9f2d2bee5d30398d7bd91417021973a7af4f509a69aada535fb7db1492f66fe8

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9f2d2bee5d30398d7bd91417021973a7af4f509a69aada535fb7db1492f66fe8.html
Size 140KB
Sample260912-243bpsgr6v
SHA256 9f2d2bee5d30398d7bd91417021973a7af4f509a69aada535fb7db1492f66fe8
MD5 82bff2452c1183acac10ddedde19a5ca
SHA1 54067836323c5d7bf1e3f75508a2ae22a859f125
SHA512 01983bf70644ac1a7a9c15e531438ee685545b86c85665c61d793493529d2fcf6214ec0ffee9a8072df0035746578a79e4b94d2d3f41bcf4bc333478545e3c68
SSDEEP 1536:2mx+Yn+hVnzURcIaZIb4F6hlVQuTt/Nocxu9JSbEao9bEaow4yGCyviya0Jlts4j:vEcQmNUHSdo9dowTGJha0Jlts4j
TLSH
T12CE384A363208CE5EFF859B349D6096F3C2E0537980260B9E3EDCE969FB791D0349459
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338274164888122"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{B8110259-06B6-4A1A-9D1F-4E8DE08E2AE2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 1352	4480	msedge.exe	85
PID 4480 wrote to memory of 2792	4480	msedge.exe	87
PID 4480 wrote to memory of 5068	4480	msedge.exe	88
PID 4480 wrote to memory of 4852	4480	msedge.exe	89
PID 4480 wrote to memory of 5068	4480	msedge.exe	88
PID 4480 wrote to memory of 5068	4480	msedge.exe	88
PID 4480 wrote to memory of 4852	4480	msedge.exe	89
PID 4480 wrote to memory of 1728	4480	msedge.exe	90
PID 4480 wrote to memory of 1728	4480	msedge.exe	90
PID 4480 wrote to memory of 1728	4480	msedge.exe	90
PID 4480 wrote to memory of 2304	4480	msedge.exe	91
PID 4480 wrote to memory of 2304	4480	msedge.exe	91
PID 4480 wrote to memory of 2304	4480	msedge.exe	91
PID 4480 wrote to memory of 1140	4480	msedge.exe	92
PID 4480 wrote to memory of 4636	4480	msedge.exe	93
PID 4480 wrote to memory of 1140	4480	msedge.exe	92
PID 4480 wrote to memory of 1140	4480	msedge.exe	92
PID 4480 wrote to memory of 4636	4480	msedge.exe	93
PID 4480 wrote to memory of 4636	4480	msedge.exe	93
PID 4480 wrote to memory of 4528	4480	msedge.exe	97
PID 4480 wrote to memory of 3488	4480	msedge.exe	98
PID 4480 wrote to memory of 4528	4480	msedge.exe	97
PID 4480 wrote to memory of 3488	4480	msedge.exe	98
PID 4480 wrote to memory of 2928	4480	msedge.exe	100
PID 4480 wrote to memory of 3860	4480	msedge.exe	108
PID 4480 wrote to memory of 4856	4480	msedge.exe	109
PID 4480 wrote to memory of 2696	4480	msedge.exe	110
PID 4480 wrote to memory of 1784	4480	msedge.exe	111
PID 4480 wrote to memory of 1784	4480	msedge.exe	111
PID 4480 wrote to memory of 3960	4480	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9f2d2bee5d30398d7bd91417021973a7af4f509a69aada535fb7db1492f66fe8.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffeabdc188,0x7fffeabdc194,0x7fffeabdc1a0
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,9517873640978618262,15109468593012091104,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,12031254797174888551,14687463599567154712,262144 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,3413327768757450229,7717383089590956896,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,6624566877154840949,10190193515280492108,2097152 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,11920180624800632992,1285932934268308378,2097152 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,17765507563698286692,9699524273477112784,2097152 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,9798879179513917747,17331192759885573554,2097152 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,3135192375044216429,4094415617371047033,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,18176320236407494187,3321215722303758639,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13383795481276535937,7429878983632583012,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13383795481276535937,7429878983632583012,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,3032976688751958106,10417503261511190545,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,9084466958772315371,6490117199839862071,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,16964090952804015782,16684610866693947473,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,16556594706538618540,9365682891722857554,524288 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5932,i,13552527687009462282,6881095727775108124,262144 --field-trial-handle=2880,i,16126456289559029485,1150692192550966226,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

86a9bc00-1558-4c9b-898c-f848be94122e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86a9bc00-1558-4c9b-898c-f848be94122e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 92703ab4d3b80d79a3940080c252681939894ef2ecf4a9f6411cf3e78731a86b
MD5 cf03cd67c0cc5088bd71726a3170167c
SHA1 2572951df58f8a58e6faaeba882c7b47f510f3af
SHA512 df8fb0fff53bccc888146c9fd125b5b7e8dd2d26e1457f8e65f35ae26e6715804e175984dcbcca19b3f36bc1ecac6559d8d04589fdf38bf5ce6c93021c3b9e9a
TLSH
T1B351E9904E6341CCF79DE73582D4168F36309971AB830E2767B4DCBBD87639553DA050
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3ce619ad6ff2913bd495db9a2e7c30d887382c75060ae9eb1a1d1ed21c89c2c8
MD5 ade05b160eaf065bd1880c8ce4c59f92
SHA1 abe3b07a4c9dfb1b68cacd451a97792788c38c84
SHA512 be3d45319c17fc3af728557eb7746e968cc9be99b91262023dbc915c6109a989f85befc9e0eb5a630ad3133efaaabd243842b93876dcc8192b6f275baa5a9e02
TLSH
T19741BDB3C3D48B7E890517F0AB256E26CD1C0A0A522C3D16C8E5AF1F63F28B4E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 172ef03fd9d2eed2361c717def094dd43873d138e399bfcd4476441eccc85891
MD5 124d8d4fd9aff63f45bc93206679d804
SHA1 96904607859b526982031736def6cdd30c58094e
SHA512 a9bf247a0acf3a402efcf4d7b5a70d1c8a63c7816732a67d09f301fbdf9fe55f2133431a4fbc0175e64afd0892cb7aaee111fac1bb7ca06b82ff59bc06c6423b
SSDEEP 192:sxZQR3WC/fxsbLSCIdpd/HW6+WNGYapYu7IgrJ:sxZQgC/fxsH6pHbGr9
TLSH
T12412B8126E38A57B8CCBE20DBA55BF53E6F9503251941E58EBFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 329a6498213de9c61ed6ff25c3bb85e64298c09a8bfba14b261f7226d5bd7ee7
MD5 d4bac40b9d7e42fd92aea1169df65dcc
SHA1 d5f5e724835d9e74a45d013d0f71432d51e112ba
SHA512 03fd340153546bfd893f03574f658bb501f3e07db08a33faeaa932f2f58b281a0373ae8e4125f9a5a96afe9e8c5b7a01215615132f7ff497f52a8098bb5e218c
SSDEEP 192:sxZQR3WC/fxsG6SCIdpH/HW6+WNGYaphu7Ig5ZJ:sxZQgC/fxsj6fHbG4F
TLSH
T16D22B9526E38697B8CCBE20DBB55BF53E6F9503251911E48A7FC8A1C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 be7302d1733366914bc733ac60771784f286c8709b1aa3822fae388342162c65
MD5 b930002d2cbc89fd4670c993a2de0f4d
SHA1 18ae9f83d35c648d417c9f002f79e2a63b6c64c1
SHA512 0c8dfb036f97a2a33f772a52ef836bbfdff91e827b811cee2f53aada8123782e60cc98347fb6331cc5e14c3564e0d27defe495d142c413ed02845518110367e3
SSDEEP 192:sxZQR3WC/fxsG6SCIdpd/HW6+WNGYapmu7Ig5ZJ:sxZQgC/fxsj6pHbG9F
TLSH
T14422C8526E28697B8CCBE20DBB55BF53E6F9503251911E48A7FC8A1C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 dd72d7524c29e0b9a721fd296b45aba52010d3df43c4efd464476c47c2bab6a0
MD5 f88ec3343200b76c7d962dd4d0e16b1a
SHA1 1fbdf70b776537b09031086b3be6493570872ff2
SHA512 5e46e7cb32aeaf3ab3d5017035695eb07fcff647ac615da9ee7a772b0b2727a267ee4d905c33e05faa61d41d286141969d3a8093d543de7bd6f0dce567a08854
SSDEEP 192:sxZQR3WC/fxsGLSCIdpd/HW6+WNGYapYu7Ig57J:sxZQgC/fxsO6pHbGrT
TLSH
T14422B8126E38A57B8CCBE20DBB55BF53E6F9503251941E48A7FC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 088cc2481a2e6346408a11b4036d40764fa6ffb61474ab8cc57b7024c9ef6cb6
MD5 a1880b354a08e74e3fd96607634a1866
SHA1 7e77724bdb4153dd20a7661b7635d7834431ee52
SHA512 483a0063a4bf54d7b6c45b7b946888d6b5270d8b913ad06b81a3d4b51d7e22636ea4eb7e6802d59e66b8ff6e2dabff32e2935dccd24df5ba165de45472bfa337
SSDEEP 768:jNWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7yro48fenmRH:jNWPcLKWvKeEeu1jaClLiF7p48WnmRH
TLSH
T1EFC2EA3B644CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 925eaa1c3b303e14b21b1ae88d21fb6a85b52d7b691cf418003b6fb82a4f57ce
MD5 7a3b48dc748b34d97da397a5ef66ffc7
SHA1 d95875854527cc2d56012bb30aaab7575a224993
SHA512 b9e51c8688bd2eccebb37d7cba2ac271799a8dca7da89a5fab5efdaf5091860014af9d8d51af48be8fcd23fd95033754443cee0b050b4534b9bbd59a69759c6d
SSDEEP 48:K0OpEIGM81bAHIISg1K9E1W1xulY/A8OyLjGnDtFVWbFIdISDWK9z1hWxrGYQx5b:KoF2Ku8aK8AKpKG+IKTq2qz
TLSH
T1F3915F0131BB160078BE7A4D81A1972E464676B33019E62F7FAD04A69E6FF044EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7de1bf03-5d77-482a-902c-30a6d5a6ddcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7de1bf03-5d77-482a-902c-30a6d5a6ddcf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 c4c9b62d82d7ecee455626beaad8ed058e09593cc0b646b1432ba9042259435f
MD5 45c3342fbecdcc5e3e1a8bedee41808c
SHA1 a702ff57b5e9f83fa4ea53c9f11092fb3d79f57d
SHA512 9a34c8b754702de9d0e751247a8f2aaf7bef65cc0bbd39bdfc4aeefd0b481138e05be1b658a52f059e6c57ed12fb2bc4da0e32444f69e0eb5362ef6a0de319eb
SSDEEP 384:ciFiZcIrUsNR8TUNTUlIl2p7k1mlTKzIGmnZctQaJiksa+VYnlTpo5:HFQIgwgcoQQ+ZuzJikhg0K
TLSH
T166A26D735CA4EC7BADFB9A85F94636138EB441A7C6C8AA9097DC5F0D00DB28C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4c306f422f6191c131e8179736601680ec51564eb583d2d9478d5bb747cccd04
MD5 7b1bad11ea2ac90fcf9839ac3b75e29f
SHA1 21d54c615d82f83ed7b294a1728c65cb1520b6db
SHA512 9bbc1fd780691496771877689bb5bcd39180ab9a87e51fa9a975d245c2adf95415abc7ade4ade69d49bfa9bf63ee955bd5e3679200b0666496805ac7208f1e9c
SSDEEP 384:OZcI6sNv2p7k1mlTKzIGmnZctQYiksa+VYnlTpo5:s6JoQQ+Zupikhg0K
TLSH
T1EF827D726C78AC779DE7E145F9873A139EB4816793C86F9486DC9F0D00DB298130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2e0d509283f58d7b0f6ea2edbed7cdab9e2016069ef0e3955200ab54588fa7d7
MD5 d616b90d68f085992fe16d7d65557f6f
SHA1 8cc4420d341e65b18d564f1b8bfb0abd8a14b014
SHA512 bb45a89aaf5385da13d024a15fdc9819e44b6cd9d48366627381473cf1c561414a7ecd846c8319d973edcfe699992b354096d0296f4767f8053c32d0f9bcdd0d
SSDEEP 384:JZcI6sNvDp7k19lTKzIGmnZctQYiksa+VYnlTpo5:B68oJQ+Zupikhg0K
TLSH
T198828D72AC78AC779DA7E145F9873A135EB4816792C86F8486DC9F0D00DB398130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dc48cdb40741afee4bc05ad31b1c6db9f2790033b16dec5afb95c83ff69c1604
MD5 10239d6c591ebb4f304ea30eae4f0048
SHA1 474a12c3e69b9d380753f555637dc8d1ee86b73d
SHA512 24a5f062f910ef85d248a2d4c29ea96c39b3615da70cbdb6305c9d381abb2ced745b4c5d3926ff9e1f7f2b8ce7e79ac5c7e4a485e42cabeb11f9a96d76021766
SSDEEP 192:aONa6IEHQmiUyovTTWuIGmnZALtQuH27Ht/SU6:aONa6DpXTWuIGmnZctQ3HkU6
TLSH
T191120A75E878BC779EA3A844F4873A235EA54227DB897F80DADC1E1C01DF25C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 722e4d1a7a60a120c51d7210ab1b07558808213e98970f34745c864c9f809c25
MD5 243245a51cf6c49e1706c16c65e7d6e3
SHA1 97df2a737cb701f742eab99c5a72dde794618f4a
SHA512 46d2b0cffbbf3cd9383880c8fd60905d3d01c61e281fa2fe1427182218c19646918deaa457ea2243b516e0a1afdf6f984a20756fae7c193c24b5ad805025b1ac
SSDEEP 192:aONr6IE7QmiUyavTPuIGmnZALSC7su1U6:aONr6DtDPuIGmnZcXseU6
TLSH
T1DB02E935EC78BC7B9FF3AD49F4877B236EA5112BA5942F84DAE81B1D00D724C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dce047f9-6438-4812-bc7d-a7af114a47d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dce047f9-6438-4812-bc7d-a7af114a47d9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 30732e599200cc216d96a6a7ac9b3687e6f505885ab5589e71b75f09fb96537d
MD5 662f330d1eec3de1c64d9439004abccc
SHA1 7f4e0e9e3e511a7ee1a4deda469bd73b46e56403
SHA512 566d02da53b38a609106f4832df24d257899d8bb7f4411894651f3e6bf75b27f45fe2b4ba156912240216976bac5167aef425e9a0a878078dec1b38291b7204d
TLSH
T13941185DA6F91048B3B7BF5A9BF6686E447FB9372E0AD46D10010E4E0623A40D872737
MD5 SHA1 SHA512 TLSH

Submit Download