855820bb3304610ceece8f20779c1eaeab1894e4498324e903f8a5713a169efe

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_855820bb3304610ceece8f20779c1eaeab1894e4498324e903f8a5713a169efe.html
Size 112KB
Sample260912-1akdcsfp91
SHA256 855820bb3304610ceece8f20779c1eaeab1894e4498324e903f8a5713a169efe
MD5 4252315a9cc545e19d9c557d99093c52
SHA1 b65836b00b1dafb10529ec1cdd889fbb7cac0b94
SHA512 eeebd0577c7d9926dd70f11d41ef62fd3c3a08fec08c16d9ded91b413d7a6ed9c0b73b27d868b78c3f7e53895bbfe65e2d8812b0807746350372293e4cb2dbf2
SSDEEP 1536:gmxTYn+hejSGRYTxnPQbsNilNQhTtNNoXx1hKkCQf+0MbEaoAbEaoCyCJ:xn+QhNG45cbMdoAdoiJ
TLSH
T159B393C701204CFAAF604DB2465F586B3D2C5837AC5791B9E3FD8F9B2B41DAE0346269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338268480323051"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{2CE1EF7D-E4C8-4F9A-A19B-5D85F73234CA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 1900	3520	msedge.exe	89
PID 3520 wrote to memory of 2816	3520	msedge.exe	91
PID 3520 wrote to memory of 4612	3520	msedge.exe	92
PID 3520 wrote to memory of 4612	3520	msedge.exe	92
PID 3520 wrote to memory of 4612	3520	msedge.exe	92
PID 3520 wrote to memory of 1088	3520	msedge.exe	93
PID 3520 wrote to memory of 1088	3520	msedge.exe	93
PID 3520 wrote to memory of 4696	3520	msedge.exe	94
PID 3520 wrote to memory of 4696	3520	msedge.exe	94
PID 3520 wrote to memory of 4696	3520	msedge.exe	94
PID 3520 wrote to memory of 4036	3520	msedge.exe	95
PID 3520 wrote to memory of 4036	3520	msedge.exe	95
PID 3520 wrote to memory of 4036	3520	msedge.exe	95
PID 3520 wrote to memory of 1344	3520	msedge.exe	97
PID 3520 wrote to memory of 1344	3520	msedge.exe	97
PID 3520 wrote to memory of 1344	3520	msedge.exe	97
PID 3520 wrote to memory of 1472	3520	msedge.exe	98
PID 3520 wrote to memory of 1472	3520	msedge.exe	98
PID 3520 wrote to memory of 1472	3520	msedge.exe	98
PID 3520 wrote to memory of 1648	3520	msedge.exe	100
PID 3520 wrote to memory of 1648	3520	msedge.exe	100
PID 3520 wrote to memory of 3788	3520	msedge.exe	101
PID 3520 wrote to memory of 3788	3520	msedge.exe	101
PID 3520 wrote to memory of 4364	3520	msedge.exe	103
PID 3520 wrote to memory of 752	3520	msedge.exe	108
PID 3520 wrote to memory of 2620	3520	msedge.exe	109
PID 3520 wrote to memory of 2036	3520	msedge.exe	110
PID 3520 wrote to memory of 3724	3520	msedge.exe	111
PID 3520 wrote to memory of 3724	3520	msedge.exe	111
PID 3520 wrote to memory of 3640	3520	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_855820bb3304610ceece8f20779c1eaeab1894e4498324e903f8a5713a169efe.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x24c,0x7ff85f10c188,0x7ff85f10c194,0x7ff85f10c1a0
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,17465149745233551718,2464662265562839682,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,16484287125504274851,9615504569132267775,262144 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,1188273535107110938,8753773959780410207,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,1319190983137213723,14754818394921427187,2097152 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,7469539394169510549,3309146651686163520,2097152 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,2054541823218645570,2489322320299575617,2097152 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,1120804252757901091,767378016793072334,2097152 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5818770480474086934,912239880502396515,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10527304226977685138,6562596672959376197,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,7539762884987378201,10472214583355230718,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,7539762884987378201,10472214583355230718,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,11282327851009242066,683880478352729194,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,3744625344260407140,7654148801767959886,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,1000222331983912840,9410238835951755055,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,5432232835316861527,849151852302572469,524288 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5900,i,4842474155376839171,8665077000207203280,262144 --field-trial-handle=2196,i,16750078923012017103,10063478913509954643,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:32

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6ded89b4-9b7b-42be-b897-b7544cb89d3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6ded89b4-9b7b-42be-b897-b7544cb89d3e.tmp
Size 18KB
SHA256 396901096036626548f98dd24709059202d880d80208fd3e59b2516688912cb8
MD5 dad975798d5fb9cbbf0abb1a8b5a98db
SHA1 402c02aada008076d94112dc042aaba176662b05
SHA512 bfe1795e6777774688740efc44421b802c04bfddd6efa1329ac6b5e8acde526aa9affcd43a3df0a4a39ba4fbabeebf84a112139006566e8563b3a7e1d943683f
SSDEEP 384:BZcI8sNGCzMWbom6h//S+Zg97O6R2Feo9h7U0oJ:J8MDy/K397TR4ty
TLSH
T1B0828D7268B8AC375DE7D581F44736138EB8906397C95E80D5ECAF1E09DA6A81307C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b6da4b8e4270fd8dc36938f48536970cd1aca00e1dbf1065e698f20b9db6f810
MD5 7b889a3fdd8b6f6b1bf111aad8e3395b
SHA1 e797eb266f1b3d32623d39d6666e073d938d5fbb
SHA512 5201756a4497d20776df2417405d31a62fddc2752209d6d0588ab591523fa06814643812693f533401b40cc6436272d21f3fb46345eb453f25d9eade54c6911e
TLSH
T119516145C59280B2FBDA697092D1138F353C79A393AB2D6535CCF77B0B8BB455234816
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ec7e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ec7e.TMP
Size 2KB
SHA256 5b3d8619e7b85706b42d2cac63725f843273b861464167452259f2496a3565d2
MD5 2620feeeb8194c44ca5d91a9fad6d1f1
SHA1 5918e2859e55be23bc6eca717860b10d78e1f2c8
SHA512 25e637e6049ccd893a228fade1765bfa8692da8d082ea8b3491d537ab563aa4287ad06c772d77452593ea0415b931428f810c3596075f196b6d90c0ba348f4b1
TLSH
T180516045C59280B2FBDA6A7092D1138F353CB9A393AB2D6634CCF77B0B8BB055234806
