hxxps://www[.]mediafire[.]com/file/mzhaftj4s3rh8nq/ROBLOX_Cheat[.]zip/file

Analysis

max time kernel
144s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/mzhaftj4s3rh8nq/ROBLOX_Cheat.zip/file

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ROBLOX Cheat.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
1360	msedge.exe
1360	msedge.exe
4428	msedge.exe
4428	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe
4416	msedge.exe
4416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2036	1360	msedge.exe	81
PID 1360 wrote to memory of 2036	1360	msedge.exe	81
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 4312	1360	msedge.exe	82
PID 1360 wrote to memory of 5100	1360	msedge.exe	83
PID 1360 wrote to memory of 5100	1360	msedge.exe	83
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84
PID 1360 wrote to memory of 2740	1360	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/mzhaftj4s3rh8nq/ROBLOX_Cheat.zip/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbbcf3cb8,0x7ffcbbcf3cc8,0x7ffcbbcf3cd8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,18088398531406173718,18329352310643632865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
20KB

MD5
6931123c52bee278b00ee54ae99f0ead

SHA1
6907e9544cd8b24f602d0a623cfe32fe9426f81f

SHA256
c54a6c3031bf3472077c716fa942bd683119dc483b7e0181e8a608fa0b309935

SHA512
40221fe98816aa369c45f87dc62e6d91fcdb559d9756cb6a05819f1cde629e23a51803e71371f4e4f27112a09489d58ed45b2b901a5f2f00c69c082b3576057f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
25ad7f20a4ca9815c333d0ed6dd7117c

SHA1
ae29790856030e20d3f1d4201eb0c8d5d801c1ae

SHA256
246fd1e1738efb361b37f651112ac507f863ff5215b5d6586fb877758f68948f

SHA512
7368ace4e3b65e4b8f4cc538e20b41a7e9d3f3a811a85d3ff5ae08631a4c03bd2bd1a745a1f8eaab7ab5054ab0120ee85400b86fed7b720a562c8e8e57b93407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7c55a1c51349df02547e88c9260fe1f7

SHA1
360f63d8f80d5d5f85ee03b5d336fa8e6c78e895

SHA256
76375348f269cb2a562a428799c092f4c961358e0c092dbe66927ba79124b0d8

SHA512
68ee5b9ce321e8331a3245eb007136d442b7d22aa298030985ac7a351f50dd3c58a0f073de9cff487551c2d37532f60b43634e31007d5adb845081663a5e0fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
21fc574b1ff78811c134d28e74e51462

SHA1
513d36685443d492355e9f84a0ce0d66df3dd844

SHA256
cb0e5291f6997cef53f252f636446b7aa51ecaed4ede2ed542de959a4fb6154d

SHA512
db7fdb42dcf82793311b50846641a23e2e17b821f0394c08f4f60e6671ccaca6a931283dc2fb0d2c31febaa861c99a143cf2bd8acce0d7fc9b806acc348e18f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c4e7179e74d27999d06e83c4b3c72c5

SHA1
5cc61fd5bce533b9be60fd1dd3c7864a0afd13e7

SHA256
7465dfaf071c028eb582b37a9e6f3029a2780387a2db458331b8de07151877d6

SHA512
f1e11ddf736b0d096fe32a1d72d5ce9a5ad90969c5057cb44826b08ec59eb3b714b89d843bcc6548a7c8c2590870743cd9a15677197ec22f3882676ca18c8333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
abd310af4b6a08f4e3470090ac3eaa3a

SHA1
e4d84c05f37b68c8203deb4f6d36430f7f36cba1

SHA256
9961ba51e04a56b128abb74d3f61898b708ab823b87d486a025c33cedbd466de

SHA512
176ad2611da056cba16afd08063a2e5a318787c00184db3daf9062f6f536b151c211a3e95f69f0b2af4887eb2fcd27af00fba0e87627f106e5510a263db80efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
11b334b39b7aa7b20cd9134095afd60c

SHA1
e18ad012f47b3f80ab2af5d6d34efd972b4fb646

SHA256
fefb50922b039285757079d587877cb78424703ebb4d3b539bafa5c945428cd4

SHA512
a7c77a6cc021801035375e722bd499c3b6e9630fca88fdb8a0d470289691c75dc11b56e5d71b4fa33a7015740cfaa35b09e62b5a74a42fc58601b7ba6c0fc207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ee4da8acf896a164d1a582bd34f37444

SHA1
07151527db560f6a839cc4351396806d1a65adc8

SHA256
b70bd240b88c7faa9f6e0247af161f2dcb4bcba9bacd388711ee664cc46d35e6

SHA512
2055d38509c7ff6403f700c052d91a224992b0ddf4ef88bb9c0e28616b27d1641f001acd565e16144b813a3093b53adfec0a1b4ad70cef53c6160f04472c2423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
565abe2d58b2d99354d32a07091b1c8c

SHA1
0c0ddb6e831b78ad2b4da066247919fcac964b0c

SHA256
02e140b1680b246eb8041467a85ff8818f6e95087adedcd4d3a76886f843f597

SHA512
1e74dda56c72cea787264a6eb9a7ccbb58b5ae4c7ed6675619c32f2b982879b34ad6808ff236f278b8ffc95422fb516339dab524420efc9591ebae6e47d64f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d34022f723b9d5cf542323812314a673

SHA1
dc2987b6c9f1e4e2a62a7e06422edb01a664b377

SHA256
6e4295dcd72bc699f88b5b9cf9bb49d9b7f185003bc5bfa12ee7cb888c3769a5

SHA512
bbea3222e3c53194c4390b5f5257c22d8a12e7ed07f1ee43421056fb6927d7586762e282453c15f06cb45cea820af9c2d1b097ae1408aa31ab44c454e1e525dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e74e14c87c0c3f232233983a947652e

SHA1
734bba54c22dd6ac4e128abf78eadc8fe5798feb

SHA256
4670d77ac5597db98e2a91c37201ced6c2083653b5e37a82b6247089cfd9d317

SHA512
a469d2c51680bc4b172ab7bf379b383a0fc08ed6c53f2081fbf92c91add34f942e0996401579e10b7c3279d459cc624abd54c42a496098411ec533808e8ecee6

Download Submit
C:\Users\Admin\Downloads\ROBLOX Cheat.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit