hxxps://roblox[.]com[.]py

Resubmissions

14/06/2024, 00:55

240614-a93e4sscpj 1

14/06/2024, 00:51

240614-a71hqsybrb 1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://roblox.com.py

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
2660	msedge.exe
2660	msedge.exe
4560	identity_helper.exe
4560	identity_helper.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1372	2660	msedge.exe	82
PID 2660 wrote to memory of 1372	2660	msedge.exe	82
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 748	2660	msedge.exe	83
PID 2660 wrote to memory of 700	2660	msedge.exe	84
PID 2660 wrote to memory of 700	2660	msedge.exe	84
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85
PID 2660 wrote to memory of 980	2660	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://roblox.com.py
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf84646f8,0x7ffdf8464708,0x7ffdf8464718
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1488 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9349173617490752277,16841132454553050401,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
4c96c2d356a8b35eb38d08b629832a0c

SHA1
4549349b0e0c000cc67adb49d618d354d24b0daf

SHA256
575d31174d6178888aa59596f54ff70f766bba2d698e715b97be720b75a51011

SHA512
2176d96a980cef93e8054689aa733ce65d23efefb23dfa7164787b22e859c1858647c498c776ac5ac8a883b580d90ea73a3ce4bcb3352a78744069a586ad2f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f330d1c94f9c95b87c946e4a53770d92

SHA1
6490f78074e103fe55ce8e4ec1d428fb3a797ad2

SHA256
6bcb08bd0d9971f82f9cd9e76f5f19908be9666e83c999beee653b1eef6eedbc

SHA512
d9bb7c6deb4d866eebda81165a6047009e44cd3295fe7c427a641c493098134db5c58a64230b78cb57e1c229aed811c857cb4f1896df63d8ca84acf0afac28cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e271b955271dba6f82e9f4097bb152dc

SHA1
e61fc463835d40ae9b8a4cfaf35c5b0e738157fb

SHA256
e67e11a6b0f22dacabe4e3401211b4526a17e8dbb68458c0cdd5cdb78cf3ed5d

SHA512
00a73b98e842774807c08edaeef9ab96b9d85335186a719552ca093545acfe7cb2e249371eeaa0678df48e261c724e840027ea989e8c90b9f1e6a5d2e13231b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7db3f7bb38c1d4a745193807896009bc

SHA1
5dd76c20233edb037bc27d54f7edce32338e0dd7

SHA256
da7ba20a843e51f8c862a74b2096a2469dd389169e72f4866e15571c221f440a

SHA512
64e5e4c70cea5fd8c64e182a1bf9f7126e9c749825f48742099237c57cb71bbf11921af1fce3f9393c564af2c80cfb42fd46d9e0509c08701b6822cbb8632f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
772ff6c0dd3181ff222c8378ba969467

SHA1
60faa2a675c2c7f6e88ca56ec5890d521a921aa0

SHA256
983a12c0bec8068e1753b57a22064459b834906314263aae23f22a06c7b3da77

SHA512
9ec3fa7f109eaa322b84f165333f15289e0edf0d5dba15666735a298477c1ad04fb5c4382196d05607f217e2d24024d347f6f9c2491e2b24cd56c6dcf93f078f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
53de4c0f01159f1355fb6e430323137f

SHA1
04e0d85cbeb84641ac33f3c11712c2dc0eaa92bb

SHA256
4a14a527388916ac10882604daed33d810614b4c47423012399318115d469ee6

SHA512
931f6c00370ddd847264628476d4c42b54290cb7f7d50701b6013ef5cbb68b39cfb93e5d5b777f5df7d72c0c94c5ab255b62af139b18c16903fea6a1bf1cc487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0214d23e2d803d7984d71c5b9568b074

SHA1
5cbf5a3da4c56ec7c146233337bd9e4ceae4245b

SHA256
3283fa0552ecb76f8e0c3597e02febcd3a05fa167d53c9ca2345b9a2d07e40b8

SHA512
dc1a6ca71689eb2cabb081a5b935da93d4b03466186b24247e8d4782b28b58d8c94a010f10145475a7cea8e7970201eade975238c012759953f27e54adc9cd88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ccc620f98016075884237b5866213f11

SHA1
218b3b2002a7bcbe6723669a20e1790439256d44

SHA256
e8dc586a2aa3153fc5d98d260e3174d2e7bbfa99144325b797d0b017951314ef

SHA512
bdd0b21b05cf5596b01dcc7444728a71e2c43d2be28cc9b4fd67221279590bf1a10c9563447780d78d264a92bcbfc819b852df4c301325e4039c1c3cda530462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e6b35b3328a778ab9a1705e1f6817bc6

SHA1
32a2bca93303bae96f971b0049351548bb829175

SHA256
8ae4165db569ffbd9a81e9e5d5c72ccc5d03441d4005a6b55ab9249ed0453ec2

SHA512
b73dad79392c7eb54f8f855717340e0836d08198f34668226faadd15c0fafb263aadaae55cc3984adea650a69d4b6040254d62dacbf981d46de050888fedb253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a81d701b07b582730fc7ac369de13e3f

SHA1
c071023ae021dbde38964c0e6937ca585a25d4f3

SHA256
e245df0d5483d3731306be87f92609a388278ce9963f0bc854cd5bf45d7dc0da

SHA512
61ef2a21e1e4a770d4d602d15298ba359998c50ca497f4896ee01388c15f83f27e255ee1b177e0043ee4d2a38ad995c20c5a6fd43d804f49a3e3fd3b7098f502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
788ebfebd63ac56e1e952a3eac8e26e9

SHA1
d767c59b9ae553fef1c2b1bde25ddbd5bf217426

SHA256
fa7e950c696b1042bebc84ba73f68a13ee19d690b33bb201ae7f12407b058b48

SHA512
f2ecc3e1618c97c46275aebc84d43e08ae0e892ccb44f4ea15f10758ce92bbfde73c3deeedaec78c987ebd95f891130c821dd32f09eb6b1138387e76c80976e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bf77.TMP

Filesize
705B

MD5
478a3239802afde8ee88a7d7db31de89

SHA1
5b2bd56792a98d214e54f03316c6f2a3757a62eb

SHA256
c2e6973b621e6332741a05b845997ee2218fcece55081ff7092cce2075931367

SHA512
edf26c58a2e67bfd17ba43d485f73ffe122eeaa9b412ac7b41a9811def393e9f2d4b13a684725b2c1638b5ca6c9952f4e4ad0a1e034a8867df7fa474f4aa85c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12a71c6e743159ebabc1c0f2417eeb93

SHA1
7be653e004308a72c414e45cc732faac8b7801d3

SHA256
8751f754360e1a4c1b758347faa8602bde5422a9e864cd789ee9d9f99480e08b

SHA512
0069b62d745c6c3760c21bbef00daaaecab1eb70835c95fa1894d490c29981502360593c84357cd343da8e71f52c442098c1daf297b128967f621c11399d79f4

Download Submit