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1fb0480ba5d4ce0113ab1dd3b72a6c1db2bc6e45a89761f61e3cab4cedad0cd3
MD5 6b0d9b4da17a28e1658f4ab37686d8be
SHA1 7bc07ed22e1c4968f514640d062b0ad47e872983
SHA512 a7c7492b64e957721124be3a4088fa2b6d77c9fbca574f0e865aa1150cfb1924a2a6feff91ee9d7494120c6539f620e629439a5852a24fbec23bf49f48a052d1
TLSH
T1094179B7C3D4877E891156F09B24AE6ACE2D0A56432C3C1688F4AF1F63F25B0D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 811854f10e8232e27bd3e9a28cb716669b8e71f5ce880db98bd3b89051e9ed5c
MD5 dc45fa6276eb44a19a8aab16e8d149de
SHA1 54145820fcbc2e244aa5fd5459fca05848170f38
SHA512 2f79c02221d28210a51e05d66053fd0e8217360b64a70313d1336472b6681530d5601e0426df1d968e0ce099ed0d288426ab75e2a1bd91b8ced43d2bd0a01bec
SSDEEP 192:sxZKRsWL/fpstxpraIdpdsHW6+WNGY36atpIgrJ:sxZK9L/fpsxzSHbGXI9
TLSH
T10B12D8526E28A57B8CCBD20DBA25BF53D6F9503290D41E58EAFC861C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4ad7891795b90d1514447e150cecc90dd5bd5bdfaa8f30931fe09919194dbb15
MD5 8213a5b3027ee23bb611ec1e12dd1faf
SHA1 a03762e37dc7d8530c4676d8e7eb4549ac82e3ff
SHA512 8e855f9da175c23ac3af4dd1f02ac765755b269d0db29a00e08314f49a291903596864c634e8a0416e60d027f8404936f81782008d98f4848e9bfd1cf8681d31
SSDEEP 192:sxZKRsWL/fps79praIdpHsHW6+WNGY364tpIg5YJ:sxZK9L/fpsfzMHbGXmS
TLSH
T10F22C9526E28697B8CCBD60DFA25BF53E6F9503291D11E48AAFC8A1C05E7BCD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4228926f51c7b5f7e32a576934381dadebbd4f52dabf09644e9669750c11359c
MD5 736c6b949bf6c66fc8843083ecec357d
SHA1 054eeea836957a544d0536b47c1b35c91f6f1af4
SHA512 98de56711c247638545d8b23cac82d6498d0ee1e47a20c2b314ceb5f139a851b23ed8b70fa6a7a82bcf58193570cf26aec2b6cb2a7d8885d8eb0c6c157cb903f
SSDEEP 192:sxZKRsWL/fps79praIdpdsHW6+WNGY36YtpIg5YJ:sxZK9L/fpsfzSHbGXGS
TLSH
T18C22C9526E28697B8CCBD20DFB257F53E6F9503291D51E54AAFC8A1C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 59d974516969d721433c38bf483bb7f96366ecb545f29e47088309ef4ac5d4e9
MD5 5b639f31a61bf16b896c9b486730a1f9
SHA1 1d8ceddcc74a8d14fb69084edb626cda145fb32f
SHA512 1f38cfa301323b0fb7b4e739b60815e0cab130a3de24ce613bfb727de635091d74027fda522c59a9a157363b1c199a66bfdc9220f96a4e984da814399e19deda
SSDEEP 192:sxZKRsWL/fps7xpraIdpdsHW6+WNGY36atpIg5yJ:sxZK9L/fps7zSHbGXIo
TLSH
T1CE22C8526E28A57B8CCBD20DFB25BF53D6F9503291D51E58EAFC8A1C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c07868fdc0f426959802606706df3b06fd6d8118a2fa9f9258ce0a964aef29ec
MD5 b15225d25d6324c90e88698ec3dd0be5
SHA1 de928370c458b4a76ca3655443f1a22d90c40dd3
SHA512 e338e55215772020517c1a64f0bbdbb20b7e621688ee0c93a4a88351105d82560a51f5c719d90194c67dd99b7dad1c73867714b8f33109bf2ee76e2423009e4a
SSDEEP 768:4qKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/Projt:4qKlm7QWvUYe0u1ja8/L/E/cjt
TLSH
T165C2FA3B640CCB7E4FC05A9DDC5A6F9B6EA802C7A6588D4047FA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6ce9bc6448de39da70aef3acf82343bbe0188d85c371e47dd82e4ece5effd0c5
MD5 e06b19fcea9a4989c28b88f80536edf8
SHA1 81af51d0f64832273fdfd7ada3ae324bdd2cc380
