hxxps://robloxfreerobuxgenerator[.]com/

Resubmissions

20-02-2024 09:42

240220-lprcwsed8t 1

Analysis

max time kernel
312s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://robloxfreerobuxgenerator.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
4024	msedge.exe
4024	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 1784	4024	msedge.exe	45
PID 4024 wrote to memory of 1784	4024	msedge.exe	45
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 4320	4024	msedge.exe	87
PID 4024 wrote to memory of 768	4024	msedge.exe	86
PID 4024 wrote to memory of 768	4024	msedge.exe	86
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88
PID 4024 wrote to memory of 4748	4024	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://robloxfreerobuxgenerator.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb527e46f8,0x7ffb527e4708,0x7ffb527e4718
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2284 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=paint_preview.mojom.PaintPreviewCompositorCollection --field-trial-handle=1980,3919686949025922958,14940209766255057383,131072 --lang=en-US --service-sandbox-type=print_compositor --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b1f40e0d6ceaf161dfc1dfdddcfc44af

SHA1
b6557a6331b4c54efb30597ad4da0be03013a23e

SHA256
065557e5cddcc8022528dc82c5fd618ca28c153d6e34978d2ba84d33227eed48

SHA512
0d7fd3eabf2d2b426c627531b29e433cab175232c169a77623213b7b9935458b3067a2860137b030235526e49ca4df6867534135cf9da60697d6fa43441e7818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
18bc1d880e1a43364e572a20540c025b

SHA1
93b7043da91e7697d7268a52ca9a434a55ddbb75

SHA256
11fcaea6cf095ba038a344829e699198e7c981149f15e30a51229b8dbca6937f

SHA512
3e8ca38dbd4d9aa865fdfa359033fb47f581b93842f1ccb667f243cc630bfabf8390cbf8ed1de6110b18819f0d831312304806667bc68fdd13ea1bb09b44742e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
72aa8d29e6b7230b2ee589d92958dad1

SHA1
d6381769b6a241761bbc37d372d2df0f49d32671

SHA256
4ae0ad3d58306238cd38195258c46c12dec1364b467469f20f8c4eb97641ce28

SHA512
74ddb8f9322a062e87174cef0ef2e9744783cc8c23b77bfa834d7b0e1165fccd47652beea4f3f543e968ede4ab2ca151aa50a7fd3991f065439af9ad883c009e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d976704e9dacc1cc17a90025f86cf662

SHA1
f6833e0e66f16f198e38a90ceafd4279fb02b85d

SHA256
7e53b00c59a9cbdfdc74a02e6c368f271fd2ab92fc8344baab9f745b4297636b

SHA512
9d944ee669211bf81b5cee2bba17b7e942cd8248ef5f20c2bafe480dfd516ddb2884d654b2d52a6972478e571c76a0e5f3789be46b96facac62bb387f4cebec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a2bc45452664f1c7dba1323c0bc364f

SHA1
ada251ededd08cbcac15d2f0cafcaf3138cc0e8e

SHA256
828c6ee981e134678c2b42ee986e4b138a71f67064d3f099d9fab19a0e817835

SHA512
367dd823ccc13b612ba1e5064f7e2c175603d18ac5801775f89883f78e4ab8c9c144fa8975b324bfd013fd90c620b6adbfc903ed75d3bcd6ad5fa37526911d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
121312c0e61761ad4f3065da0414b9ec

SHA1
bb1be1c48693214b86cb0a2555f44f7e43eff9ae

SHA256
47f6201f0d97567bcea20ef88d64e8b7eec14c4d3fc2def3c478af087e6348e7

SHA512
d2c330eb25654ca721eeb42b8df5b5d78269ebae2d7e00f56db4c17b33bf49cab408bb03c236eccba5174779c398a737a84b516241112b11f80e33db79c27687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c46304e9e61c69f3de1ffb25c4bf7e5d

SHA1
47ff02dd519ee99eab199f2fb7a6d642d18e9a7e

SHA256
e13768b9081f6103a71cf51b1be4f64550ffd6220b4e367b1d3020b8d19aa512

SHA512
3e0db9abf4fb03cbd56a86d78001f2b06306d6266ea3fe5402dd11f0b8d6b844924b33d9d6acfc5bdbe07208892e118d0d5a7116f58adeff408f7ea7cc8e8393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
fa70c490d68a89fbe96653ca333e9ae2

SHA1
a235336dc0b8d0d7e6ee0fe1077238b8d42ae3be

SHA256
8768a9abd7cbfb8de513d69ccd910c1901aa42b810c690d2529483278cc21219

SHA512
a592509cc137e67ab89742caccea2d71ae73ea843853419aa294c6b2240e96608fddd02e4d98ab6d2e60a7414ac27a48322352e76399eb124e15d3962d13e982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c081.TMP

Filesize
204B

MD5
06870b9ffdd0faf87c7f2811225f51e1

SHA1
4510b99db39f66f95b0d66394bdf5af2b913a828

SHA256
88eacc229158a7b669a2e39e5fdbe7bad645d34686df2df5b7b4c902de9360b1

SHA512
1dc6a57701838df35fe7a7e2b8d875f4aa0c860c22c8d2c23042f122780a87a278adf91148516f8138ca3a071cb6b5504d03ec27a59198116c110ef200e84091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
990779c526fff84668fc76d2b97ed84d

SHA1
7437a26cfb399d406f7e114796f74c5d4063c778

SHA256
0a5cbb79791529a9e1d5598708d5dafd9c4b1f8ca30530894f485648a609a8c6

SHA512
6572a0d5e0d0143612f30a660521f766ece857df4b73a7ab771fe4abef7aa3a1e5a0fe66414e7d92e3b19d247521b669b755f78a4dd10b8ed457a5a559bc12c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit