3688	msedge.exe	98
PID 3688 wrote to memory of 8	3688	msedge.exe	98
PID 3688 wrote to memory of 8	3688	msedge.exe	98
PID 3688 wrote to memory of 1420	3688	msedge.exe	99
PID 3688 wrote to memory of 1420	3688	msedge.exe	99
PID 3688 wrote to memory of 6104	3688	msedge.exe	100
PID 3688 wrote to memory of 6104	3688	msedge.exe	100
PID 3688 wrote to memory of 6060	3688	msedge.exe	102
PID 3688 wrote to memory of 4172	3688	msedge.exe	106
PID 3688 wrote to memory of 3316	3688	msedge.exe	107
PID 3688 wrote to memory of 4436	3688	msedge.exe	108
PID 3688 wrote to memory of 4624	3688	msedge.exe	109
PID 3688 wrote to memory of 4624	3688	msedge.exe	109
PID 3688 wrote to memory of 1764	3688	msedge.exe	111
PID 3688 wrote to memory of 4200	3688	msedge.exe	113
PID 3688 wrote to memory of 4156	3688	msedge.exe	112
PID 3688 wrote to memory of 4200	3688	msedge.exe	113
PID 3688 wrote to memory of 4156	3688	msedge.exe	112
PID 3688 wrote to memory of 2616	3688	msedge.exe	114
PID 3688 wrote to memory of 2616	3688	msedge.exe	114
PID 3688 wrote to memory of 1864	3688	msedge.exe	115
PID 3688 wrote to memory of 1864	3688	msedge.exe	115
PID 3688 wrote to memory of 3988	3688	msedge.exe	117
PID 3688 wrote to memory of 3988	3688	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Roblox.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffb188bc188,0x7ffb188bc194,0x7ffb188bc1a0
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,1847354419719629238,2634367544347893773,262144 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,16258538758422622955,4686898604755401795,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,15461841611360897444,963087533900600290,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,13912918306608237217,7598596592392793655,2097152 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3668,i,13722762169767975882,13392592266825659961,2097152 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,10495284392059277839,18310625387968579710,2097152 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:9
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,11634573348069676005,4890474891640676,2097152 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5384,i,6441332815755485009,13198911304601212276,2097152 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3045737079661235849,3057400063757255109,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,16425781288108940838,12150906655025834021,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11719369497052187313,12180103354790463204,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11719369497052187313,12180103354790463204,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,3764832742507177087,11256575804790679916,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,13940290347359735297,8917750596507787609,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,13796606967549152772,14754850317945227384,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,1805791248989941127,3231704205965397393,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6548,i,11922396139883515702,12670117203013765955,262144 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,1500101407268075158,5078192599063952812,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3312,i,16600786933593941467,13297812844327499575,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,14053817941293291518,9209127753204239494,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1108,i,6012839371824152865,12510534781847459373,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,4701627611002064293,85067173517414674,524288 --field-trial-handle=2464,i,16471547217484367290,18402220378656523513,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14
  2⤵
  PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1964

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

143de099-1f64-46a3-8671-0bf5fec86707.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\143de099-1f64-46a3-8671-0bf5fec86707.tmp
Size 38KB
SHA256 ee5502fb9505f2b3df7db6ea984ccf0b440fd25e8dc4b1e0e016261dcc601c36
MD5 ac04fb3c298cc6d231ff03b191c662a3
SHA1 01acffb33ad394f754bd22459071a63aa4e0531e
SHA512 ffa04680d8c5fd2d25d094f3c8a926711265d6e3625fe0bdd8f1947ace6e23f674ace47df9e215ccaa6c05c93add3ec140c7ba08a94ff7dd76567245dc0d6922
SSDEEP 768:5/UxvxjgC+W3vI5c7fZrKbp5XSwQs88uBkiTzP/P84g:sZj3+W3vBtrEILNBlHg
TLSH
T18D03CF39F8945823ACF3A385365B374BAFF05153C4C41AA44DEE6A1E028B75D5347897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6223aadc-c2d7-4c6c-bf73-62344ecc243b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6223aadc-c2d7-4c6c-bf73-62344ecc243b.tmp
Size 33KB
SHA256 f47f0a83cb9127a720a04deab449a60f19d813b2967660ca5bb87a3d1ee61cf4
MD5 5d7c3f4fda1585b70a1abc23229d94ce
SHA1 68fc76f9b7292b8db6fc58d4dbe114cadc5ca28b
SHA512 601b0f887f7cd8a1d97249c7332d2624ec74293d6547f4f4675d5d24f794560e759834ee4ee33501ff2a6c8206277e6a98c643303c6424b15df09ad944367fd6
SSDEEP 768:FH3VEArc7fZrKDp5XSwQs88uBkiT2PoaTZc2HwLl:FH3VEjtraILNB69XQ5
TLSH
T1CBF2BF34F8909873ADB7A391770B37076EF09147C4C40A94CADE662E02CB75E678B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

58edf91a-7edb-455d-b144-73a1b7bcce8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58edf91a-7edb-455d-b144-73a1b7bcce8e.tmp
Size 23KB
SHA256 5deb1a29618bfff474dcc1d15b311eb4c36bd3473ab4b3a79291a9f14a847315
MD5 f79f0ed51c50ca84c0378bc1590e20d7
SHA1 8d47f0128ed254bdc2cd31c19d5873de84c676f0
SHA512 7115921fc1b8feabded3f60d1189b7e478556400d5565616bb8943aa4ea93727519dbfb53c3976b78981b54dd6a2ebb7de5538e189376a5b8901e345179c6693
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXkroJea:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0VK
TLSH
T116B2D92B740CCB7F4FC04A9EA8196FD77D9802C79A588D4047FE995C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60a63404-fa53-450f-a9cd-fe6bbe244cba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60a63404-fa53-450f-a9cd-fe6bbe244cba.tmp
Size 11KB
SHA256 261ae838bc5fb7dfa63c103a4cf9c284852baee435f693e477baeabff9fe8242
MD5 67634f8eac51107206a0c6dd46c76d34
SHA1 b29d80f27b3b30edb6e7f83a8069212ba0e7bdf1
SHA512 b52cc08c8ab21faf9697c91302880f7630f89c0a7080c1afdf26e5551f5da32c646fae63685f48558d3431fc7481d014d0a516aea8f0eba54e7e6e5447bf7cf9
SSDEEP 192:sxR7R/bG/f6sdQHRvQzoA8pxg/g6+WN0hn/YEf92G+3IgDmJ:sxR75G/f6sdQjG/5+/i+
TLSH
T12232C855AE24A93B8CCBD20DFB657F53D6FE147261D01E48A7FC8A1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90c2735f-f896-493e-a557-431627020d29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90c2735f-f896-493e-a557-431627020d29.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fc3347e-4e49-4303-8498-d3a40a78a168.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9fc3347e-4e49-4303-8498-d3a40a78a168.tmp
Size 11KB
SHA256 400be8b3e0c23928897f48b0b79069d2792a9ab8ce432e813219620f6b7cb8e5
MD5 37f9537a6a1d074ca830db02de8589a3
SHA1 6e0b41bbb0b949fa9fc77a6ad242b3b7c7cb638f
SHA512 e3774836b9f07d9ca2c94c6a673f2adca3c64d446393df87468724924e0312c0ce48656d8b4922b84e38ea6fc8f0d7ca2e8921bc83c957899ac5267a09498593
SSDEEP 192:sxR7R/bG/f6sVQHRvQzoA8pxg/g6+WN0hn/YETj2G+3IgD8J:sxR75G/f6sVQjG/5+/48
TLSH
T12C42B855AE24A93B9CCBE20DBB55BF53D2FE107261901E48A7FC8A1C14E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 144499c8c161f1a6f72073aab4402878ff1f5a8d52d14763bbb1ca130b5c0096
MD5 e9ce6a8feeebe23f7844d2c03c1fe4f6
SHA1 11bd288908c14e8c942b6a81fcc348eb0d1940b6
SHA512 58964997653f9d674ba8e27ff25203f95af1abbee8e9be76521687f3ec0866640a14e23cddcc7572e9b45bb2b3d73b4348465352247040b3540059c380e045eb
TLSH
T14CE0DFC464CACA2EE358648701A8670CDAC1276B93C4698E5B00C4C57001AE8A7A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 328B
SHA256 39c854f98635034d7b7eb7b78f47de895092eac12d36781786fc18584be73908
MD5 ad3072016280159c96f3118bc2e4d8e8
SHA1 f1a38546d97d87945fc43579a7f661c5de479df5
SHA512 330d2d8ae953ec7f3817b653fdd25c90ccd25df42470daac3ea36119243d445cb2dd5a9e0b92d7aa026c706ddb7623331cc5760a744e1137693c5c6faefec007
TLSH
T111E0268418DEC22EE30864C712FC9B0CC2902A6E97C4798F5700C4C4710574CFAAB790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 bf41ecb612a6e94d7d18837053b42ae8a45ec0adb4c8ccf0a415e466957c60e4
MD5 466af1e65c44f674ab821073f1d94bf1
SHA1 f9c65a9dc736761133d051c80ec8c520848d105f
SHA512 b7c0248c35238fc13ac3f493236aaf6334b8a2cc0f0400a9e2e5a5b94e7c8badb783b576f52cfdf7611ea0e1eab9bbebb240df4d98a827e319782ecdb1666888
TLSH
T121E0268428CACA3EE30864C751E8678CD280366BD3C8A9CE5704C8C5B001B6CB7F26D4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 89d54fc5788f863d3f6b548d0ff1e5716abf9ac9f94cc99be558a5d49b2f8b0e
MD5 e384bf2006db5fd9884aef8e9bb78f8a
SHA1 b23bd9ead462059eca54aede589504ff8534dd7a
SHA512 e85c65c09d39bf4e2a2e19891899c02b3f5a81117368f98cbd65e61a7a27b3a4d80f5ee79e4cfc50bd27abe3c33a42aa993b0a9d29135734bde66a72567674af
TLSH
T1A251424B97B24C25EBA2413D91E613CF3B7BD570755F2E020AA4C0B9BB4EB387224C52
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c9776d1a2af5eaa969a3ad89afe6871eb05c73cc7df4611e7e322c58224e0e04
MD5 54653fcd6b0042409b5a6078931dc36d
SHA1 ec60d9d2534ff9a3922c7dbaffdc313db884cb67
SHA512 ebe4d6eaf161dc7be1d072410744d8cd420e01e1ed843e31a58e403073c6979c7b5cc8408a28cfb86d24f09cb4730c1758204c7388b241f84182410981280044
TLSH
T10751424B97A24C25EBA2417D91E613CF3B7BD570655F2E020AA4C0B9BB4EB387224C42
MD5 SHA1 SHA512 TLSH

