hxxp://roblox[.]com

Resubmissions

01/10/2024, 11:11

241001-nar2zszgmh 8

01/10/2024, 11:04

241001-m6bt7szepe 8

01/10/2024, 11:01

241001-m4mtpawbmm 3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://roblox.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{CD2EA603-4481-4434-9F15-243AD6D66D53}	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
2804	msedge.exe
2804	msedge.exe
4724	identity_helper.exe
4724	identity_helper.exe
900	msedge.exe
4396	msedge.exe
4396	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1704	2804	msedge.exe	82
PID 2804 wrote to memory of 1704	2804	msedge.exe	82
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 4820	2804	msedge.exe	83
PID 2804 wrote to memory of 1016	2804	msedge.exe	84
PID 2804 wrote to memory of 1016	2804	msedge.exe	84
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85
PID 2804 wrote to memory of 5036	2804	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe13ad46f8,0x7ffe13ad4708,0x7ffe13ad4718
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,8819128797728540626,11764475275857977434,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a8ac7dc79c128957bed47971ec484715

SHA1
c4bc6ba0e3428ab9867adf54cb931d115e12cf12

SHA256
f34603f0030f3a82d2224ca56a2ac0dd4e425ba45da244cdfc8ef69e96a858e8

SHA512
cfdd3a96076148d83f1accac2aa950e4d3cb316be29480826e9b8c55ca50b86c9c73bff25fb6bbb3bf660e2d20898181c8d2904d8babe6a5f51a3bdd7b11459e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
772B

MD5
d32e25287578ef5e0ddfa4bf8f383121

SHA1
e41ca073ca76d7e281ea10df3831337052fe5c2c

SHA256
d2d320c265877dd127868f8bb440252de7bd4d3b7cebe5937a9d97da43eb84ed

SHA512
3a008f340db0af0879a460d941bc525f918e24f809f8da63b6535a43e91f9cf2bc07e3cd122c43bccdb66c10239dfb9789712589f7ef979ce8f6b300ed210e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78e9484b503e75a6fac5f37745c20135

SHA1
46c6a27c45f45cbe016592191209524250ec31a7

SHA256
6c7e1f9d4670437cf0e183220be8847087a64e3a9e4db25de0fef8646959c00e

SHA512
2a897e0766d9987e3e073f34244e0c23985b1deb37dd375dc72bbbdff0a31c35fdafb16f4fc87a4c458b4bbbcfe9ccee3a5ee514e4bf0dc88468911d3c964d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcf0d96a19f8bbd81f87df3951c16673

SHA1
03bdd9102c8f89c8c74798cd5473b584cc8e7ffe

SHA256
8e54777602b2405789fa21d715252a4eb1d44ce0cf03243abfb8b67ad3ba76a4

SHA512
20e7e98a9352f962b28dcb39435713356a74b65133ad8b40571279143bc8c1afda5234b84353bc5edb24e10c09150af19c535b3cf1752fb859d7ce5fad17e448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
203aba77b6d8f7d8d5ec5809152d0b79

SHA1
ac77b5ccff0821e680e726aab79cd49e3eaad7bf

SHA256
9a7857410e09219984940b2717a1a3adc58b68d6a43cf3b7b9ad2a885b147e38

SHA512
90eaa9c5525591dc95d7db0e05bbd9f82423877c63a92ff37a6f7bfd7fadf0c695753c372b87d855294810fadaba5b8c316be24df4d6fe55a68a9861ef517573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3beec6662004b5bd192ae27a8f3b9723

SHA1
a650430356a8f19114fc63cb166282b3d7009adb

SHA256
ea989bb19a8b06d7bfb647ef3a6bea4362f8ded7ed043643c24b8d45b61d7aa8

SHA512
b97a1afb2df5add0801dc3b75555664eb6adf5fe4a2f823a150a76d160b872a65707fdfdee49f43c8570db62982a188be103f7685717f57814d62d9d54e471f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
01df72bcafa783afa2e67cb505676a4d

SHA1
48c7b79ca56670544c65a55c75ca20ed5cbc5d50

SHA256
d1443437cf0add6f1f6ad258de90571434ce4de68a0e0d64b921fc7fca69895d

SHA512
2f390d30c795d76167cb78510410372a16f43f80720087c2086a360cc28fdccb81bd1eb5a47b796cfa7d64ac7e67fa81cf52f016ca881c6888fbaf91a1ad0e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eaff9d24c0620735fa04f1d2b755c50f

SHA1
df1f3ee3fb87e13261069649e72a181bab4a2d6c

SHA256
b961110b1ee6014df3d6ceae93a1523485a84f5647d3ad41c7822003a38cd0d2

SHA512
69188d0a2c49515090292888ee4dde2783fc7dc9391f6679e74ad43b082f4be5771f6d7a498bf98d5f5dee6eff2389fc067f93c808ecdead478ed67677aa2795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9cbd733ef6bbc1e9cd428464cf83d8e5

SHA1
30245d166b1ead845b71618d0ba30c58eeea5df3

SHA256
4543c829cbd53303f15585e830b96c63113845c2944967af8d27a1557a94b15c

SHA512
3167c12ad4d6ea60ea6359a9617c13428387e60a2282ad8ecad02e84b8e89840ddae4c6bec7e94845683fee84d3b3ac782ea325fe7e321deab470bd31c0d023b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce4c.TMP

Filesize
1KB

MD5
cdb99a886fe5bbf487067c08ddc8c052

SHA1
0313dc18ca811e48cf3489f0a095ef0183aec5dd

SHA256
b184f7896d4bcc09562aa40eca8dacb9c604ff47b0a6ef029ac27393776be561

SHA512
f1362f3f844f99a2af25ffc33718f9c10f1cfb3713d9c9e12252298ca0d21d6f6662d1fb529cfe3894fa4e70123c9cd21ffa547aebcf0bce384d3f2c6ca69483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f5c2583033014fb08cc040eec7dcf62

SHA1
0a1127b88fe5fa94d9c725b93efc45046b813f8e

SHA256
4cfb10b776c11915af0cc1387aaf306dcddd1a6e24d30c36c2946aecfcde79e1

SHA512
dc2d734c1b62895684b2045c3a052aa6933693e49dce1b0afa397810f488fd4bb8e534c5285efa83337a25c0037dfae94320ff9853c4f8d74206d9ea45ad290c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit