hxxps://roblox[.]com

Analysis

max time kernel
1680s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13-11-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://roblox.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1712	msedge.exe
1712	msedge.exe
4132	msedge.exe
4132	msedge.exe
1832	msedge.exe
1832	msedge.exe
4048	identity_helper.exe
4048	identity_helper.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4132 msedge.exe
4132 msedge.exe
4132 msedge.exe
4132 msedge.exe
4132 msedge.exe
4132 msedge.exe
4132 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4132 wrote to memory of 1584	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 1584	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 2796	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 1712	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 1712	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe
PID 4132 wrote to memory of 4648	4132	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://roblox.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe8bbb3cb8,0x7ffe8bbb3cc8,0x7ffe8bbb3cd8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,7877571436083723679,4600561715631323733,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b128cfd1366b39df397ebf7d01f9bd0e

SHA1
57da38110a3c2776a12f1382fe49c3e364f20c51

SHA256
18bf712a21b46629e245afa3ca1b58845f2795b94dde36df5265db35ace86350

SHA512
fb4d1631a62c07e850fd51811e8f13fa4ff0c0d85a06190b2a0d2969b98ebc87231d1f4f546ccc8b8505bf058e88c4ff7411a28b4a0e4248741d9831c2b434bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
689B

MD5
43819e886fed7baf73fc67762fe78115

SHA1
eecb30991c86ba320dbdb5eebb6359143e21fd47

SHA256
e2a46d107bca01cc5672cfa74292ac0e9da9030823f0ca05996ed4d8ad80c3ca

SHA512
3e981b2811e7147674ff85a3b27e9999dc6603dca71e537fc3e27358fc16279b0e7451ef7dcfd1fb898cdfd0e5ba1f78e13c2e3478bcb74b936d2b14ea507255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f2a225f90a459de5a61a81e4c187f85

SHA1
faf166110fe6208c8087be34ddcd64a5b12dc085

SHA256
28fa299402d72b8c7298820c9f1bb2e5ce5bfce96fcc8c9031a265e46cf3cb0d

SHA512
9b133e76f53ee6fe6be6114d4a61abcbc41466547381d5252509538b2460970b8b32be219b816b394a08266e5c54a01d84ba39b20a3a4f178f3937d033b1be0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0beb925111eaf87873b47a7ce5601e0d

SHA1
9df9fe788ef0cc4ec9f0a521e08e0925c0653717

SHA256
e43b7b51d2b2774ebab1c3353845ae707ada05bc7b754936f95919d08b8315f7

SHA512
db58813ad440b49b6ef96a0ab0ffa022e8d9e9757ee1818270bb9ecce66b40d30b2de501aadc45d5b26eda20fda26e8dd7deef1541db643cf7cda054747ebe85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9d68891cace282a9314b1dfdb5abb162

SHA1
ecb6bbdf276e1552acc59f842c3f83ec3463cf03

SHA256
373611b786aad95c66058e7749ccff0dc06656ec1766bb7686932f6316375a33

SHA512
ac4576d077f162e2833e23f426d0367ddf14f0ccce76763ebeb25fd12242ad7eaa25e8dd4fcda4e6f29419fe45387dd78277cb30ecc1c58c5eaa6b04ead1383d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39dfc5e84edcd5080f4c99cdf784d3bc

SHA1
8d50c526a729ba8dd18c27d100d57241bfaa62b4

SHA256
a65cd80ce340a9f5d7c9189a73eba48353d92149b88f61cd886243f3cb2f6c80

SHA512
153128a4e2f687fcb0ce4b8812cad32b38a08e11640afbc5ea73b1676d13ecf39b7c0119173689920dd8082c365a90f42793b1769dc7d3f57e00e435ac2ac92b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6b16fa6fcf423f964fcb04c190fbd35e

SHA1
29c80630027537f3b253f9af7bb082a9c42d3725

SHA256
887666c657a149fff507035a55d20e9b283295ee2bea4fd312a245685faf2f54

SHA512
cb02151020e63f15552350f1a9217b467406177e9ae9d6ea40e74cb715f9e99052806187714f3078ad76577040aa710f68fc6dd5f310d0d396adbc4473ee53a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58123b.TMP

Filesize
1KB

MD5
8a64eb14ff8e8435d635e13329c7c7a5

SHA1
450f5638c6aab82407c19ef749a84bf96048a81d

SHA256
7485c95f7773a5fb0784ceb44b52126aab2f7c547130bcbd514512550cc33612

SHA512
cc4dd4c6652f9f8a8f8220997271587c014eb20080b0f23daee2b144b5c3b10a27af0bbe57a4569dc6b66f6d6c1a3dd216260ff24ee3884d44cb21043048bb9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c2138750f4847adb47853d1b35aeaaaa

SHA1
b15d23ec0a487eb5c3520ebf42b2519ce1c5f0a9

SHA256
1c728cf5d2f86c6fdaf40130d54af79e2133a2ceadc9edc602197ec1c002c59b

SHA512
7d38837cffa6838f659e37f5e961363e40c548fc256d23d6d84dc001e9f8a92eaf2645168b470294692500b9f43c584f6d99ca83fcd5e57ea0bb80e33f5a1fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
46593f8952d4114ae9e8c8aca513a0d8

SHA1
1236e182c9b0b711e8581f6daf978a34d6e9df0d

SHA256
1644e56f52479cfc2547e8704590001231c969d49ad734b32b1f994f7d8d2a6e

SHA512
4289247eb36e15a880e6e0a8e082fc36ef8bd7e5bac2140822627f719031a9f51df03e255436d9273a2fc9f4ec1176bc7526a818572b2d8b265ead15d4cac91a

Download Submit
\??\pipe\LOCAL\crashpad_4132_KWLOCAKWDXVMLDKU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit