hxxps://www[.]roblox[.]com/home

Analysis

max time kernel
480s
max time network
485s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.roblox.com/home
Sample240606-dljvmsfc8x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
1748	msedge.exe
1748	msedge.exe
4880	identity_helper.exe
4880	identity_helper.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2404	1748	msedge.exe	82
PID 1748 wrote to memory of 2404	1748	msedge.exe	82
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 3972	1748	msedge.exe	83
PID 1748 wrote to memory of 4432	1748	msedge.exe	84
PID 1748 wrote to memory of 4432	1748	msedge.exe	84
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85
PID 1748 wrote to memory of 3248	1748	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/home
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92c546f8,0x7ffd92c54708,0x7ffd92c54718
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5240334460350225522,6407975772176028529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Size 230B
SHA256 7a06c29602b8828f8a0ea2217a0b7170d61fda1cb59bb29144ac9eea0238a62c
MD5 87d8c0144a9ddb4fbbba3d6da728c82b
SHA1 1775c3ba9886363993b67acbb08fbeb5c1a1c463
SHA512 289961eef4512e6974ae824a4011d99b7dc995889c4f31019f15740f1afc44dd2ba51aeb83c57cbaf66284605f262df16f6fe31104c7bac8661b097c8485ecc1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 46db84afb23c112f6e345227510d4d5bd3ce39186f4cbaae73bdeb07ba86a7f8
MD5 5d4c82ef792684a1e7130dd804719246
SHA1 0af4ea277b3c8af38b95c5fd88117bf12d9f4688
SHA512 917bd73f8a230dae64df7b647873addfd13049580ad6fe7c97b2d41672e38382395b78e36bf080e46aac0cb355c41e8d4ffc2309cadfdba52915eb0580879480
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 ef37650aa0cd10dd317064f354b5d9ba1217e51a33e2eb5b3d73a55cbad588e4
MD5 65aa56b864b66af90cc38a16d0da98f5
SHA1 cb51adcc7a7fa8a32dde4db8d895e0a535eae318
SHA512 d7e062d6335982a81549de95f6fc552aa3ce271ad5136d73dc5ae7d42e5c9a09a4c757b0c170b84a998a00b92e8b7447e7bae27f146226f90f53ba49f26708b8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8274cc966c88510cc1473b99c7608709b393ec878411c03a41b51ae15a2eedc3
MD5 76fd339425686cdb95d3b13342ca4904
SHA1 63ea19c512134eff64bff6a5c44cc19a43125f0f
SHA512 04e64fd0fbe0617ed595f08a6b1133e3a14f172e88474052378fed2a696a665131a8851f32e0f992e967a9b398dc27ce083e54c66d72c4c2ee900e0c06133842
SSDEEP 96:nLmkfbUm1Fz9wpvWMoiVmdeCuN1jpRH5PUWQyV+VD7AiEwb:nikxjz9GWMyuNhpvPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 67512413f3e71d4069a96dc07ff975b37ed9fe514bf4eadcf514d5070db717ad
MD5 b049111e23ce24564c179319a01c732a
SHA1 984827df1ff6f4f72c2e6fdb45c64e12e01dfb3c
SHA512 f546940ed3c12cca1424f310870679f69d6d7f5f2a4d37763cd65945c137950eac4937c875467c3a2a03c4d70e15a7885197f7e3034c604daf89af41869b3280
SSDEEP 96:nLmk8bUm1FD9wpvWMoiVmdeHpRQ5PUWQyV+VDCziEwb:nikgjD9GWMXpIPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1f18c9e5d421e9e3c065d72a5ea2abb022d9e126fa9bdb49c629d78560932d60
MD5 cf5474ee06fa6cfc0d23caca546d283f
SHA1 7905f3c6264028086530bf1a8fa4955dc5a91070
SHA512 7ff55f8aea4c2b31d83170ec81c49e8b1352c51a32035af8ea073d78e3f454cb583accf694d08226d3201acc3d6705e48e11eb7f8fa484eacc39d2fc1db6b59d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 5420c08e2419343ab59cb29fe0c6f7112dc10d869b6c6fccf5bc513734144be7
MD5 ecdee55046f7a1cf1a9872206e33eb24
SHA1 2b9aa89fe5c59dbc6bd74bb4c4eb7649ba917341
SHA512 19cc08311c962efa6ea4ac26b373722e6e8dae88674db26129162e6cbff2f0d68e0b0313dc9b84363d75478bd45b2527867f1b943288242aeaa1187ac281d786
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f967af3e5b25926662a1c0028bcae4f9f421abecf089fdb54ce22ac530bd2e76
MD5 1ccf917d6d14913dabd90b5c17366001
SHA1 8900b738dcd036ff8dff2154341010167bf325d8
SHA512 2667d1038c7c547fb115412ba5fa67848aed6159d6e6d052f66f14f9a181faab5e21b5ec86743d815d174168740f85a11019979939fb794b0188497143ac2967
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57cd52.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd52.TMP
Size 1KB
SHA256 2b5c1a33313e08298e6dd908597b2bd42ff31b29c610e5acddab65b39cda982f
MD5 09661358150eec7af7e442cb7efddd67
SHA1 f26e95e7188cbcf5008f0b0290d3f2ae0fe47403
SHA512 d408d810f1fb1fca116ee9da746ae8b11a3a6b9be7bd4197f2a613202d0a2dadb63eb11389677a167f324621e3b6feb92cec227bb8067dba35faf17718a7f51e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a5fff029da580a913cb37e76fdfdf3e976581dc0685adb4bfd42abc40b1e0317
MD5 b66c076b912a0643a39b85378470e3bf
SHA1 5a0c34520d8761e61ce727aba6a469f88cdb3fee
SHA512 ca4b4002c4b900bb5c4dd9a4bf1836e03202a179f3fd9789871d93cbebf154e5b82b10d6ccaa36998e34cd1a7331da86c7e6d5ad5a078a3d542167163b79ba82
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupYavhe2RUCqTM3z2OMDCRHr:A9iIxuERzA83h09RZxYYav1YMaOMWRHr
MD5 SHA1 SHA512 SSDEEP

Submit Download