17218ee4e5f59d2a01d62714cefb00f8f75b8aac64cdc2a425e135888f50858c

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_17218ee4e5f59d2a01d62714cefb00f8f75b8aac64cdc2a425e135888f50858c.html
Size 183KB
Sample260912-18k3jsba37
SHA256 17218ee4e5f59d2a01d62714cefb00f8f75b8aac64cdc2a425e135888f50858c
MD5 efd073c93113072a66626bc2b1a6952d
SHA1 8fa7e0002702fb9b99c24082634a798852bf5c1e
SHA512 a19c385e9933b51bef7370d252f2daf90157067447944121cd98d60a1fb12c6c2898911f605e27e3beb17073fcead5a47ece858a7e24a04482e0a6694795a8f6
SSDEEP 3072:WtX11H9HHA+Xq94leeGBESlW6R5Kd4rLti2:s9le/Qd4rLti2
TLSH
T1BC044114858F1417BD92C8E923493C1BE054F092DCE9BC54E94CA7A816BEF976FCE788
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2928	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338311316954364"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{D71BA274-9174-4560-B6B6-B92269537B10}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4140	4700	msedge.exe	83
PID 4700 wrote to memory of 2928	4700	msedge.exe	84
PID 4700 wrote to memory of 4988	4700	msedge.exe	85
PID 4700 wrote to memory of 4988	4700	msedge.exe	85
PID 4700 wrote to memory of 4988	4700	msedge.exe	85
PID 4700 wrote to memory of 3616	4700	msedge.exe	87
PID 4700 wrote to memory of 3616	4700	msedge.exe	87
PID 4700 wrote to memory of 4324	4700	msedge.exe	88
PID 4700 wrote to memory of 4324	4700	msedge.exe	88
PID 4700 wrote to memory of 4324	4700	msedge.exe	88
PID 4700 wrote to memory of 1544	4700	msedge.exe	89
PID 4700 wrote to memory of 1544	4700	msedge.exe	89
PID 4700 wrote to memory of 1544	4700	msedge.exe	89
PID 4700 wrote to memory of 672	4700	msedge.exe	90
PID 4700 wrote to memory of 1860	4700	msedge.exe	91
PID 4700 wrote to memory of 672	4700	msedge.exe	90
PID 4700 wrote to memory of 672	4700	msedge.exe	90
PID 4700 wrote to memory of 1860	4700	msedge.exe	91
PID 4700 wrote to memory of 1860	4700	msedge.exe	91
PID 4700 wrote to memory of 2728	4700	msedge.exe	96
PID 4700 wrote to memory of 2728	4700	msedge.exe	96
PID 4700 wrote to memory of 3964	4700	msedge.exe	95
PID 4700 wrote to memory of 3964	4700	msedge.exe	95
PID 4700 wrote to memory of 2900	4700	msedge.exe	98
PID 4700 wrote to memory of 216	4700	msedge.exe	103
PID 4700 wrote to memory of 3776	4700	msedge.exe	104
PID 4700 wrote to memory of 32	4700	msedge.exe	105
PID 4700 wrote to memory of 4360	4700	msedge.exe	106
PID 4700 wrote to memory of 4360	4700	msedge.exe	106
PID 4700 wrote to memory of 4544	4700	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_17218ee4e5f59d2a01d62714cefb00f8f75b8aac64cdc2a425e135888f50858c.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x254,0x7ffa5bb7c188,0x7ffa5bb7c194,0x7ffa5bb7c1a0
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1848,i,8551393441548805811,6553048237508766483,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,16948672958397567384,14701926632699777085,262144 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2228,i,16366388447898680286,11722229173469436843,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,10223587871449689437,5538569433968627326,2097152 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,14829870015723857411,5018181621937334407,2097152 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11929667607374310377,13747718843760824048,2097152 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,8252765341969150566,10307560312727852542,2097152 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5108,i,3143791264523391229,15176916324416247359,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5140,i,5773531723899741862,6436388769344120478,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5888,i,7381707422525965396,12074097553608568723,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5888,i,7381707422525965396,12074097553608568723,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4256,i,12636325666756231586,14873852415324503552,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4940,i,6297910117367825455,16780393149698318920,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4392,i,12917108526594143875,14615983729321097514,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6156,i,12728731844237476013,11273990158817702594,524288 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5952,i,15838960233663858950,4159640859106167672,262144 --field-trial-handle=2300,i,6583476268506436194,17649030481806544299,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 182d894480f78332f1d5a892de8354ffc49a271545776953029ff6e15b29d12a
MD5 35775357f2fe745560301735cd5da588
SHA1 9fad1278471cb274a11c3ee40bcb3e4c05cb1940
SHA512 35e1a1a8af4a81257e61350808d2f35045d869479e4b531e58a7e149e167232ad3c46a1db7acb24414362af83b887a771dfad61c94cbdaee88cfe2a4fdf899eb
TLSH
T1855180817AE4C084FFA45FB1D0C828AFBA32D58CA483BF130FA4E4B96B163748149394
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1be494feaff8293a77b55eafa4c51f5c8152f079dec9b58fb66367bfac830644
MD5 f2c1bf5d9245a362dc36a762a2e5337f
SHA1 6892c9f5d8b9629c97b5e99ec133fa885b57b8ee
SHA512 59e0cd2ef82f0660c037eb916674cc19a19a675f3c75bf7485866c4f9eb27aeb04fa7c278a6ace16e9cb9a1711eddb3db3c806a67b3a06195f4f64b85de39b46
TLSH
T1D021B1F2C3D586BE890116F05A29AD17CD1D0946422C3C16C9D4FF5B93E3071D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 214e004c8910fd0a887fd02109337dacc659c4f7a8e8b92b29bd32986e10d51d
MD5 6b19387b50608042af3f20db69af91d4
SHA1 62e9f4e10672e5d1cb2b1abc328b292abdc105f0
SHA512 f76db8c9a529c436200e9c0cf6fb05180e936636f2a7d0246e3cb1e381c48587268bc899c94755d199b0f0fafd260d80ecc95ba2b86e113520e52fa27c537638
SSDEEP 192:sxZ6RbWv/fcsMNIdpdlHW6+WNGYgU9nzIgrJ:sxZ6Iv/fcsMujHbGuL9
TLSH
T10212A8166E28A97B8CCBE21DBB15BF53D6F9503261911E48EAFCC61C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 48256c3c2bd080df8fe1373e87f2a77b0d1da899dafc6f319a4ea8b01561e2d6
MD5 4d07b602b6b52851aa5d33a6a8ab2496
SHA1 f0fe19a06c0b0f7531a3cfa0432eca6a4ce6b9ee
SHA512 76cb70cb4f2cac8b9e566b07da3f786e6aa6db27bb64f3c199f0777075d1837fe1fcac9097803759e4b1dd6cdf058c9b2cabbc7719ebcdd30ff1ee2b0363e27a
SSDEEP 192:sxZ6RbWv/fcsENIdpHlHW6+WNGYg49nzIg5mJ:sxZ6Iv/fcsEuFHbGmL8
TLSH
T10222A7566E28697B8CCBE21DBB15BF53E6F9503261911F48AAFCC61C05E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b2f65519841c42e85e2867f976441ab6b4dd6728342513a2e38fa1757a4e8782
MD5 da6f222f0b9ff5bf49f099a16fb5c2bf
SHA1 7f430c295cfd61e7d36289896e4c9f217cd291bc
SHA512 3861663c31505eecf2990ad06729db2d3f4c68e5f7ca25158e5195c10acc3607419e035e12d4c00063ebbe439f4f60accc65e25410d95eb2012f909e7ab28528
SSDEEP 192:sxZ6RbWv/fcsENIdpdlHW6+WNGYgA9nzIg5mJ:sxZ6Iv/fcsEujHbGiL8
TLSH
T11822A7556E28697B8CDBE20DBB15BF53E6F9503261911F48A6FCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 44364e74a508472b2bddc9cd01e91ed8fb21e097827db739c7d04ccfd6f3c75d
MD5 fc9180bdee0e3b11dbcde362f4571fd2
SHA1 e33eeb7e95245cf6e058bd5ee466aa4b44d8e518
SHA512 0eb00d0ddd7fc60603fdc18526010f5d34360e35876ebba549674d0073c376e3cbd1f6f5e9dc897fe955bc1ea719269eb4faa6c6456ddbb10b4e655760bc1365
SSDEEP 192:sxZ6RbWv/fcsYNIdpdlHW6+WNGYgU9nzIg5EJ:sxZ6Iv/fcsYujHbGuLO
TLSH
T12E22A9156E28A97B8CCBE21DBB15BF53D6F9503261911F48E6FC861C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e37e7b0fca93ca7d2fe1c99ff3e604abf1466a18d8be25a83819a15fb437e16d
MD5 144fbd2be350da01cdb97951e8176e06
SHA1 6ac91dac3ff861b554ec6cb809967253311705d2
SHA512 e8f7da8f516538b248880b1804bc7a716badb2bc6e8e76a013f424c2e5f75537b4c1401fcc51943fe1ae1ae0b083ef2223bfb6f15b31d6079e54a5fbc1d1717a
SSDEEP 768:IFichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzsro4nE:IFichfPWvPZplu1jan+LKgz3iE
TLSH
T1C8C2E97B640CCA7E4FC01E5DDD1A6F977E9802C7A6588D4047FA994C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5e4f35f2f36bf1f5215f1b9a6d948560fef5a626c6ed31ccd5bac7d573bfe799
MD5 966b72a81b4d940a495a04ae018547d1
SHA1 174adc66cf70c4d905a80aa25a272b05b6f26aa4
SHA512 5a84433d9ce8f17300a143585ca6c8b3a7d51c31e45c90776c9955d1876ecac662b0857fe5b6de0ee29064dcdccbcb264e3169f5fed634b532d33efbece88a52
SSDEEP 48:K00DCOcey7bCxKISm7K9C1Q7x0rYZ6SIyLZo1JTXrEbXyvIShEK9h1LExpUYSTGk:KoLWKQsSKeoKDisLWK4c6O1
TLSH
T1A0A1035072BB12063D7D654985A5972F024171B37058EA7BBFBC21729F2BE084CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

597dc527-3ef0-4228-b15a-db4db3b62c7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\597dc527-3ef0-4228-b15a-db4db3b62c7c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a8299f9732b83a9feaed2379ea6dbf67254556b7f06f8f40060e453b83d95d42
MD5 864617c64a4924066f3b6a32d2fef34e
SHA1 e35d56377c4086af99c1ff0370b1214eb09ab345
SHA512 746a295d5cc285b9f9587bfd62cd02da8bd94ec6cd4363a4b5e31f9a0790e471371695a76557db8b64fb513757d9bbee6e3ad67c4141ea8c4272a416f50c35da
SSDEEP 384:xZcIZsNK7C5YtJBGYX5EWS4It18Ugf7O6R2Feofh7UXoq:ZZgErGYuWXIt6Ugf7TRmeZ
TLSH
T10C827E7298B8AC375DEBA195F4473A138EFC905BA7C86F80D5ED5B1D00DB694130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ba3add4e8a31f048683336379a6604e3ddfc2692f3b71e442453e35a4cd90a95
MD5 a72837aacdeb794269e610d01cf0e096
SHA1 e77dc3b55a3554dd51c08095bf64786de1f231eb
SHA512 7fc87a83bf1010c846626cec165c603eefcda69fe4b74e73e7765eb0e43f7056f2822676cf2ef0d44ac03b6205928b974beaab7b9b527be0f496a86f6dfbfc3f
SSDEEP 384:RiFiZcIsXsNS8TUNTUlIlWC5YtJBGYX5EWS4It18UNf7O6R2Feofh7UXoq:4FQM7wgFErGYuWXIt6UNf7TRmeZ
TLSH
T183A26D7348B8DC3B5DFB9A85F94A3A138EF8416BD685AF90E2DD5E1D009B598030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 2d4c2e953227abfa784c592e5f8e69409da6b37293a3898cda407001cf03247c
MD5 45d1abb99e2f4d635548d595d857a393
SHA1 a3e1bc568416bfc1427794c44f1e47699de0b2c8
SHA512 24820926381111b9a53f0e5b6ebb876e1663250b0ae498875a84aad2b9de560217bd561c35456fa381e8da2a94ab475297e3a1947629e2f7300042db48d3e07f
SSDEEP 384:ssNKMC5EtJBGYX5EWS4It18Ugf7O6R2Feofh7UY:s/IrGYuWXIt6Ugf7TRmh
TLSH
T1E1625C76A8B8AC374DE7A595F44B3A139FF8815BA7842F84D6ED1F1D00CF698130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ad107465bc92a78ddd1b995c5eb4b9b0437c764b8d7311eba08e96635e69a48b
MD5 aa0023a92985e8ffe1b5f1e4fb3e3f39
SHA1 db3a6ef62b6e4fc1bc869e4a64a093ae2eb330fb
SHA512 bed4ef46da8c93e69318858cdcd1866b027c56c8733f2892d4acea565cb29a3a5f063affa43213a51862cf02d096ae27c53a765f83756370f7fa08bf54300bba
SSDEEP 384:zZcIZsNKWC5YtJBGYX5EWS4It18Ugf7O6R2Feofh7UXoq:rZBErGYuWXIt6Ugf7TRmeZ
TLSH
T188827E7258B8AC375DEBA195F4473A138EFC905BA7C86F80D5ED5B1D00DB694130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1af561ebdec91913e9ef9b5aa3221ab19bdf1a3fe24be5e842df35c14b37d253
MD5 676469804160b9826ade8623c3b28b30
SHA1 b0160cf31c8169c11eb516bed306beb3ea925d88
SHA512 9944ad2832fa329bc6afaa455ab9e17f04efcc89ce49a5303a078e5b9e4e6a1cbc2ed8f5dd4d302969621bf412a49d5a87052b0899cbe136a28826884ce24ccb
SSDEEP 192:LJONg6DphmqQmiUygrq8wGYX59eznCS3oInkk7hLqbU6:lONg619DRwGYX5EWS4IPxqbU6
TLSH
T16D02EA39E87C7C7B4EE36E45F5872A139F99112FAA942F84D6E81A1D00D768C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6bde61aa0964e654f02d8f8a3d6c4e5d3997ea950bb264bbd0930fa4d2510f99
MD5 e2e4aa35b48d3deffd776a70407e4578
SHA1 5228da240d1f8c0d72501227c901abf3c408e3fa
SHA512 c2c647bb6039a1ea87dac104cab4ed5aafd433b3961078c7604ddff8087158e7848901846472e86d06b7bdb04550a261bb00ce503f02ecf0f2721658ab0d24ab
SSDEEP 192:LJOND6DphuqQmiUyOrrwGYX59eznCS3oIt18USkIIg/5JL+U6:lOND61JjrwGYX5EWS4It18UjfU6
TLSH
T195121B35E8B8BC3B4DD36591F48739138EA8422BEB887F54D5EC1A1C01DF65C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84477fe9-e96b-4d8e-b8e9-51a148040968.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\84477fe9-e96b-4d8e-b8e9-51a148040968.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d115d47d9e229d6ba6c4c288f3bbad755594c628466b01e9a4d4eea46d9f9036
MD5 0a2daacc6c44bb4151dea15dfa9b9379
SHA1 aa9cad9fad88aeba000c3cdf409055e06fed7350
SHA512 d67d7c757cb7ce94d6f31e295717f92e682b26a063c54deceebdd6d74dad269b6e2f10cb0a970e175456d8166f29373be88beca96fd1c3cf3f37e30e9b3418c0
TLSH
T19141F45CA6EE1148B3B7AF5A9BF7A8AD487FB8672F0A945E10110D4F0622E00DD71733
MD5 SHA1 SHA512 TLSH

Submit Download