0faa614ecef18d8bf9dfb7e162f233e1d37eb1fee462bedcfcc39d184bc3cadf

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0faa614ecef18d8bf9dfb7e162f233e1d37eb1fee462bedcfcc39d184bc3cadf.html
Size 6KB
Sample260912-2h486sbb66
SHA256 0faa614ecef18d8bf9dfb7e162f233e1d37eb1fee462bedcfcc39d184bc3cadf
MD5 a486e1dca99fc6a9cecb62c53971b8a0
SHA1 428ec487c3cbfaba3332e78b54eb2a4604a87bb0
SHA512 37e22b3ce977f1360dd62b3984cb8d583db32c6fb3917e75020603df7521d812cfa3bdbcd826eb5ad93f1715b4fe9a8b144817e5677c79d7a48a599b9d8aa761
SSDEEP 192:zWLv15G5WDNlxeqmngZ1nZ69dzEcE8XECgUdDhQoKDejCPJu:zWLJlxeSf80WhtKDejCxu
TLSH
T10CE1B65A9E4C853F4100059BF0A16A1CD8DB447BD312D8A6FCFF412E3FD9EAA45375A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4868	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338319858669821"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{658A324B-AF52-4D37-8960-3A23620547BC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1668	1048	msedge.exe	85
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4416	1048	msedge.exe	87
PID 1048 wrote to memory of 4416	1048	msedge.exe	87
PID 1048 wrote to memory of 4416	1048	msedge.exe	87
PID 1048 wrote to memory of 3068	1048	msedge.exe	88
PID 1048 wrote to memory of 3068	1048	msedge.exe	88
PID 1048 wrote to memory of 5000	1048	msedge.exe	89
PID 1048 wrote to memory of 5000	1048	msedge.exe	89
PID 1048 wrote to memory of 4584	1048	msedge.exe	90
PID 1048 wrote to memory of 5000	1048	msedge.exe	89
PID 1048 wrote to memory of 4584	1048	msedge.exe	90
PID 1048 wrote to memory of 4584	1048	msedge.exe	90
PID 1048 wrote to memory of 1104	1048	msedge.exe	92
PID 1048 wrote to memory of 1104	1048	msedge.exe	92
PID 1048 wrote to memory of 1104	1048	msedge.exe	92
PID 1048 wrote to memory of 4124	1048	msedge.exe	93
PID 1048 wrote to memory of 4124	1048	msedge.exe	93
PID 1048 wrote to memory of 4124	1048	msedge.exe	93
PID 1048 wrote to memory of 4640	1048	msedge.exe	98
PID 1048 wrote to memory of 2828	1048	msedge.exe	99
PID 1048 wrote to memory of 4640	1048	msedge.exe	98
PID 1048 wrote to memory of 2828	1048	msedge.exe	99
PID 1048 wrote to memory of 3248	1048	msedge.exe	101
PID 1048 wrote to memory of 4024	1048	msedge.exe	107
PID 1048 wrote to memory of 1348	1048	msedge.exe	108
PID 1048 wrote to memory of 4372	1048	msedge.exe	109
PID 1048 wrote to memory of 3164	1048	msedge.exe	110
PID 1048 wrote to memory of 3164	1048	msedge.exe	110
PID 1048 wrote to memory of 4032	1048	msedge.exe	111
PID 1048 wrote to memory of 4032	1048	msedge.exe	111
PID 1048 wrote to memory of 1476	1048	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0faa614ecef18d8bf9dfb7e162f233e1d37eb1fee462bedcfcc39d184bc3cadf.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffffceac188,0x7ffffceac194,0x7ffffceac1a0
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,9004205948233103415,5168698550300406537,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,8400546968196162325,13659984902131410208,262144 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,14021834205732097820,2291796564468874007,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,6134990029224318170,3689496661925561622,2097152 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,14958863208384590950,1756072913202877886,2097152 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,17214998885815344340,18134002121585884956,2097152 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,13123047804215397349,14456199085893727765,2097152 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,16966787828388566807,8387070165314249259,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,8172580530005187134,3268641090577721511,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,15352447728931118723,3662588767917290470,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,15352447728931118723,3662588767917290470,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9855219514596681242,9561403793618722330,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,11972544327996944081,16881198632263103899,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,16820149896590176586,2231286450511784661,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,12970001703046197097,5886116443912591892,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16497196337275810264,7637974089256475783,524288 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6348,i,11633241610806036581,5672890699539514050,262144 --field-trial-handle=2376,i,7402806501733551075,7839603144605901547,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6289782622b1b5735b598db68207974dfdc50d408c3eea79838b433aae11a452
MD5 3c99c21f10de40ee8f5af9a277a804c4
SHA1 35d3af6ffd5242fbf5c8472bc7361775ac8dd563
SHA512 96ed1deda7741da184238eca29e6f9398d01b0e53a16b381afb87f8172ece7199dedfb996504d610c2f78a31b5dd0f47decd2d53e2b1b2a49c184ac316af5bec
TLSH
T18D61D490D6D1C365FFBFD9719B9532EF3A6CC9D204877D1243A8DB78A84EB0982150C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f94f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f94f.TMP
Size 3KB
SHA256 6159e56f7467b177e353adf612b536476908f76ede2fc78eeedd4813617f884a
MD5 d8c66164cedccf7f73ea3db85c24d351
SHA1 074457e66241ad009562cf0dc1df383dd13d0a43
SHA512 3de30d7fafeb74734b024c00690c92c1968cd2ee808a786db0f58e243ff8e34691ca5e5a257afb04a3a363f93ea5128b97d88a66db42802727fce67489405d59
TLSH
T1D961D380D6D1C365FFBFD8719B9532EF3A6CC9D204877D1243A8DB78A88EB0982150D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c4c2688edcd8963984c6fb3667b9f08892236ed899e22948558cc6f5011aa32a
MD5 abc46318741de389f1e1a11847de5ecd
SHA1 0980eeef028eb248601e64456ee7bfaeb6f63ea3
SHA512 9dd656f1aa1b2e45bbf5daf01c6d50fa12e9cc5bf5f510dfbf3a0e0559e95205b7453175e7467c5ac80b6fd60c2793196374dccf327169d9d54ada05c8490e39
TLSH
T1F12182B3C3D986BE890156F05B24AE2BDE1D0956432C3C19C9E4EF1B97F24B5D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7e8168480d5bcc0203bba015f5789500509171f98216cb1f3e37a9a7e1d3dbce
MD5 035c5e12f552c87d4a53edb1561689b2
SHA1 5220c7982046d03c183867314187a518bdc6a2b0
SHA512 6cb2e49d8f38327d841580ccae885e316732029146608635d03da8afaf40ce0a132bd1ca2f3c5eae468a4567e628adc1e8187279d84c6bc4a123602fa47521cc
SSDEEP 192:sxZvR7Wk/fPsMuIdpd1HW6+WNGYRPRaYIgrJ:sxZvQk/fPsM/jHbGm59
TLSH
T15B12B6166E28A97B8CCBE209FA257F53D6F95032A1D41E48EAFC961C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3405c3d25ddcd034c7c8f737633a36ee81f7a3467eb598c904d1141d4d92351a
MD5 537fc2c5d6e8b6feed63e84681c99517
SHA1 a83bdb2e64e25107ca3cb636f10d33c58b6aa857
SHA512 bcedc1293a5f95ddc05be85ebea4ad811e15b1c10edf44320bc96935c75a45ae564d7d25f203d7a2c34ada9479f88e1a84f33017c2330a3bf00b084572ae2415
SSDEEP 192:sxZvR7Wk/fPsiaIdpH1HW6+WNGYRPZaYIg5FJ:sxZvQk/fPsizVHbGmxx
TLSH
T14222C9566E38A97B8CCBE20DFA15BF53E6F9503261D41E48EAFC961C05E76CD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 948ef5747d56078310fd7338fe16bd0eb918a4217a623558cf884c0c62b8470b
MD5 06a23a04158f644ed25dd47dd308909f
SHA1 78c12aa7014a3719932f0b5d017f859477bddcaa
SHA512 5e12a1a58a1906c18a1a3b75e2510d7024aee4c2e3781652c39a32ff7e25ddb35e7b720d85b178a925f7d5d046271b097440b5d601ca8759b33aaceea3e07d12
SSDEEP 192:sxZvR7Wk/fPsiaIdpd1HW6+WNGYRP0aYIg5FJ:sxZvQk/fPsizjHbGmGx
TLSH
T1A322C8166E28A97B8CCBE20DFA15BF53E6F95032A1D51E48EAFC961C05E76CD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 66c841c4122074f49a9ab99189fa7bd1aaf5677833ddabea2adccc17955f5cd5
MD5 75360b56f5a53eb61403851744d31a22
SHA1 80d160b455636219ce02ecded60263922548ad54
SHA512 d227fd010bd26ba7a115da136714214b9b1a9eec3ef243a49076f6037564e48694fdf6adcf4352f2f086bdfb74701029179491006595dc40ac032d9b59912807
SSDEEP 192:sxZvR7Wk/fPsBuIdpd1HW6+WNGYRPRaYIg53J:sxZvQk/fPsB/jHbGm5v
TLSH
T1DE22B7566E28A97B8CCBE20DFA257F53D6F95032A1D41E48EAFC961C05E76CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7499d221134c2ad8ca91ba7e290cb661f1009fed5139eecddf60463f1ce8b1a8
MD5 fcf1fb6830f7e813a46e842af79874c6
SHA1 335d3d9e6fd780c4dd9d1cce0049a34b2f9f161b
SHA512 eae4768bf1eebe78adeefb3c586fa87b2c542e93dbed7a5d3880231c855b1762dca5eca49659689b6b25245bce45b807dc2c8da4116752eef16124a738743df7
SSDEEP 768:RNK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3iroi+BY:RNK9uzYWvcQWsu1ja0HL7Q35i+BY
TLSH
T140C2F93F640DCB7E4FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7205b8a5712207406c93571d6a0eea95d6804d4cda6805df45c097ee5198bbd0
MD5 4ce0ca28dbdc70b606951d9d71cc173c
SHA1 70a14b96d716b7676452f9982511387a66034f7e
SHA512 038a0eb65d2068cfd00c1a9a18615a4d0ee7aee9a48d665adf21c1ef0ce2f248c74fd309c8c1e4945b7b8dcc7a0fa5096acfb9885a8139fc98774b23ab3e7113
SSDEEP 48:K0mImmBcAeEE9bI/wISY9K981+9xWtYXoEPyLZo1JTXrEbXyvIShEK9h1LExpUY2:K0m9luKuMjqiAKTaS27MKbCHO3CeQT
TLSH
T161A13B4434BB0654B8BE255881B5872E469175733558FA3BBFBC406A8E6FE080DFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a03aa37c-4af3-4d52-8325-9b9d0d27e99e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a03aa37c-4af3-4d52-8325-9b9d0d27e99e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5996a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5996a8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ed71d93c380dc8643238266ca7406f016fd2bfce6a44c5a5e61827e506f69ff4
