46f495f0d3bad8f4c3dfad1bdd1f67357052cb16b2fcbbf57a5f871a15db1723

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
free_cheats.html
Size 9KB
Sample260622-v13pqsez21
SHA256 46f495f0d3bad8f4c3dfad1bdd1f67357052cb16b2fcbbf57a5f871a15db1723
MD5 8ab7ff1af4b19e41649de1aa51397176
SHA1 befda7e37f95b9d5036f2ee70e2e431870e5f5bd
SHA512 442a37b97ce75f6f9f2ff7a98ddb631d874d98afdcca6b923b1b1c762e5ed25deb3da2346062a0e14b0a8a38e0ed08d7695b9ce5d8b8a9062644feb6bbf74d6b
SSDEEP 96:QyQynyIyDypybiy4y1myryCyg3ACqJda0yn+63CGAxQfuPxYwWVY9DmUPAO3HnYz:6N3ACqLWuPywWVY9qUfHnJwVy5s
TLSH
T14B222105BDCC88F240B169856A34E64DFD9AD527D30A952931FC2BA77FB2F998C07870
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266229127072728"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{075C01DA-323F-4259-A23E-6039D73F0142}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5864	msedge.exe
5864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1324	2632	msedge.exe	88
PID 2632 wrote to memory of 1440	2632	msedge.exe	89
PID 2632 wrote to memory of 6016	2632	msedge.exe	90
PID 2632 wrote to memory of 6016	2632	msedge.exe	90
PID 2632 wrote to memory of 5788	2632	msedge.exe	91
PID 2632 wrote to memory of 6016	2632	msedge.exe	90
PID 2632 wrote to memory of 5788	2632	msedge.exe	91
PID 2632 wrote to memory of 6104	2632	msedge.exe	94
PID 2632 wrote to memory of 5476	2632	msedge.exe	93
PID 2632 wrote to memory of 6104	2632	msedge.exe	94
PID 2632 wrote to memory of 6104	2632	msedge.exe	94
PID 2632 wrote to memory of 5476	2632	msedge.exe	93
PID 2632 wrote to memory of 5476	2632	msedge.exe	93
PID 2632 wrote to memory of 4748	2632	msedge.exe	95
PID 2632 wrote to memory of 4748	2632	msedge.exe	95
PID 2632 wrote to memory of 4748	2632	msedge.exe	95
PID 2632 wrote to memory of 3692	2632	msedge.exe	96
PID 2632 wrote to memory of 3692	2632	msedge.exe	96
PID 2632 wrote to memory of 3692	2632	msedge.exe	96
PID 2632 wrote to memory of 4700	2632	msedge.exe	98
PID 2632 wrote to memory of 5336	2632	msedge.exe	99
PID 2632 wrote to memory of 4700	2632	msedge.exe	98
PID 2632 wrote to memory of 5336	2632	msedge.exe	99
PID 2632 wrote to memory of 2336	2632	msedge.exe	101
PID 2632 wrote to memory of 4352	2632	msedge.exe	104
PID 2632 wrote to memory of 4352	2632	msedge.exe	104
PID 2632 wrote to memory of 4352	2632	msedge.exe	104
PID 2632 wrote to memory of 256	2632	msedge.exe	106
PID 2632 wrote to memory of 5692	2632	msedge.exe	107
PID 2632 wrote to memory of 2340	2632	msedge.exe	108
PID 2632 wrote to memory of 1568	2632	msedge.exe	109
PID 2632 wrote to memory of 1568	2632	msedge.exe	109
PID 2632 wrote to memory of 5864	2632	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\free_cheats.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffe46b4c188,0x7ffe46b4c194,0x7ffe46b4c1a0
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17652292920159996262,1055654721037590546,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8880397882180353103,5317805766907247865,262144 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,3100839007858222243,6172130452550702670,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,2253369355366045576,15368204914982178264,2097152 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,593255970424969906,2988763785792434490,2097152 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,12348906236560409124,14766884216026899591,2097152 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,7436429759117404450,9889118272940070481,2097152 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,18420114857001923916,17275323646840727435,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,10466985570717349729,7008024918965049158,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15910437213031339257,11702125327869025867,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15910437213031339257,11702125327869025867,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4924,i,988356599716897783,4197962044121205773,2097152 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,18046461195948768243,1592150263113063265,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16364400625904608145,11222099275152929724,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,14884263985700822431,16569468946386556793,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,17920771073669819184,2284745144898986327,524288 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,2803069336710848855,18204343476668189597,262144 --field-trial-handle=2940,i,8197172680639178174,9955584190520083727,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a73b32029b5d0c6ff7ae727c0f35079c0207fb5160bb2094317e96e23daf1cee
MD5 5fd2ab1b84f4c46ecb80443cacd9d150
SHA1 dd5f53ee71d94f4de7f9196f7dd42d06437a3320
SHA512 80afd342835e5b7c47013c2e8821b8636a9782f5c0541da2d81ad7da7f1be3e061af3ccb4f9143b3b85ff16c6113c3f6bf41ea64da18da643b2cf34c67ef65d1
TLSH
T1C2D0C0303300F601C0CA24B4FC106311123B8A1230E3C21D7020D00DEE940D0EB8B45B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02e83107bdf4cefad04d7dffca4065fb67146265abf734fc1a0a6c97297b321d
MD5 e502aaa276aa06e6296f6ef4749253aa
SHA1 99b55990cdf0fa9357771717d8ade2d2ba1023a1
SHA512 2f9d794c6e91e4888f5f7323dc7b92a27fbabf3cf561300c11be8833a6a0a6f5855daaa7cfc1901faab9b2932d40d1361bee35e50c2951c0e558a06150e71a6f
TLSH
T131D080707755F505D5CA25B9FD146315523B8A5220E3C61D7160D00DEE940D5EB8B457
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 64866cdae2b9689d1b46e6fbd5fa85710dd39e06fd694b7b3c56bc4e4369ee96
MD5 3cff1cef96c437a05a9b5b60d6d8915b
SHA1 b347600e3de177995b2b2191c028aa2c6b5287f6
SHA512 7a12a39d819b5ccc0449b846fd7e2da532b7ab948ff6d9e25880e544b9d32dae9818d871ad9165e8a70f003f2aef6629744cd77ee32eefb812c2183ec58b0a82
TLSH
T13961B567D4652066FF778135A4E2908937B4F8457E9B2F26A3D0B0388EF9BC135418D2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a6a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a6a6.TMP
Size 3KB
SHA256 352f57d394f3af98293ba01bec0953b79e75e4b421b484fe8f45c02c4786aed3
MD5 7284b8b13ef4c76b3c38c9f9d4444652
SHA1 9c3491bbd8e9cc845c3586360367d37ae13ca9a9
SHA512 3fab496d510d1a562badbcac221c8ee2b94de3627c2d4e2e9bb5414ffc5848a60923654a3a5790f93be4c3d2bc0ff2402ce25b13943cd2277377731e617b8795
TLSH
T1A561B567D5652066FF778035A4E2908937B4F8457E9B2F26A3D0B0389EFABC135418D2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 3d5a8fbea33c7236a0b0d14e67a45c3378e477b6c4fdf3b3554a6740cd2514c3
MD5 5c5372f6079985a5aafd5b97e981857a
SHA1 ab12766c9de40a55ca2c6151b0ebcad228c5c485
SHA512 ae3418d58b4d1f0aece6ccf67c4c2b4b0acdfcd60126de3c5786dc3542d203d9ead605df367fa452a8c66f98fa8df3c4b8d572cf63b295da6383590cc1520623
SSDEEP 96:DEOqPnkMbq1da8+1/W8ZmzBj6fjpXuEz7fhd:DPqPnkMbq1da8+1/W8Zm1j6fjpXuEzLH
TLSH
T16AB1CDB7C2D8877EC81516F1AB25792BCD1D194A93283C1689F4EF4F63E24B0D20269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b787f53ff9f8264524f6ff9b605131d07c043a5ff9d0956d4c4d3ad889b269b1
MD5 dcd172921aa68a928fc9d389a9b38060
SHA1 2721ba98eb600e3ee621f8ef528de4f96de1c7b1
SHA512 8f16b0c5983139b6f6ff82c4d37bb6003e61a86b0756265228bb8978344376d905f1efd2bfaf88833864e89fc8b71dfa3e0d7034c94a7e8e08f7ea30d0afe8fa
SSDEEP 192:sxRgRJyM/jK1Ml8wFz/fVsWa2srabqzoA8p4g/g6+WNIY54LNG6IgD+J:sxRgXbz/fVsWacbnB/5IpBO
TLSH
T13262D805AA245D7BCCDBD209FA927F53D6F81573B2901E44AAFCCA0C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0441840df5d51cb182ce58998cf2af1a395a424e9708a51bd83e1902033e37e0
MD5 d3267baf6a4d7ebea1518129a3340632
SHA1 1f373cc16ae33ca6086a76ec30d872e5643fe026
SHA512 08eff94f843f2ddacb750af77bf622a9ee41e4f0c6baef8d549948bfbe87538fe0b6a45e20e9cadff1cbaafdf378ed5b461e8f3fae3bb8743bd736110e9fe135
SSDEEP 192:sxRgRJyM/jK1Ml8wFz/fVsWs2slbqzoA8p4g/g6+WNIY5xLNG6IgDcJ:sxRgFbz/fVsWsrbnB/5I2B0
TLSH
T18E52C905AA34597BCCDBD209FA917F53D6F81572B2901E44AAFCCA0C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 58f4a8e86cdfa0aaf1513ff2f77ed5d9bb5641150c779bfddcca1364554e7c57
MD5 48ae93a98f9c63eef0fb09033d5f42b7
SHA1 0d2e9554d622dd43aaa0af25db4a9c08d8d85416
SHA512 5ffad62820358636e44596155c5fd709c78c5bd52bfebcc10bc560ea2b71c515c27db7e681ed0b189b43da1224374c94a2bbccf7b709354310d64322518f9c89
SSDEEP 192:sxRgRJyM/jK1Ml8UQEFz/fVsWa2srabqzoA8peg/g6+WNIY54LNG6IgD+J:sxRgXqSz/fVsWacbnL/5IpBO
TLSH
T18762D816AA245977CCDBD609FA927F53D6F81572A2941E04AAFCCA0C04E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a878a52d69f35a4a44283f8f3faf62cbb0a68ef9ce15da6f45299cb462317c94
MD5 7babdb6347f0a8597ece47fe8e4decb0
SHA1 eb10d5a05df6c22c22c7afb92e7624db7857eb38
SHA512 e28af3f15e7494f02634ca0dcb0246ea0755f78861d21546fffcd1db4f4bfb87af530700aa51b37bfde1194296c51490350af05da092cc2c93e1cd3a70100cd6
SSDEEP 192:sxR7RJyM/jK1Ml8wFz/fVsMs2slbqzoA8p4g/g6+WNIY5xLNG6IgIJ:sxR7Fbz/fVsMsrbnB/5I2Bs
TLSH
T10152D805AA24597BCCDBD209FA927F53D6F81533B2901E44AAFCCA0C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 92485a0a4868bc6ae6351efd8f4f9178114f8a121e542bf9a25e52c7a3610843
MD5 d6635806ea5a2ff1a872aeac11334dc6
SHA1 3256345765e16bb31380e1ace99b35330272eeb0
SHA512 9ebcca0b18e433c0b3b7ae5665f0a6212cf5a70ff19a1e96ace38364e321a12db6874ebbdbdad2560c1fb80cddd0d94b77a2d7ceb10d8b492eb8c3bbb52d32e7
SSDEEP 768:QMUhBCWgmcfXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVY2oKIro2Q/UigUJ:QMUhBCWgmcfXwu1ja1dKz2Q/HgS
TLSH
T164C20B2B240CC77E4F844EADFC2AAE966DE801CB57588D5447EE890C03C67EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 978ea98638df5bda83901c50d6ff0f336c5c47b8c6757967b2ad3a2c6de3625b
MD5 5ce75c754c0a71489dcc59c9069a5769
SHA1 a0837f2bef8fbd82d1e5260b325648f2bc169315
SHA512 9ba64a65b4fcd54b7ab02dd71538bdeaae84799350f1d34e948ee352e811d65adfa3f1402b8365f08a1afd33f717d0c05f84a82ab1cddb24981c466edacdf9fe
SSDEEP 768:9jaeqD4MlshiLdMm03N34r0rjfdfsTt9fsdZ0SEbuRpag62Dai+fAhvyjWtUTTZ:9qcjhIdMX3iUfdfifnijag6E+Ilyj2s
TLSH
T1E013C076DC788CB78CB36285B61B3A966E740543C6D66F889DDC170E06DB2DE0307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a5dd68afdbb532dc2548d5c54b1f9596f400c48d58046f05bc8568c42b060fb1
MD5 ccea42027c0564778b9d91938731a8db
SHA1 79e35f00e29510644394d9da4ec5632160959f90
SHA512 21680671dcc68e2788ed689adefc63fe727d25f47ba2bc3ab86e55c6c475d4529f09948a9d171dc1ae9a030ae670f8c9d474a7c1d294e1a420441ddb8b2a5b97
SSDEEP 768:Wj+9K3aD4r0rjfdfsTt9fs3Z0SEbuRpag62Dai+fAhvdx3vr:F9K3LUfdfifTijag6E+IlPvr
TLSH
T189F2BF719874CC774CE3A3D6B61A3A466EB4550392C92F4899DC6B0E0ACB6EE0347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 885dc78683e0206793bf64794d8b8f1c1681a54791cc602296cb810cbb1f8135
MD5 d4930f7f322a7e2254fbd3069871c00e
SHA1 87eaf29741e386e85a7187a29ab7e8defb9bb997
SHA512 45d2597250289efd95931ef8983be78ef040f6c8d3047e4de8565724adc9b57a261d1119b22e8c936874fb51a2dfbbadc3afb16734ab4f5913c212b82a81b078
SSDEEP 768:Zj+9Z3aD4r0rjfdfsTt9fshZ0SEbuRpag62Dai+fAhvdx3vr:E9Z3LUfdfifVijag6E+IlPvr
TLSH
T140F2BE719874CD774CE3A29AB61A3A466EB4550392C92F4499DC6B0E0ACB6EE0347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 46150feac74a90dc872c5f9c0f835f91534c12f18b9e2d5fc5d755c36b3216e1
MD5 5386353ec59d283af2cb5b3279c49dd2
SHA1 71059f52add8dd2ae518e5f5faaeb2cea7667a16
SHA512 f1a8cb35b5b9ffd3ab93c10e70589fc136ebf7540ad48a71b608540acf6b991e2f5c410cae6a540445f06ff6d8f32e136895eaa8bd23d6e4dd9d35c81ca086b0
SSDEEP 768:GjaeqD4MlshiLdMmi3Lh0rjfdfsTtCZ0SEbuRpag62Dai+fAdYyjWtUkTu:GqcjhIdMl3afdfyijag6E+I+yj2U
TLSH
T1B003C07698744C778CF762857A173A966E740583C6D66F889DDC270E12EB2DE1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download