hxxps://cheater[.]fun/how-to-use-roblox-scripts[.]html

Analysis

max time kernel
1s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cheater.fun/how-to-use-roblox-scripts.html
Sample231230-sc1jcsceb3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 2932	4976	msedge.exe	34
PID 4976 wrote to memory of 2932	4976	msedge.exe	34
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 2076	4976	msedge.exe	92
PID 4976 wrote to memory of 216	4976	msedge.exe	90
PID 4976 wrote to memory of 216	4976	msedge.exe	90
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91
PID 4976 wrote to memory of 4124	4976	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheater.fun/how-to-use-roblox-scripts.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c9346f8,0x7fff8c934708,0x7fff8c934718
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16718071378536009358,1664363981589105371,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5988 /prefetch:2
  2⤵
  PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11
MD5 5e77545b7e1c504b2f5ce7c5cc2ce1fe
SHA1 d81a6af13cf31fa410b85471e4509124ebeaff7e
SHA512 cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37
MD5 SHA1 SHA512

Submit Download

1c9c832f-217a-4095-a720-0e92b78aa650.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c9c832f-217a-4095-a720-0e92b78aa650.tmp
Size 535B
SHA256 c89485c3fa81f04b48a9984347e5229379b111620f70155c1efa362308a2609e
MD5 e768fca3ef8e185a2bd9f3bf06061bc2
SHA1 69f20ba7bbf39053186db96f204f5d43ad71e6ad
SHA512 418ab2315d3ac9a2b68d6b067cf8d9ee3537c22b973e21bb6d7afe86d4beb66da41d539403013ba80877e1c2f8d78c6760f395317c0e514cc4d4ff4d448f1506
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 99ffbb667427198587be6f35029138a42f1c79b6d87a3febe078806bbd6b1d64
MD5 00be2c109184df4d24a886f28e095895
SHA1 8edfe843bee9a9a5fe9b3d68a3a959d74f31db01
SHA512 b3a35af40d71228f242fea39500a995690d2694ebf764fd1b2f435cd988e4fddc60c9893106b7dd847ebf0538cf3a5e2c502efc927b57e01b696660cbc985f5d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 1ce6db4bd778aaeecfeac13bf766d4af1ae1848855c73c023e964930ce3441f6
MD5 d67ae2809249d9af58c485b60a61617a
SHA1 a717daafdadc9e9f1ee47a14d100577fa1672e93
SHA512 16be69d64ebc7105452a78c53a6605d0d88f5b4659a4522921c9b06f6921774e761fb4172c807f8e6414f2b63ae76073399c3977ebc90c2c83983bd2dd74ceea
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 78ac24ea6c25309d22d718b7811cad820a997c6fa9d518a7aeb75eea26f3233e
MD5 60225f266b7194aec0fda5857f5bf515
SHA1 c1c3aa85cad86a461249b72f07aa410fc7e6402a
SHA512 bb380fb5f21749dad4b498769ee8fae4cd7c53baa46d045751f644a3d177cd075dc391d98b34e6e34202fde6c35c26f0e8433d7585bc1e228070c958d60e2937
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8483a7d3eeb12805ff5632b7d698fca6ff5fd162e187c5c24d77e9b1e98e4949
MD5 d6fb15f7161826175504a7b6e1947e61
SHA1 1e7cef091cedaea08f32bd5fe94c88c98351bc3a
SHA512 0b61b31ddebe998227720cace1cf775e381fcb865fac7860ba61472253f7da29f0673f183f73dec20c690eacc760ac1dd6981630bd712b3c454cd3e3e3abcfb6