MD5 aef1b850e75b97d828a8d207ae3b634a
SHA1 7fd54c0a97822990c070c6ea843ff1d4d64c4cf5
SHA512 e655f2eeb1bee3ec1bf09d20f107ce0c2724d3122f5597ff72239945977a11d03213787709091dff65d4d79861726ba76a36987d73097e6e01c7b1b44faa8d2d
SSDEEP 384:OiFiZcIlTsNC8TUNTUlIl6w6GjmOjTV9iOyGPjEjywJr8/Oi87O6R2Feo9h7U0o/:lFQxPwgNdn2OYjZhKOi87TRMlI
TLSH
T1C0A27D325CA49D7BADBBE745F94A3213CEF840A7D9856A90E2DC6F1D00975DC130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 254031e860a579d7d36d453c9b35c86cdfd88c3092133c43af7a0cce7819534b
MD5 ddaf913aec4e5a7a4a7d7f69410b1c8d
SHA1 5e1987ba992f242c25012975a2bfb0cbf24d9f88
SHA512 53d801834ae58dda4542580f2a5f7fc55c2a7f32b25604d120622713d65a4eb3ccc32faa22afa23c65bc752d450a7ffa0912702ed3f09f4e533b756f34e6fca3
SSDEEP 192:SONK6ygpQmiUyHqtOCTVgmiOyR0P5zPp8U6:SONK6lHTtOCTV9iOyGPVaU6
TLSH
T1BB02D834AC782CBB8DB3AE05F48737179F94116BD9552F84DAD81E1C01D769C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5a91afa0e50c759471a4fd6419638a8e7d59bf3d3caf182430579f4f19503c60
MD5 214b110735de0a2b5975ab33b5acfe88
SHA1 ef7c4eb0c8597e303b88d8aaabc887fd86676d90
SHA512 38168e6dbba679e8fe17f7fe298dbc9f909945e856c55072bd366f04cbb408dfd6a95094b1166cbc521029dd1b2dd3513da0eddc261ea16de75dea5d20c8c6cc
SSDEEP 384:jZcI9sN66w6GjmOjTV9iOyGPjEjywJr8/ki87O6R2Feo9h7U0o/:799dn2OYjZhKki87TRMlI
TLSH
T12E827D316C745C7758B7F146F44A36139EF880A7D6892F90E0DD6F1E01DBAA8230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3660bd50d148ca42492f6bf6a127bc4e603777e04b87d7b7520527d5b78ad3a9
MD5 46e12e937cb62240b73bf1b989277446
SHA1 25f8dc0844c866d4806785f3e7916bd2eb026384
SHA512 3f08c3b4a46f047af72019bcaa665c1a68b1c80e0f2a91f311feab1c62719c5d2bf253748687350c2385d082f72a19ebe6eefb5def1ffabc9d4dc56ffec3dcea
SSDEEP 384:FZcI9sN6Lw6bjmOjTV9iOyGPjEjywJr8/ki87O6R2Feo9h7U0o/:99vdn2OYjZhKki87TRMlI
TLSH
T10C827D316C746C775DB6E146F84A36139FF880A7D6892F90E4DD6F1D01DBAA8230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77518ae8bbb2df73931c0699cfc9b617c9b305328b96ecff70d382c03eaa6db5
MD5 4cd0350004abe61798ad20f463cef766
SHA1 72d01fbf45a29875098c53bee960b1f7f8d9d4a2
SHA512 52554eb68bca60fc25c9dcdeb4a3a7e289dc5d23e932f3091a833b449d8e88957a722ec5a738aa09e4643f2276d2e24e1f533a4da9c29c9432f4c3d8d988a7d4
SSDEEP 192:SONb6yBQmiUycqyOCTVgmiOyR0PjEjuFJSJr8/X3UD/28U6:SONb6s8yOCTV9iOyGPjEjywJr8/Ui8U6
TLSH
T1C6121A35B8786C7B9DA3B545F48736139FA8416BDA493F90D5DC2E0C01EF6AC234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0bbcbde2e15cdac5a16c7a17c628269ae8034bb6df33aecc241c65b89c3aea6
MD5 b80e5303d5935e8954b52c087c5f7877
SHA1 b260fce54915f143f8022bfc262b830b70077b69
SHA512 1bcb65f9a1453366114b38c3e955f22fa8227801bb754b588f53122dcf302affc1d89fa37ca9b4a1f917e13d84e50eee4ca7f3e80ebe251c49d6e87861109ebe
TLSH
T10F410B58AAF90018B3777F5AABF6646E847BB9373E07D45D00020E4E0676A40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download