hxxps://rule34video[.]com/categories/roblox/

max time kernel
112s
max time network
117s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2024, 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rule34video.com/categories/roblox/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
3976	msedge.exe
3976	msedge.exe
4872	msedge.exe
4872	msedge.exe
3396	identity_helper.exe
3396	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2812	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2812	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 1132	3976	msedge.exe	78
PID 3976 wrote to memory of 1132	3976	msedge.exe	78
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 2100	3976	msedge.exe	79
PID 3976 wrote to memory of 1688	3976	msedge.exe	80
PID 3976 wrote to memory of 1688	3976	msedge.exe	80
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81
PID 3976 wrote to memory of 2128	3976	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rule34video.com/categories/roblox/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff81f253cb8,0x7ff81f253cc8,0x7ff81f253cd8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1912,3294899154796299293,13453621863125083111,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
50KB

MD5
bbead612704e0de25a3c19be5811dc40

SHA1
8d12652d5d8728fb093d62b8e16e45468bb740e2

SHA256
9a93c949b11c2a44a14a8759fd384180b02ecd07c681878de01109c37dab5830

SHA512
97a264d3ed179dc39c5bf09d343f36ea3bfebb59a39ac2b6558eeb8d31b247d77d4f071b57cb5d4b28c7ed465b7fefaf5247b8591e91274b18c6643fefd3c5b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
704KB

MD5
c2de0667fa68cfdd06a0367e2dd2e989

SHA1
67915fc795c7ae6cbf944321e50cc6a48b4dedcd

SHA256
8eb694cb090428905a10da1a7ca8e553e7abf6e1dcc4342ef68a8dc7608904fa

SHA512
4b23226774a58baea2d2c38688408556375524f6e7473104b991cae6c1940ab48f4963735034bcca5bf1ca85648403caf5b6663f4024581f8ee3a1c4f316f9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
76f2797ae9a0039823648f67f2f9016b

SHA1
6fe10ae023dc2bcd9cda475d8cdf06d592bbb735

SHA256
7ab6297787e9cee02a0b772245b8436ed0e13b2583f24e61b29693a2a59949a4

SHA512
a050f0aab5d1750a1d8976f874a55e3c47711615a0a75c0f5caf3d3ae317f49147f827f4c3d515f1389cb20b440fffa06c231bd70701cb44539af475171ad464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
58408306d71bfdd3c4f40ef747db1663

SHA1
057334897616f1cd7e799b17b077a84f8ecafd30

SHA256
bbe56d8f92a6a0864aaabf38378d84ba1b4bfc180f23bbe0b2ec601b2819b804

SHA512
b39061e33324a160222e14bcc4049cba8098dcc67fae516bc1b654ef72c31a1af5d7eb47d8726bf5ea86ab83309190c528b04aa61d9d8131f8e656e8f6850e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c9f1aa90265f5b40696be816097634c

SHA1
fa057a3383a1676e9ab95767b1c5e2118ffd86a7

SHA256
a4e87a2db6c59e966bcccde4d82d7af2759bd4609aae70750d401c674e8f9963

SHA512
fec2981838a9d9b8abbb2c005dfa61d248863cb6a2d7731b686a9507d40a53e9a02b0949143ac13f754e937ee64a3cb482ff7aa90b014420eaaf9183e26c4200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01c9311a973c5d13447133739d7c5da5

SHA1
e54269961421cba65e3fa15ada6a8de66f05df2c

SHA256
c49db98a90aa2155b73f8bc07aa247b15d6bf1d33bc5d4074bbbc972b6f8b304

SHA512
9aaddacc5e11551c6215a28c96a3d110d1a7557390e99bf092ca63b779c96787808a3fa5416305ca3b7456f952dabce1b1101b48f2079fa0fef15725f9df3082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
d86579dae98e2106c4244744276bf191

SHA1
929e684f67c94d148943b7b6054da9e992011116

SHA256
ae32f2219d8019a6c5d6d3efa0559c626881d79ed1faf8d008093333afc78b07

SHA512
80a860393b072319704b1b0e0bf1f3090d31a9be189d8a185cc85c65ba56086523499aa0ac658cb40204d815dd4f29bd58e4021b1631e2d390e1f5aa785ca9bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5843bb.TMP

Filesize
371B

MD5
d4a3e03f46595e91d371034a1f42bc8b

SHA1
f4f0a7768a26eb3f03c8b17655994d79f8e31e1b

SHA256
cafe191154bbc150d426395ab6b17c27f0595e4d98e8b367de8524228b4388a6

SHA512
d9048445eb8b32b192c7544c613594f71fa3efb69a4adfef81fed5499500a03b952deb7f6b0db2df7a71ee85f39b91529fff889a50c7e8f625eceda80000022c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7609c6eee3ed8f118f87c21dc8aa2db0

SHA1
8cbb052be12f0a32684ec254acb10ea3b6d003e5

SHA256
a49cc95e073a9cd09119fb7acd63994ff18f410607edf6faa1ecb983bc13b110

SHA512
90c843a0b74b6522251596eecd99034569d0d9183f0775f7c5eb50dc1d8c675bf268ffa8e4eb3a66894e969bcb98cd8f11debeff1b0c761332c28f0cff0dc7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
84caeebcee6c4670450b103a3d514112

SHA1
a7fdf6d4f9876e03f4dcb9c608b66d89d7b76394

SHA256
64c433eba23b27e0e40bcdf907a5b786ee2ebb601d928bb4c164d1c62562ce25

SHA512
c8e64eefe21f39cdd864a7c54ed3ed763b1c778d32226d8e74f2e049153d4e329a960b276a61a6907a23bd4a760384b2bdd61605694035c50bc5110dc305294e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit