hxxp://roblox[.]com

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07/03/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com
Sample240307-c8phzade69

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
2588	msedge.exe
2588	msedge.exe
896	msedge.exe
896	msedge.exe
2140	identity_helper.exe
2140	identity_helper.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 5056	2588	msedge.exe	78
PID 2588 wrote to memory of 5056	2588	msedge.exe	78
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3132	2588	msedge.exe	81
PID 2588 wrote to memory of 3116	2588	msedge.exe	82
PID 2588 wrote to memory of 3116	2588	msedge.exe	82
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83
PID 2588 wrote to memory of 3408	2588	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa2b9b3cb8,0x7ffa2b9b3cc8,0x7ffa2b9b3cd8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14401680589921486474,11723590938324368516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c
MD5 96899614360333c9904499393c6e3d75
SHA1 bbfa17cf8df01c266323965735f00f0e9e04cd34
SHA512 974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e
MD5 19a8bcb40a17253313345edd2a0da1e7
SHA1 86fac74b5bbc59e910248caebd1176a48a46d72e
SHA512 9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 537144d8e84aa2fdc17080751f981a657f8cc33362bf0370bb3111018d4fc247
MD5 1aaa8222332aba1e320767929a948ebc
SHA1 35638fc897fa0154a239e11e45f60e8405f25df7
SHA512 77e8cac8c7f670b97bba1cf9025f65092e111ed5d0bdc8605bbf6aa5690ddb739d9c78495e9febe6b66877ddbf62392d676ee385f5de74ea815692f901be9d6d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 846B
SHA256 6d487bb3763fad0603e1e7c6d8c164ee2f9e62b5fbe232453b3e8fea85f54094
MD5 7e1ee0c4a187cfe0076093ae4e09652a
SHA1 d3c5b318fe336debec30bef4d85fd7ace85ed2ee
SHA512 42f1ad3e1ae2c897b8236c4366cb505551745311b2691bc354d3fad15aa7bc5fd6c6639fc4453a8f82472f8813aabe0e7c56c033778c59496ca67368d8daca1c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 31d3d0ff064a5f89579aa9685b6c9c94beaae8419aa68525b3013b3d6de534e1
MD5 f2b20a0cab52e6064458a9f1661a0a61
SHA1 5e4416b84b4abbedf89dfb158f3d61341852e917
SHA512 783398839249d699f0298782be8cd2153196ad704c721b6977b74ccddaa8e81b641947865032013a8b8f4188060409ff3c2617cce0fc3bcbaeb71976763f7b52
SSDEEP 96:nRk3VUUVk3wSv0MoiVmdHI1nJJkWwP0WQyV+VuziX3wI3:nRk3VvVk3v0MAI1JJkWwPLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 07fa01fda5eed1fcd71fa69a0fb2561641e8be68be142ec486d29ee556604c41
MD5 e408f9687cbe7906a0e6068430806faf
SHA1 bdabab235142f0775f8bd2fff59fa43bd52a73bb
SHA512 5940b7c4bceee59b122a0a014e545a7677afa32153824fdcd0340b6fa9d6d0f3441c22afe85056bb83fa8bfdfc7ec6df9846279ee438a467c99e9a67e0cfb791
SSDEEP 96:nRk3VtUVkZwSv0MoiVmd0uO1jI1oFJJkWwP0WQyV+VuAiX3wI3:nRk3VGVkZv0M9uOhI1GJkWwPLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 aeb3c0d6f8aceb7aa388ac7dedda2e0737a304a80e9d05ddfe72543140952630
MD5 c7f5f709daf4bfd75090711958bb8dee
SHA1 fd443527661ac7be8b3edfe60699d8969f26bdf6
SHA512 eb03694d5df65e4315b3dcd0e80ae6041bac6f5365ebe8a6c6f17bb8fb01f4595013b3a18af399a4bc17a093d11835c1a8ca6cbfd28c0c197244f437d26d24ce
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 5f24a1bee201c8479c102743296916efa2d926678e3ba5fde30984a9d649f797
MD5 a5e85f30f2c7fd22b7266f2c20a272b4
SHA1 f6549549e187476e6bb7fd28db39ce0d1b52b7e8
SHA512 48ed7931894bc2207ca0ec183e9a7846c3f2724f4d9176450ef3ebc417d251ef811be422ce7e755e1c1d163bc0373fe9782bb40a2e69ba989881f2638a49b516
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 10d19ead1c2d0aad5ff5da97d188110913581a1f0438e63c6f656baa565f5278
MD5 ca92d78ab12800c6760b43d81f16bd4d
SHA1 9b414ecf008a510ab77435d64ac21a455ff8c3d9
SHA512 03cffbe6d86626dc2fdf0dad8b6a1e29fe742d43e6259edee1623cf565ab8389cc241dcba8a8c637752f02b13722c68ec7e958e00a2f67a1e879613bcd894aa0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b064.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b064.TMP
Size 1KB
SHA256 2c9090c6315cb3c8069d359269823e7179ceaea9de7ebd959377c46a08d525c5
MD5 e68c5ac1ea34b74dd0af9b29fbf4bbaa
SHA1 210a7fc30b81864f6fb74313ce61004f1c5da910
SHA512 f618032346310f1cfc0b9ea54c57fe374b2c06ba014ed22ca70ad96833632d18cc0f66ce6b7fc3edc851d7c3c95c6f17aca88982336de04aea7746c68d440e9c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8b87f7322fe82d69f0285cafd0b61a92327a15fb9c23dbf3f6775c91d4bff77c
MD5 5c6a0cf7a103cef95e9e9530c8f6f91d
SHA1 577be1d53aba0f12946887cf7d3eb35df310d02b
SHA512 a19ad98d35faa545b7aa4ad3e3ca92166412b46df3ffa8af30047c40b124ef337705067205266a84aac434aaac14352255c18718ae6fbf112557f99b9ed018d1
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3rzF6e2RUzjmRmY3XE7Eu/PgQu:M9iIxuERzA83h09RZxA3HFUmjsXE7ZPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0fc076ffe511af99a3c31ba4234075a91db38cd5a0e6fd9434f0341da21f517b
MD5 04c43e94c603963c4a984007e5b60a9b
SHA1 fcbafa5dd8e12451829be83646bbc2fb1b1addca
SHA512 f8eb5c1a38a0cf6a4a770d2f18a6260828c4a821e9f7545a3cfb12bc60a19afa4dd915578fdf092d349811c15a8fc7d2c47f1b63b36b60c149d3285fe4d05475
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGFzF6e2RUzjmRmY+PJE7Eu/Pg:M9iIxuERzA83h09RZxASGRFUmj3JE7Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download