SSDEEP 96:nRkjvm1nRnswpvWMoiVmdefYuU1D7zEFhIbzgGpqqTMQqUWQyV+VD7AiEwb:nRkKVWGWMwuUd7YFhkzGq8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d86e6ff09890e5a463b3a8a8b9385845c66f2452ed8a8c2a2aa4f654a49c5833
MD5 9212cda7437f29356840865434469de5
SHA1 2c8b7a967a158606996389a9ee5114bb25b9c68f
SHA512 13d5c0fa82fa26c2c14d0d4fc4eba85af16f8dc8482d22ef60c401a175bb1d09dc21389db681b855b411c1f8e06994d804418bfda070f3846460154983364861
SSDEEP 96:nRkjvm1nRnswpvWMoiVmdef0Uww9jB7zEFhIbzgGpq+V2TMrLqUWQyV+VD7AiEwb:nRkKVWGWMcUww9F7YFhkzG+V2a2rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 02781e930a2d767720fa882eb450f6bfa36ed097f25e2bf474990574bdbf480c
MD5 3718ff986dc6f762d850952d64bf3287
SHA1 33e4c6b49defe5088fdd06088f49c639d576073e
SHA512 dec69c6d1291ae425456ae385141b411e5eb02eab56b4f9a156c11cb8992e70c6db1b029a503bab49d805476467e51a96438ac4dc98473cc7cfed0fa87d2b162
SSDEEP 96:nnk0vm1nhnswpvWMoiVmdeHTMdUWQyV+VDCzia:nnkfVmGWMXsrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b4097cc60739ed245adce34da3cce681b3a06d97d6a45b5fa065c0b481831a29
MD5 62bdff0179a6e545ef4dbfebe6870237
SHA1 ac7bad186f55fe4f1dc4be2168572d6f0ad06dfc
SHA512 8793fb9615ff04ba1d753b9e94cb8ca293ebbf3fbafb4691a578237516896154c14911c06c3681ec335a9e461a98f44be0ab7a8e549a1ff54592e5b0a1e2c612
SSDEEP 192:nRkK9XGWMcrJw81fDUNe+SkjMyjZV2aArg:nRD92WtuSLeeKptrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4
MD5 6db2d2ceb22a030bd1caa72b32cfbf98
SHA1 fe50f35e60f88624a28b93b8a76be1377957618b
SHA512 d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912
SSDEEP 768:nYXexSxWTfbn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqELl200zRrUNe/:nYXexSxWTfbnu1jaDELMZzaNS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 535B
SHA256 0425fd913a66b29574f348b8b909592b952d4efb273927df6b52f953c136722e
MD5 9ca9b7f969f3ea1b065d43a198bdc613
SHA1 f368b3f182225881ab050a1aad59fcd70f4fe8d5
SHA512 40d9d4b6f0f97e28ddbce78235351f08fc67f635bfacadeb58bf9fc8a6ae8e5da2413aa6acccf24c79aaf0d37c07073aab466d1bea0dda1d3d58f642198d97c7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f3b27b8f98b2561761c9919cfb92b7ec3c3f07f3b25c7f81d851e61f67792a98
MD5 49e53ee1b5c99eedf0a79f3bc49a9463
SHA1 7003744e50a06b4676503f4a17198dd9cff6bde1
SHA512 db53b87627257378ca4a33304d6752c745ad4aec4b0055a154c4b2d57b3da34bbf44458833742a06f94dcdd9a61ec57e36a6edadedb1754ec2691e9a8f078858
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaT5e2RUcRbC5Vs0aJGMmGo:A9iIxuERzA83h09RZxY6WTOE3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 84273587b070a97aea275834ae67f79db36eb844c87ce881ab2a9e7b745f777b
MD5 69d0b2f67916874184ac62938247cc1e
SHA1 d4d472dcc6ab92370c4de8d625af56ea3468f2da
SHA512 2d49ca3daab5adda670a2f5145dbfd4ec08b5f8129d7d8eb611adeee65c9a3784d9c68456df1c6eb5b3e126ae88422bda228b4ad2ce4127a8a5d336f203f57c2
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaT5e2RUcRbCLVs0aJGMmGo:+9iIxuERzA83h09RZxY6W5OE3
MD5 SHA1 SHA512 SSDEEP

Submit Download