hxxps://www[.]roblox[.]com

Resubmissions

25-02-2024 19:10

240225-xvpl2aah8y 1

25-02-2024 19:06

240225-xsjm1aab76 1

Analysis

max time kernel
1172s
max time network
1178s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.roblox.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
2524	msedge.exe
2524	msedge.exe
4152	identity_helper.exe
4152	identity_helper.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3532	2524	msedge.exe	49
PID 2524 wrote to memory of 3532	2524	msedge.exe	49
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4120	2524	msedge.exe	88
PID 2524 wrote to memory of 4836	2524	msedge.exe	87
PID 2524 wrote to memory of 4836	2524	msedge.exe	87
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89
PID 2524 wrote to memory of 4352	2524	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8df1046f8,0x7ff8df104708,0x7ff8df104718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9415184245432062164,5126880185667614196,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f0ae8c2245bf75de2194fb21d1123bac

SHA1
819bec9b8d46f2a6261952ed9049750f9b4d30c6

SHA256
89c0f5cc4dcbf54cf9070c400a333312f3171d805c368e6b79cb93cfe9af1f38

SHA512
fd412aec5b23b2a94a7cfd174240e69b9fe67f068593725c4de47ff83c57fcab716e1466e2eb526dead739f1c3c8d493b647ea6aabbbe338c875ad668ee7d416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
851B

MD5
976025fc7cface7e9f622f64fad9fe14

SHA1
6d3a6a458a1d668c004f44ff16b33425106dca63

SHA256
4c9d3d1ff81c71088fc8b63e8b1ab7c80962045a718369c37c81ad545163f643

SHA512
6bc1b63c3ba00e64595ff9979762faf1c05f594916472171151cc1cd3129bd123777a8e3cf386c221f90e0b360589c6ea24f60a7e4b6d3a9416a6829222c0880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0dcfff5e65cd34c78a1438cfdd5ad4e

SHA1
68d0b75957c93de67d5d3ee9c74d3f23e407bf9a

SHA256
dd3dc29025b5e4791490a024014b13d98cc634ab1663efda504b93c52b173cf2

SHA512
7889ad393de8b420ba4313ebe101ea1d1e784bf24a1235bc5dfb6b8eabf2841d85933489140619cf4314def9462dc42e4f87c637446644cbf93727fca3ef4e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20209dc6042ffae5521a56d6a6eba2de

SHA1
3a3cba7d02ad1f4f8d1fc9be09e49c2e7b439a0f

SHA256
4a22ff28fe52ae93f72381ba01e3d194334b786cc7b1ff0c01358d0ba257a295

SHA512
1eec7a04fd367ccdc6008c92d381ffdf5d5e02178276743f951d2eb9ea335381b2922046afa8840a7de2efbc1af643fd681224cf75765fe6cd31b6faff6969d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fafd78aa1acd03ac7ebaba4aa799d162

SHA1
5b4a40295873bbb8596065df29c8f797f0abaa4b

SHA256
769ee378205e6b34d527f93ac22232a2e28ddbf87e7b7acf87d13fbcd599896d

SHA512
a3bbe1f02a5aa2fb02fcbd129ed97df58092e2106c59b2ed2b7e25b95e7c2466cbe98ec74883d8b837babfae18d013ccbd60e7c6cf60da9c8add1e8b8192a408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
83f84f6f31c9be1c4a4a208bf990f181

SHA1
8dc492897c6cbd25f772c3693c1fe844baa07ae9

SHA256
cde58d2fa438ca649105f42e6c8f3d89c1790feb5c427f193aa291c4285b8d3c

SHA512
f77d76d3cd91fd748fad48c877933ec2887eda312688772a5ce80ea496361ddc58a72800a5d9044ada74c55047d2ce1d5a1996b3dfe98c586e09ceae7d1629e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0617b962b41758616f48e74fcd248d34

SHA1
9a8a801622448fa3d6ab6af6c492fe43da4389ee

SHA256
d05ae9796b802c6b9997d8b658df543c9dde0d36ef6f27594980006a514acfac

SHA512
fdabb733f9d9715aa004895ba44ee868049760ed50f1b1e355674cb41ffd91b154297bbb2fa34fe874fde0989a964472bf9a461ec6e6920775bad70f27632d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dd12.TMP

Filesize
1KB

MD5
783d1f11850895470e487bc1303b095b

SHA1
457ad8a12a863a7fab994f232b18792002ead80a

SHA256
7b41f594f4cefd44f39ca5479214ad25e428130eff7ce86711776e175cde7f72

SHA512
e045eec0805f816e8a3e89c70ec856d010c3c170664cc8aac6cadb18c11cf604e1d83be8070b702c0d36ad9fa5a80a9017f761fd59d5046ff82fcb8c93727b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50d269ffdb55952822da82213617ed9b

SHA1
aa416fd7734f586596a2abcb3b6e139db7557d35

SHA256
9c8743bd6b4c357e7036f280fd370495aa5efe445a7f52fa46df33d134389d25

SHA512
50d8ecca65b76cea6b9867e09717e677a3911f7369590b242a978ffbc21a6753cb984d3ecff394cafcd35628e80238bc703468a9bb323420e395f2a7eafebd33

Download Submit