Submit Download

44a09bd3-ef6f-486a-b7d1-f5aa297d0c32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\44a09bd3-ef6f-486a-b7d1-f5aa297d0c32.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2d626593-df6a-47df-a067-f89a350168da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d626593-df6a-47df-a067-f89a350168da.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9bcb7fc0-e552-44ec-85b0-0675ad3e6ca2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9bcb7fc0-e552-44ec-85b0-0675ad3e6ca2.tmp
Size 1KB
SHA256 fb037cc6a4657f905838db930fe58b5bb3309ef7505253b8031d869b9e337213
MD5 bf88b610baa7600a7d202c21ad69e931
SHA1 bac13c14c04f9b7fbc1b0f029e60f7e4a411052f
SHA512 84470298abc7978c17a59ea4d40e99d736bd3d98aa1bace08e239a78ddb77dd7c37483871fb52448c28e4f6e46a1a1246db5f15b7a38a4e7e9fbdfc22c5dbe22
TLSH
T18F31ADF3C3E8467D8A0156F87A282E1BCE2D0854432C3D56C4D49F5F93E18B1E28099E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a00c4e65-585b-4c2c-8aab-92bd6c96881d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a00c4e65-585b-4c2c-8aab-92bd6c96881d.tmp
Size 2KB
SHA256 dfdb9c0d28db3b332c2b4a12b3a5854076695aa9ed48eb5875a7687eeeea62ad
MD5 75cc5334a1a5d53efee446589d51841e
SHA1 13bac5b9235691795a4564a598a80b7123fac6f2
SHA512 3cdede56d8b2c4b33d296c619f44f261a1228506ca4e2e1fcbcf5327d052c58817bbae354818b0f9befb2f8c0ff4b636fed840740f5777ec4d1e159798f06511
TLSH
T1E0518FF743B1C56E9A1596F0EA08AE1FCF5C0521435C78BA85E0BE2793F3462E041B9B
MD5 SHA1 SHA512 TLSH

Submit Download

a3c3a9ca-7a81-4d14-b022-3a94300c28d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3c3a9ca-7a81-4d14-b022-3a94300c28d5.tmp
Size 2KB
SHA256 a5ecafca237f3f5ea8a4fbf0b20c33748a98b445bd992a8aa119e7183d2d3136
MD5 cdbb3997d273b79fac935af1c6473379
SHA1 d749623f5b03fab24dfa48b33dde0a158a7431c6
SHA512 ee305b427da2bea626f95fafe2df9d84d0e31e2b424bce2027dd7fe78c1327bb312c3f885c34741ffd51d853a46de38ebceac30e7d22029fa78fc6a4259d42cc
TLSH
T19C518DF743B1C56E9A1196F0AA08AE1FCF5D0524431C78B685E0BE2793F34A2E041B9B
MD5 SHA1 SHA512 TLSH

Submit Download

f074a85b-d9c1-467e-bf1c-c31aa1d3d448.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f074a85b-d9c1-467e-bf1c-c31aa1d3d448.tmp
Size 2KB
SHA256 2cb778ef05fb181105a11ab1d7e1472197f59c315ee81e4fc432d3d33ff34374
MD5 39711303c249b9feca69e94923f8be40
SHA1 d30693b5851719e261105d17d48f61331f9d8a71
SHA512 762ee97596f577188d365bbd31b2c32bc656352440094ac414089c04fcd36ba1738b09bcfe12e7710202b560386b439b274d0fb7e55501ad335ace8bb0dbd1ec
TLSH
T1EE518FF743B0C56E9A1196F0AA08AE1FCF5D0524431C78B685E0BE2793F34A2E041B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 733210e349220731945a049a254b20328eab66db19215476e8e3d4da2923188d
MD5 0f9407b3bfd12df0ed68cdc2ac4cedd2
SHA1 470d3685469e65f5c68f436c5a39b0e247ede052
SHA512 ab6e32ca88298e5716474627da60c3b8aa9fdaad6a8fe7fcedd32b918a8f64aa0adbd06c2b8c8661ef3557c0e05b2ad95cb0ed520fd7140f19c575f863deb247
SSDEEP 192:sxRER/bG/f6srQHRvQzoA8pxg/g6+WN0hn/YEf92G+3IgIJ:sxRE5G/f6srQjG/5+/is
TLSH
T16232A855AE24A93B9CCBD20DFB657F53D6FE147261D01E48A6FC8A1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f57448f-1936-4438-90ce-eb13ef2513c9\index-dir\temp-index
Size 360B
SHA256 30712106ce0ba34c00495957c73790f9ae19dba1c21bc8cd15740d1694b81e81
MD5 049d8677f591e6ee54dfe563260e4209
SHA1 70c258d7f6e3f56687819b4d927fbe5ad5cd4bcc
SHA512 aa4f5d4fdb0f2e28a4464d669255dd82a105ebae5a853f83f6226e7719fa41b985dee77fae2afc3055540836d5d50922c61e00d2c64d179d19e8f33c9069fa33
TLSH
T13CE02B9C3D2352CBFD644076743E5065677015ED9314160F24FDB4578D0B794BF43A18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f57448f-1936-4438-90ce-eb13ef2513c9\index-dir\the-real-index
Size 360B
SHA256 b2d2be6507b8604daf364ccc3d80fc1a6cddba5f121096d26d4362fcca7c5fd7
MD5 370d2360447afc7c31ebbf34ba97476c
SHA1 cf33c2602a93ee439ea9ec6145b7912da36372aa
SHA512 5b94452b78b2c9a8f5d48125bd1069e8aa017f510011812dd6a7223e16f66757f6148832035dc74abb3b1808a7abb93e704f4eab17bcdeb5ad6a98c6188492f2
TLSH
T130E02B5946238245F8480031287E603162711418E360270F61EA84568846B44AE03B14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 151eb42d5cb0f2a7fc9f378eda6b0f0d20d3aaff880aa9d6833917d9f4298a2e
MD5 73c10fb471fad353b92e3441a7b08882
SHA1 bc99e0877d27fbdbc8e12506bb12d144b77cbaa3
SHA512 633e7526aed3307ea6ed64b9fb781d25a391001098e78f7b99cacc7c92d1bf37e06c31a9ae3520352647e47365a256950678f0e4dfe93793abdb78f73b07652e
TLSH
T185E0D8F729B71418BC9F93D6243150694145B868C945EC8F002A579340B13663456C76
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 865454943f109c0d979bca4fa12b5fe134a0b833c3ff64618f8e8934c7c66eaa
MD5 3923b1eaa797ab688e8fdbf2ab11eb92
SHA1 90e526ec97263a894c4f833aa7bdd4c5678b80a2
SHA512 a08e69adae335a45bcac8deae91fbf6338291596abec8688c08c05e3878e528a9305d25104b7978725c37c9dd1448cdabe42be33962d932fff7be3d8a363814b
SSDEEP 24:Kljo/gjI/KPhe1qSmZryXCteRkdIfrM/YPI/Kzhm1ySCNbyXpW5uE8IJKShM:KkYI/KpeEnyZaICAI/KVmMDytTIJKkM
TLSH
T11E912514717E060039FE259A44B8C57B424231B33129FA6F7BA894E64D6BE192DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b505f36a-aa9b-408e-8245-7b4c974dd200.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b505f36a-aa9b-408e-8245-7b4c974dd200.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae5e3a21-05db-4370-88dd-825f9b90f1d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ae5e3a21-05db-4370-88dd-825f9b90f1d2.tmp
Size 33KB
SHA256 782dfe58462f1dc4cd16d2a458810815a086d099b943da40adfbe6eb7471c56e
MD5 8ab36ceb7b01a26ccb320df93e6f441b
SHA1 4a94410f0f6b88a16a4b29d2782dd67ff85cd7f3
SHA512 fb6eb72e8b5a666857e58e93e89c133f66bceda0ab1db419c1905b57fe59c919c0a23316306876872819dfa5f3400ad44bb3b4d39061c5917b3920f38634a285
SSDEEP 768:jH3QEurc7fZrKup5XSwQs88uBkiT2PoaTZc2HwLl:jH3QEBtrBILNB69XQ5
TLSH
T118F2AF34F8909873ADB6A391771B37076EF09147C4C40A94CADE662D02CB75D778B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6bd72b5-e3ac-4910-bff8-aefaf54afd91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6bd72b5-e3ac-4910-bff8-aefaf54afd91.tmp
Size 37KB
SHA256 a75c678f710d04bb46282b6366214344527bf57584b176178cd48842126a752d
MD5 9864a168b0753eed1a69817517b816de
SHA1 20e0235974d1b0cb75d497a1d2fe5c7bce48dada
SHA512 84af1f96dde4751179c692df4ce089d20601cf4ccffd9de5819b62fbfb848933f50755e9fe4fae02d864e9f2b00ba9089a0bc9a30357e4d5082e6291fd701c3a
SSDEEP 768:R/UxvxjgC+W3gc3c7fZrK6p5XSwQs88uBkiTCX/P84g:kZj3+W3gLtrtILNB2Hg
TLSH
T10103C039FC945863ACF793853B5A275BAFF05063C4C41BA849EE7A0E028B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec962406-2db6-47a0-9c09-eb8a1e03b76e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec962406-2db6-47a0-9c09-eb8a1e03b76e.tmp
Size 41KB
SHA256 5a7abec2d5d8d528547e07e6c7d538439b4cbeb549f99628b28b7d9db182a311
MD5 3ea22e9a5c5b74507935e9c9775a8aca
SHA1 4b07f70bbe675841d00e0d5d2ec8f8d9dd83822f
SHA512 123d21d6569ba78f16e7d6c9579ab4c2cf609a9c35e8c5c0127c7e3a8f07aef6688893341e17c47f875cc7fe4d5e4f8ae052bb79b3915008a8db85ed8af0a1e7
SSDEEP 768:eFdX3pwgaEArc7fZrKSPp5XSwQs88uBkiT2PoaTZc2HwLl:+X3yEjtrbRILNB69XQ5
TLSH
T1991359F1A8C38476EDAE9783673E2E029EBCD043F4840A50B7C9551DCD8627FE386856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e12cc13c-c395-4e77-b3d8-ae1602b8bf93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e12cc13c-c395-4e77-b3d8-ae1602b8bf93.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/6060-259-0x000001C0B12D0000-0x000001C0B168B000-memory.dmp

Download