hxxps://www[.]roblox[.]td/games/1537690962/Bee-Swarm-Simulator?privateServerLinkCode=31039674311273675863297116586027

Analysis

max time kernel
65s
max time network
68s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/09/2024, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.roblox.td/games/1537690962/Bee-Swarm-Simulator?privateServerLinkCode=31039674311273675863297116586027

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
3880	msedge.exe
3880	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe
1432	msedge.exe
1432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 3696	3880	msedge.exe	80
PID 3880 wrote to memory of 3696	3880	msedge.exe	80
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4252	3880	msedge.exe	82
PID 3880 wrote to memory of 4212	3880	msedge.exe	83
PID 3880 wrote to memory of 4212	3880	msedge.exe	83
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84
PID 3880 wrote to memory of 4176	3880	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.td/games/1537690962/Bee-Swarm-Simulator?privateServerLinkCode=31039674311273675863297116586027
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffffbc03cb8,0x7ffffbc03cc8,0x7ffffbc03cd8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10688822244778102981,14397264381953441657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
72617c56dda5dd824957f63622afd2d8

SHA1
805369ad164df7d364ba780e3d4904794cd5e0bd

SHA256
7c33b9462594eb9dafda936b2f53ddb10f29dab0d3a504f749ded18f595f57a7

SHA512
1a231fbb7b340db719489653a6c90d329a2b24348e13609bb029c9f91a3ef607cd54559e0d7088550da06cb2f021d9f8ea86c1bb17995da4277daeafd7234982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
700bb5531102c4e03004989f0fcf0e75

SHA1
2a9f215ba1036dd4c34a845f9656d3e0bb14f966

SHA256
67d0ceda4fa5f2f9df7c407fb374f9111508644e35c013a86e46d79b025a7dd2

SHA512
49974dd5674a04a3b4d457856c5920179b637b8def8264586cf8067f12679d6723beb036b88a2672abfb24ece332ee50ed5ff1d95e5e6cb924d036080fd5bb7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edbd843bd2bfe8c9aa1e996cca002270

SHA1
b5f48dd1fb7c185ea85c56a93c1ba19e4ef5566f

SHA256
593836bd4d90a5141619a3e17a9f59a68eeb576c73a06b955eef4191dcb71167

SHA512
15f69275e5daab9c901b613793d10a1069c5d7f03afb8ee717187eb6ee77d683418ac9a939f299e89468cd0c1e74dec11c4f79b9106fe179261a9d8d2bf73379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f0fd92d8f8ea0904027fb4dc67f8731

SHA1
c16f4754c2b652889be8e069da94fb450f51b23d

SHA256
d8deff3585dab42fa35ce23bca92d9d102c17f1b306a92dd43b99ef3721ad2ef

SHA512
6a819705f9188905a9b638f95cf0aa618cd272f679453856f629ac51215d0db31407f442bbb351503a43acc4f453e91e302d246c32a7d54e72a899bd5759aa16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44558495f6bdf321cecbe693f4f13ddd

SHA1
69e0066ca6fff8ce11731dd961fb130af1b3841f

SHA256
cbe6cd9951291fa3cd77461028d1a39d357ee92ca981104cdc2a98a7042efe98

SHA512
de17a0c08bafe6387f778a4cf03be851f463651c41a91bf8aa159cf5a7474db375c1b1d7eff7ffbacaa5292dcc545e354b70e623ddff76f1719e9cbe3c5f2ef5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6e7e03301f9d61e9e7f22d1e3bdfc77

SHA1
716fffb0cb082879b2795fa674c82ba6976be1c1

SHA256
227ea7940197d1ab23f9330235576fc43386199c7da6d27872aa5757ad67df78

SHA512
c55af3e25b63c97d35f7f198441ddf30a70bae6a4845e889bdc3f9d3e49fc107d25d51f54fc34f8c96f8d5f385df14985109154acb003ec97080237c809d2d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c89d8a61e66709849aa581955fe075c

SHA1
40e8342aa2c76dbfee9d14c35cceaee9773aad86

SHA256
b2de5c507250fedfe6ac6d4460d42f7a033f743fc7cdb6ae0e9f4a54ad8d80cf

SHA512
864a5b6654ed41894d40498ea863277927449b09e3187d2c976b09b04086470b07fd781bc612cca69a5bcaf6ab98c83a9806a4dc469251c3a13404f6fe796047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dd4663842e13164485056402010f3afa

SHA1
d9b576220b1865dd1538157aac55a3d47f8c2dfc

SHA256
48a270db9ffb18a329beacc7176bf119b5fee21c962c5bc3a538aef76de0acc3

SHA512
d983a3e82d9e264949ea424ba97b98a1a135fb4a9add715c6b5838a82a9de9569a6603fd2cf005f327d05a30cab0370e13c0327c9a3626d62e57fa3e87adcf48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e41576d900568c01482897eb04074ae2

SHA1
03faecfbaa60e1f0fd1dbcf90e8cc3d9d5ef9a75

SHA256
66fdb17632582bfa54ec3cd97c3149753c58f45d8ee4f84d9f42839775cd60c4

SHA512
908a70851c8b9b3a98b5e86087bb2949678e6933fbf057ab2567ff7959ace2950daf131943ab70ce83dd529dfe95a5fbdd500412e609c4dd39a0f8ac9a93ff12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581661.TMP

Filesize
1KB

MD5
3f1313d476ebcb48fbfe904447815a48

SHA1
65e8d2bb97ad62f85d61c1805d3b10edf118ad90

SHA256
be33e9b13a922e260e79d4da84c24b4b86fb60a77251b650a33bbc7e3ed47e38

SHA512
40509cca2521ec2b22068ec5fc08f6e55e23adfb14ad9b28e42d1ebd00a8a9b13acdfa758bc6f3332e34821998afa6e34b4a9c7696f093f17ce6528f3c71168c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
28d01a9f786cc3c07bb8dc79ac78a5a1

SHA1
90016820c3d61ad6182f6d385669374d289a967b

SHA256
00473e8936c30c413a85f1b315ffd7ab4fbec6d5285471435a66addfe2d35967

SHA512
9031a9503ae41a9247c246ac5f9d2a3900e1527d129b960f3aee75b04af7936bdd7cc1bebb1b9785e6019e72fe8db9886116046161d1774b31f99a18d1b50150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf0d265e2ee5dd1ee00ec3613eafad26

SHA1
5a9dc272d30b26720690e21fbf37932c0c73e73c

SHA256
28316d16a57af3c59fe1b700b367f0627f7f508d4d8be989b8de865fde1fe25a

SHA512
6bf81c727382d56a8fc2d903c2697d4edb73370169f77d646144ee8e2ba8de352fb02df9fbaf9cd4c46785fc39a7204f67eb0b4c90851de4bc775d49a368000d

Download Submit