SHA512 fb752f4f10e39992e1bde76a25a246890ee76a63e155000f2e8b24e8fcd8c76ef13beee5a362447d2b423385fda8aee4b523c7c7ff2cb1ccc0569d482125b923
SSDEEP 48:K0Mb6G02aDbqpyIS+DK9a14Dx8TYRi6AyLFk51Hznob7+7ISNoK9t1foxt4Yuf14:KILSKEkOKK4KP6ce0KDqeul+KOA+
TLSH
T1D5C1FF1176BB024139BE29988272871B524136733418E72BBFBC50A1CE6FE085DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 12377b32a4734562012689b855d26f8a37bd1cfdb709616525219b08b1a25815
MD5 34127e44173b0ec76a954597f9534c0a
SHA1 86e9056b19e8ed4016acc2648811e675f242c9ba
SHA512 d50f91ad0191be9ca9ddb17895639cb3336e12cecbda791f0f6525f8b01f7a6cb6e38eef395267296fce84ab77776418690fff033b4906606283b94fb9af9a4c
SSDEEP 384:uiFiZcIGWsNG8TUNTUlIlvzMWbSm6h//S+ZT97O6R2Feo9h7U0oJ:FFQXfwgpFy/K897TR4ty
TLSH
T1F9A26D7358E8DC3B9DFBDA85F44A36138EB850A3C6C5AA90E6DC9E1E04DB1D81307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 857e6d3bc901293ced131e0e9308fabbe14753dddf4a50a9e9dd9c6e8a641e87
MD5 c14fd639e66c0a8a612ad02e9aff5a42
SHA1 f5e24fb652cbe7f3a0d79119634e469a35cc8432
SHA512 73681c0d2cf6ad58e8c357ffe1c1923df807210430e61eed4fb10cd1368a8f963b71d5d3f170df9e122eac857ce96b8c37c417745aa044b83a974d6da3d38d67
SSDEEP 384:zZcI8sNGvzMWbSm6h//S+Zg97O6R2Feo9h7U0oJ:r8pFy/K397TR4ty
TLSH
T1CD828D7268B8AC375DE7D585F44736138EB8906397C95E80D5ECAF1E08DA6A8130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6859829280938c3fa0279e95457b0709e9dc1386773b180cf9cda871ff487be1
MD5 8fe3c47ec58add16665d22326defcd4e
SHA1 214a7b8124e50fed73d000758ffc68a5d6eae18e
SHA512 81bd7ed038cdf3ba77bba0f031fd1f4b6be3afaaaf8603700d9ae3b397205d255a60cd0965663d7ef9968e60c6961abc8578f212ccd353abd054b0cbafe30dac
SSDEEP 96:KqONkiQsjpfbUmjH5ih/cIPURHl8h4otop5EaDKBKP4v+Y1xf//ojdqxERtIgBCO:BONm6JUm0QmiUyFaso//S+gBCGQ2U6
TLSH
T17F02D739AC787C7B8EF39E45F0873B239FA4106BA6916F84DAE81E1D01D725C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7db0985ad01ab78de7ee235c6c8e9ac6122b324329e192c5c592170804314d3
MD5 687b2d885c21d07928c2366a75d5f369
SHA1 3ec7cf5df32426d8b6514e4b611191cf12badcc4
SHA512 d45b99b88866bebbf65475ff310b755b752344cc49ff38f5ce5576684d26b1e708bf38e3cb93e281edcf1d7bcb22e38edfbc63b4e60b3f94fac256ccd6f2d657
SSDEEP 96:KqONkPQsjpfbU5H5ih/cIPURHl8h4otop5EHoDKBcP4v+Y1xf//ojdqxERtIsx63:BONH6JUKQmiUyEeamo//S+ZXNx1/BhU6
TLSH
T13D121935A8B8AC3B5E939981F08736139EA44127DBC56F94D6EC2E1D05DF29C230BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

308cefb0-9cf6-4a2b-9a7d-c191e19ba5c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\308cefb0-9cf6-4a2b-9a7d-c191e19ba5c3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c580bc812163684b1c3e754c9fcb893ab52669bb525be1c78cda0d09e8b0e907
MD5 564ec126260165cb033b3464d362c103
SHA1 2225901985f14732994cda08cee0e31bfef9dd5b
SHA512 4efa4d2d41d6ff7aa4b45ea553178f447280d14cccd7ca0859bcde04b8f5f9a5b385f379b33f3559cb5deaec0e762c68c26f63acc34f5bc8b526811cc65dffeb
TLSH
T1EB412A58AAED1158B3B77E1A9BF3A47D847BB8372E06945D10110D4F0A23B40C9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download