hxxps://www[.]roblox[.]com[.]bi/users/5445740091/profile

Resubmissions

04-09-2024 16:28

240904-tywyqsvdnb 10

04-09-2024 16:26

04-09-2024 16:25

04-09-2024 16:23

04-09-2024 14:19

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2024 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.roblox.com.bi/users/5445740091/profile

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
4524	msedge.exe
4524	msedge.exe
1140	identity_helper.exe
1140	identity_helper.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1268	4524	msedge.exe	83
PID 4524 wrote to memory of 1268	4524	msedge.exe	83
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1756	4524	msedge.exe	84
PID 4524 wrote to memory of 1488	4524	msedge.exe	85
PID 4524 wrote to memory of 1488	4524	msedge.exe	85
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86
PID 4524 wrote to memory of 2228	4524	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com.bi/users/5445740091/profile
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8650446f8,0x7ff865044708,0x7ff865044718
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5596447585276041628,478193787177915785,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
185f2f933c5d5f97a22930ff8b729404

SHA1
6fd0d546598c32ef8a73026df38d2221969d331c

SHA256
f6e9865cad2bd24f5d2d434b4f3a1d3b33885290979606e5a50e4a231fcc60b9

SHA512
6f8be06d4d766e6aa5aca6cf7835c05d5734001f785edd3be1914224a6607f576651a67817df414dfd86608849de9863277bf9b8e13736db56e99a7cb93ea4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2de423c002fcb60363b109c646228317

SHA1
25edd7fff613e7e8d14f737a7cb1e5bd62bf5953

SHA256
eb7d22912d3e33021804c983181cb73db0d5df37a9ee7265c0b46fee6bc00272

SHA512
9eeec7206f34861e2fb8316aaa043f1304ea8072482b260d84a558ae1f05cb6b88aacb69efa6755aebd0e741b6669c5ccd19b8c549d598675389e88f29056176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
654adc48a5f5b81d34f071aae8329211

SHA1
73586d6d85e10feb9c72965257193281b2fdae30

SHA256
161c30ac4ba8038925aa2fd6afa021a75de78b37959ef3bc7b6147b575d9aa42

SHA512
1cfb98e271f1a11dcfcfc4e8159231abc9eb46bdd447885c23289f117f9d46849ce29ea28bc6f0b5809a54af33b4eb8d4e63fe3394016d3c1a6d3eef349ddefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef8d74bb34ab98231ca6ece065691617

SHA1
171e8fbb0ca70c7b935051dee3facb46cb85edb7

SHA256
fbbe6fe0f4ccf858d7741900dfbc2ba6bd671804c8cec55f2bbbf6788d8ca2a1

SHA512
77f4d9c629078d0ccaa089ef1fd03c08af1742fdc705d15d1f19283d20012faf23a8941b371c88815b93d44c7001f5933649c0c862bd3427115fe3095e90e57a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d90717c34778f0e9fa81054b279b6404

SHA1
de2eb78cc186c6df2d232ac5838a7453d50285e8

SHA256
aab10a5e5968593450138a5f132cf157676771e7209e1ca5cad94c10c469d07e

SHA512
fd1316565172d5212e020061469085b42cfcbcb71a991b25a552db7e4304adbbbf30094a2dc30d4f60c24e8cb6f6cf7a719e0250c4e0ef39d4d644b4a53d0105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49c61b3e30a8b7b87e7890136bed53a0

SHA1
d6bfcfb8a0aee016c4eab3b26f9c66fd2b4f8d3f

SHA256
d5e801d2657db9c82f1f7bb92f155bf61b2cf2cab9497f2a2273777530daff34

SHA512
5ae71343d725a01c252bead589eee864def204fd97f3df735dcc02f2b38176c2d1663cf393543561901bba0802785192dac0f7825a95d0eed788e81aa78dbcf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b254cbf2de2ba90ffd5d4fea708a782c

SHA1
eb046e21c2698fa0c113600d073dc7f34467e9fa

SHA256
87d6b0adeea0941efb2c59a69203d14e1a930c0fddbd4750870fe32918f0ac63

SHA512
2ad089890feb4ded05f3c6f98a2a45e6f55f2807c77c55d4e2cdf5cfead7ed0381df32e850f4125d7445c095a9ae7a139bec4f136e414da5f55cb0cd70aa4d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e781.TMP

Filesize
1KB

MD5
626dd873cf3c92bafe70867b6f24ecde

SHA1
851de901f367e096e9d2406b2d3c82cdc32d5e8c

SHA256
798e6eb37bb0429557785735199ba731d8af29816192946d209ef96475509ae9

SHA512
1f989fb79a6c554f96499bcaf3a0fbe819b89e73d3ac807a1b15dbe52013d5ab156a2683eb706bcd4539de461e1473d58ae31789ea5261166fd6f307509bca6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
966cd0cd8154cbad1383d5bdc72931e7

SHA1
abea8b0b7514e30b4b24e3b45aa4dafbb08e4b93

SHA256
6aea711aa6686ba8dab0245f6221a85774663de7868e2a9a6eafbb803382802b

SHA512
e0b8ad6be999e711ce5cf10b0b95695501a69a65a66bd8b0f19d70d87e4e6b15a5553b942108b0c0fda544b6c5e05b6d6d9a982cb2a0db20c9e387792890e8d5

Download Submit