hxxps://www[.]roblox[.]com/users/1199551040/profile

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02/08/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.roblox.com/users/1199551040/profile

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
3396	msedge.exe
3396	msedge.exe
404	msedge.exe
404	msedge.exe
3828	identity_helper.exe
3828	identity_helper.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 3768	3396	msedge.exe	80
PID 3396 wrote to memory of 3768	3396	msedge.exe	80
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5020	3396	msedge.exe	81
PID 3396 wrote to memory of 5048	3396	msedge.exe	82
PID 3396 wrote to memory of 5048	3396	msedge.exe	82
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83
PID 3396 wrote to memory of 2076	3396	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/users/1199551040/profile
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7fff8dc43cb8,0x7fff8dc43cc8,0x7fff8dc43cd8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,6148938466324817137,6685968718257583455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ffd24e2a84a655f049ba642312cfff49

SHA1
ec40bbaac2d8d23ea39456164d86b9710e96391a

SHA256
1213aec418000f588d8502f8130866c11d2ac773efe53c7515aed8dc9b4d04d4

SHA512
eaa1a006897963c52140352040c0d7aac9101f29a549022ca84b65694daf3b180f832290b8c52f1b6ce24365d12fe3659b110cfcaf8edb0401ff101e42b72e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ca88579291690ecc2d1069c6899dc34f

SHA1
10677b0acb6ec5dcc50f1024a7ec8fd8212b253d

SHA256
b6920a5b32e734a7aab6f5145ec0e8a03d45735e8484a64af12ed4d96c96af94

SHA512
876098946777e41b53966c0fc51754d7322c592a22b1675fb7b91fe18aa7728fd8eb9964d1352ccb44bbcbf328cc2110fdf5c560c0c90304c1d80f8a50d7e59e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
558bf60475639cf5fcef2f432a12a475

SHA1
d8e55f9aadc7d90fb620baad02610afc03ee39d6

SHA256
17ad13fa071ae6c1d8881e969b59f9d37b6d926d47cb2410874ef68693682335

SHA512
c26869bb5f69644bff6b897ed5778dd0bea39836234319cabf9951469b0f843c706779c1ec3e4228711c1d6e7ba2770e37aaf6f72dae26e2695c9668facafaae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d439b3014c00e0ae9056c4076eee0310

SHA1
6f6c7f671eca41dc7630ffa0f58f657a58cda1f0

SHA256
2b0c50d802904da9b29f0c451f4435b0cdef88ddb5110afb945162a6dc6456ad

SHA512
f17282e40f9dd5ff994f35f613e87344f38990bcfd13ea20f8f57fbda68a533d84f3036000f817deb9a6861e3507ded6f7f8762e025351d5b83aa05b54e6ba5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1807e53ee8533b8c041d801b4276d46

SHA1
e3512d7ddebe5ce9d522e3adb12fa8d167dacc86

SHA256
53cfb8722355d9d3a3bdebd5b2704b2f91d033426ac357a927bdf42d944ab0f9

SHA512
4db6256876fe1a3d86565de9c419f348fa999f6e68ba5b3e8aa06faf2bb98826c132ae5d911a09e5b311a9e21277d6908886a9c049a5311997387a49babd867a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16f831454bd7e461c02a9697375ea44d

SHA1
db3a5d1d736cc9bd2af41161ed078ac6699c0bd4

SHA256
5ae0a24bd841b5ab1d4ac037b7b2892494467de4a142790504d20e48c426cfb6

SHA512
9d156a5204d3d06d1a04bbc57538c366486bbeff48f4cfe6bda5ecbf8cbc5bd59169197c3b6aebc6ad8163766a9f7321787db984cc488fd2e7922454b29d789f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0c897ab3282527ffab691a834407ca78

SHA1
f9b60daee098d36c36b6a34571e669b057b4fe26

SHA256
2abeb27a0220cad70a1f82f0a6b7008d6f630864c9a72296f234d9e87e9386a2

SHA512
b5c30cd54117bdbf88e38441bf1fa024bad864425f01383a554954799a5a3a5591bf1443b9615716ccf67fe10f9378e7cda3980f8bb682d2f6da19fda585d2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
82930c131dc44a3b63d4f40fea037224

SHA1
9eeefc416bf1e3ce47de33101fc6a5d5c4ad1eca

SHA256
4f96093aa62df1d66d73288f630ad0371bea06a62fd020c909ed74501a8f73e1

SHA512
873ba8ff916aedd77217a2a8854e5b644ca8c9f199431ad9ea0ff94474eba58732ad6c2acf64dffe06be8418b225945c387dd209eb904f3dd68af824777878f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cef2e6cdc9d34e4c03d5bff5be52b07d

SHA1
64ffe06cd63bf01fd76dae1d61556b2873d42a78

SHA256
1999cc48c8e74bb7b0c0e97ea7a51d243655a75f102b379ab4bf1d11a24fe29f

SHA512
5c4d6586165593662df78310f06d7d699e9f7c01fd63e5848dcfe3e6f1e68d1066a17f2d4694abd3d3021729faf793aeffcac488ae036f5049d404924bb64f56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
76a4891f08d0399a8d0e2638cfdfe32b

SHA1
a681d4637529e6851dbdd02b035b0d8cedd3292e

SHA256
2b609b12f68adec00baf3a503222d26848c11664f9bb7377d840e54c55804e02

SHA512
b999520a37e0a0e8b050f49b9b3e2c7c25fc10e157a5512d8d9eb8b10953e16a7e511a340172012c01edaf432b806333bae4f06c610374dac9d68aa8826e1b0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
01bbba306ced9fde3bb0c9f6b0cb53da

SHA1
85f1c53422ce65e18dbcce7ef07882557a8b26b2

SHA256
958ac62ea883d79a28ff794ae8fcdd52867b3a52ec3d3cfc3f7695015fccc214

SHA512
67694071878081e5e8a4fe3a948a1bf8ca431946cb1102bd0373eb3d4fdd44af54bafe4e27e2e0298cc4a837502530b66f6a3824a092fb51ab635865dbec8ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58002a.TMP

Filesize
3KB

MD5
5f6af4ebfdbffdad934f747fb55af9dd

SHA1
4b5631f0d2831e7ec92ecde84f0a684e23cee630

SHA256
c5c5a0e798e6ec9d0a6521e82d1a5fdf5154187fc7012f6a270c0ee4e28ba800

SHA512
75411a0c8bbb1a937043cb6cea3801c52769316e1cb8e1bf3f055767d56674bc811af07d142753dee2b5eeedd9e399d45a6ba8695c6e816d39af276815a143ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
923b988a44e00a57b89702a372e913f1

SHA1
29d015acf7cbecb77c37bc956e9e472359f0a8a0

SHA256
4662101d49eb9c342beb0969ac431fe8f5f341413ddb1575fad50b0f8c3719b6

SHA512
d5777e232c42b63ee0437be3ced235103cd1bc9f8d055516105649bf91ba06ac59b58ab9a3f1242f8cf4d732b63a5b7ba55f52de338daf662e84c3e577a5cb5c

Download Submit