hxxp://robloxhackers[.]lol

Analysis

max time kernel
90s
max time network
86s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13/09/2024, 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://robloxhackers.lol

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
2948	msedge.exe
2948	msedge.exe
4412	msedge.exe
4412	msedge.exe
2764	identity_helper.exe
2764	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2368	2948	msedge.exe	81
PID 2948 wrote to memory of 2368	2948	msedge.exe	81
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 572	2948	msedge.exe	82
PID 2948 wrote to memory of 3944	2948	msedge.exe	83
PID 2948 wrote to memory of 3944	2948	msedge.exe	83
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84
PID 2948 wrote to memory of 4520	2948	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://robloxhackers.lol
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa645c3cb8,0x7ffa645c3cc8,0x7ffa645c3cd8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1
  2⤵
  PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
fe188d386a2b82e5bdfe95332b57e538

SHA1
17c841ed7bea8b9eef6399aa1cae69b8909d4c21

SHA256
4b2adc9511146a8a42942b1d168b7a0988ab34566a97ca5e7843846fe1b2f745

SHA512
e66389961bcaa92b50f8e73345c2ecbd2db97684d43ca5148e833989ce04a8b90a3c646078f97e2ab5df98add0bf630c8a1bea06ad51109029615003e4819287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
403ac658fb0ccee820e1520e020daa52

SHA1
20ea34dae78df60cba5017049e2ab9e3182903f3

SHA256
2549d87a14c3dc55636501514bae5e954b31f237935029691844ec6b12f3ba32

SHA512
b6926b84dd3bc44177f16f2b8c65a898fefa3d77ced2fe864091239aae6f07a8fca338632cd81f40b6eb391280c1bca8cfaf7563cf237b9067b3e73ae424800c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bafdb058c0625ca86c358a34672b895b

SHA1
db36fdeabd4b2e5a9a148f4abaf9f26f7635c586

SHA256
7e2eff938590d38e2317b12018ddcbeb15de4a409cd3419829569a26ff2b9b4e

SHA512
ff7c20cf4007ce202522cf75ff55902b21643dc6b70786119dde686d401a50363a812ec91a6de37525835081632cdfd8c996387f1db265f73d27af7d80b1cad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f246df6b2d6e4becb78c48aec6edde90

SHA1
8cd33e980ccb4e70971f333623499e3d1644f061

SHA256
89cd734502c28aba5d5a0b18d645aebbdaae6c21dd0ec0d879da4ea21dbb03d4

SHA512
c65bef24eb36ce7283e898d8ae5f771a8ad3888b92feb3a16e5bec8479eab5fe5dcfa1a515ae1440c75f32d70d77e5059f5c8ff0cdf3ffe8fc1a71ebc8752952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5558964dcb4df57a109a11df1bfcba03

SHA1
39a3a0db44f4aabfbac9cf601ac2b6ae211a0e99

SHA256
77fbaae4ad5dd129a1f23d2e7990ecdd86405d3f4615fd25fe9c49c763430b0c

SHA512
cabbaa1e0fb4926d23183e517ebaf3b5d323791c06aae56b838c97fd92b38743a27f1a1f1abf42adc7745552e8bceebd18a4d290447162081c31563b2109d285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
1127b4d104e8c44a3ed7fb462e7fe02f

SHA1
e75b13ba0b1ae49b3a264379c08c05f3b38bb472

SHA256
24ddedcbe6367e104668d311fb0742822816409b78dd45d5e04cf3974daaa686

SHA512
aebcf68d5647e709f4f9a00cb9fc6244a98a1a3c2fc8c8a2904f9f851c68cf6af4cbf1e8b3b516c5256f4ca89bbcde7da51cca1d30b208b90e814038229fbafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
864B

MD5
0c34a17670bf63d86b8a80748e045c10

SHA1
c8d13062d34f166b2ee10b4c2f9c56e9666c7ddc

SHA256
7e28a0d5a8994547db50222fef15e1e081be0e932acd1ca963fe75a92bad99ff

SHA512
6a3ce0e7e73aaebebf13694515465a3ca22242dac7118b0da3dce5971df1840f3700fa95fadccd54b3fa23b5def838e7ab4d69ddd5fac27e80e43a6507156599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587819.TMP

Filesize
370B

MD5
16862ae21d2fde42e48d04565086f96f

SHA1
2d0567d41a5b2afb338209163ef42c207002cac3

SHA256
8370868635da1e56236d5b32c0936d133546ac9b6d8f72021edc392295e76dfb

SHA512
fdb58a442bee321404925f0f1d0d4841bfe6b6c4a7c9968fec7544c795f0b17d3659f2494d4a9723b4631cdb297d2d0e7ef7873f132adaddb33d1e8e4c919c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d05aa9d70aae65462369d123c43c1d8b

SHA1
949b7ffc40c12f5d88354f18e29864783276422b

SHA256
4d2010000bb745bf117148e0a9ce08872f8808f6725936edfd287860a8267b7c

SHA512
bd601775b442628ec708ac0e0f0aa26bd09267bdeb51dfa29389916f7334784d45adb4c862540f113cd1aa23d7b87d175090b8f3bafd03da9ef092417d805a60

Download Submit