hxxps://cdn[.]discordapp[.]com/attachments/1273711853750456350/1274138852159782932/Free_robux[.]zip?ex=66c129c6&is=66bfd846&hm=0f0393743ceaf8f90b8647c9027e9e4edad13ece4814a18110636fd59a211f19&

Analysis

max time kernel
73s
max time network
74s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
16/08/2024, 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1273711853750456350/1274138852159782932/Free_robux.zip?ex=66c129c6&is=66bfd846&hm=0f0393743ceaf8f90b8647c9027e9e4edad13ece4814a18110636fd59a211f19&

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{BA37EF56-009A-4BAA-8901-7EF1D65E697F}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Free robux.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
3112	msedge.exe
3112	msedge.exe
1672	identity_helper.exe
1672	identity_helper.exe
3664	msedge.exe
3664	msedge.exe
2100	msedge.exe
2100	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 2628	3112	msedge.exe	81
PID 3112 wrote to memory of 2628	3112	msedge.exe	81
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 3956	3112	msedge.exe	82
PID 3112 wrote to memory of 5048	3112	msedge.exe	83
PID 3112 wrote to memory of 5048	3112	msedge.exe	83
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1273711853750456350/1274138852159782932/Free_robux.zip?ex=66c129c6&is=66bfd846&hm=0f0393743ceaf8f90b8647c9027e9e4edad13ece4814a18110636fd59a211f19&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffba6eb3cb8,0x7ffba6eb3cc8,0x7ffba6eb3cd8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,4273529085746760745,14873475195634322409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2396

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Free robux.zip\Free robux.txt
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ac22612bed64827f7a58f86294b23897

SHA1
5ea89856eac620511d56c85ac0c34818d1f3efcf

SHA256
5888fcc258f64bd4f039933f558540036d62d85de7ce264f7780fb8d3c3f040e

SHA512
045cb3cc6400b1feb86c8af1293f0a8a2b0852818e4f7c1810fcd044c23ccbc93766b5a38a6f5f1f5bbd2a4072497fdf0e97168889871f0b686cdd504b7c3e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
627B

MD5
bb3636ef80d3d987932178ed337b3e27

SHA1
19ca8348604ff45bc0af238e455a97d7fdfa4057

SHA256
dd45bbda7d8f6eb0eda049040688582c5fd0a7ea73cb946e035a71eef91542b0

SHA512
86537829941af5df294c221540d4d99293db88f6263ddd2579f83c111800189fbf533685e819f5c66153ab196c2845495c6503ddb5aa35570b5b525eea03460f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4176168eadaa117ea60a475be8e4b543

SHA1
b0d847249ccc9d6e6ced2853e6401ce35af5b586

SHA256
52d06b0df332c8894ebab70f3d2390cbe0addff0410e3f397bcf3b306cc50dc9

SHA512
85f0394dc390ce4cf5e3113ba5562c1d37389bdff12b25607d5ba85be685910bf659dfa0b4f6d610f9e8033b4899049de3c51a968fdb0370921a5010cc24c107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf88a83ec01274bbdec06fcaa983813c

SHA1
91ea6ed9efa8cb157a57704b0506fe38bd798b38

SHA256
cadc08c312214e06f8a919672ac4065307d6564f980bbf98ae274c81f778fedd

SHA512
3b5d09331433f89a997c710e3a5971f8408e5facf66adc791f9a7c5dc00d408a9bf923474e85de590a46838a173b17b364a61366843cdb2e46cb3cc49e1a9e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f52533d4944e618ac5bdb93c3c1b6987

SHA1
cf2fee3b60660bc88adf2082b0e637d63c35f4ee

SHA256
e1c903d9a485235378374e5ace35f09949a4969227ee9813a715bca65daeb0c0

SHA512
5a80708d34d1e6b15e73619efcacfea1eab9e4fdb44047add5e71727ce5610f8648bb3b82f5644777ae31f0a48daf37942d8ada2dd316166a92743543f524739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ea153bca183504bee6928c36c07329f

SHA1
41649d35c5fc699c32abf6d8c9c41f2b5d70d234

SHA256
3c35a1e274e40f0b0250d49c3157ab2a281160461acb1dd7df4696021f59bc28

SHA512
8dfecc1e3ee10a6cc0e99a165465f0a0800143ed44a280241fc68c846cf66a0d6e6c5db1d1d6b325e8cc7cde8c0841e015d0b44f559f80ae6513388ea08809d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b0e6b3158c68ccf6a1784f99c01e143

SHA1
50b4b9e27cd0c7a6dd49cca69d80a3804d8fe03c

SHA256
98e071b0ce9423783a7f381b7bd4ca5bd50d61453a8e1a56ff90188430c82292

SHA512
4931790b3dca73392285697b52f72db4698b92d56d152dab1ee3f3fc407c70358523b81549a02e6a83f5e4da8e14d30edf328171a727ae77fd83109dfbcbb651

Download Submit
C:\Users\Admin\Downloads\Free robux.zip

Filesize
757B

MD5
f0a4e5dce93872aec97369c1c7c82424

SHA1
5a6a80bf865d6b1f61051d10dbb5c457fa9e8d6b

SHA256
4dda87afd9c88e4eab522f74a40f0edae33eb97eb7eb0f6cc55f6ffe6bad986e

SHA512
45dbef0733a66a0d0f1c16f8f085866b4346717cdc4db27d25a47da2fc85d9791161788185f9fe1f281407f9b339abb517c80a6e5b3e40d0cd17aa464e724173

Download Submit
C:\Users\Admin\Downloads\Free robux.zip:Zone.Identifier

Filesize
222B

MD5
a4df9ecc8ff7f1f97630149c724e3ff2

SHA1
5a7711fc9de6a1680cf86868109fe24cf6422372

SHA256
b947610efd2bd0f884cf7294bfd71b7680dfff95659cec1c81b2560bbc5f3164

SHA512
0b5d33106b50d277e2f0e644d2ed41c5b9c48df1ecad69a9b35c97df6b8d7b5c7c27f5558f02223829febacb4d914183cf94c6c739d613164507e3669f6f2379

Download Submit