13b8fe1aab1d7a72d27d66111f5dc7c91a7ebad9b615b888dee69f0dd7e44112

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_13b8fe1aab1d7a72d27d66111f5dc7c91a7ebad9b615b888dee69f0dd7e44112.html
Size 106KB
Sample260912-2lpynawgrc
SHA256 13b8fe1aab1d7a72d27d66111f5dc7c91a7ebad9b615b888dee69f0dd7e44112
MD5 e3e50a38fb72ee827b7951cd86358642
SHA1 6270c575b2ac073d577808a290bf3fe750a97ccf
SHA512 63c34a327ccd63a5e9f3a83f4ecbff88559c81f9548bbf6764fabee7bf85fc924a4dacdf79ce9bbf14ad6e410996c49b9cf4f2cf04eba4054a73ef001b37c069
SSDEEP 1536:iPxwYn+hUb+6RMkxM6O5fYFloQ4Tt2NoGx9WPEbEaoPbEaoOb:4eXQxNlSEdoPdoOb
TLSH
T107B3A48701205CFAEFA04DB2465B48673D2C5437BC5791B9E3FD8FA72B41DAE034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4840	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{F25CC1E5-A0C3-47DB-9F51-41B26F7D7323}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4088	5044	msedge.exe	88
PID 5044 wrote to memory of 4840	5044	msedge.exe	90
PID 5044 wrote to memory of 4140	5044	msedge.exe	91
PID 5044 wrote to memory of 4140	5044	msedge.exe	91
PID 5044 wrote to memory of 4140	5044	msedge.exe	91
PID 5044 wrote to memory of 5060	5044	msedge.exe	92
PID 5044 wrote to memory of 5060	5044	msedge.exe	92
PID 5044 wrote to memory of 700	5044	msedge.exe	93
PID 5044 wrote to memory of 4164	5044	msedge.exe	94
PID 5044 wrote to memory of 700	5044	msedge.exe	93
PID 5044 wrote to memory of 700	5044	msedge.exe	93
PID 5044 wrote to memory of 4164	5044	msedge.exe	94
PID 5044 wrote to memory of 4164	5044	msedge.exe	94
PID 5044 wrote to memory of 752	5044	msedge.exe	95
PID 5044 wrote to memory of 752	5044	msedge.exe	95
PID 5044 wrote to memory of 752	5044	msedge.exe	95
PID 5044 wrote to memory of 3532	5044	msedge.exe	96
PID 5044 wrote to memory of 3532	5044	msedge.exe	96
PID 5044 wrote to memory of 3532	5044	msedge.exe	96
PID 5044 wrote to memory of 4684	5044	msedge.exe	99
PID 5044 wrote to memory of 2520	5044	msedge.exe	98
PID 5044 wrote to memory of 4684	5044	msedge.exe	99
PID 5044 wrote to memory of 2520	5044	msedge.exe	98
PID 5044 wrote to memory of 4460	5044	msedge.exe	101
PID 5044 wrote to memory of 2140	5044	msedge.exe	105
PID 5044 wrote to memory of 3332	5044	msedge.exe	106
PID 5044 wrote to memory of 2108	5044	msedge.exe	107
PID 5044 wrote to memory of 4972	5044	msedge.exe	108
PID 5044 wrote to memory of 4972	5044	msedge.exe	108
PID 5044 wrote to memory of 3044	5044	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_13b8fe1aab1d7a72d27d66111f5dc7c91a7ebad9b615b888dee69f0dd7e44112.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffc9107c188,0x7ffc9107c194,0x7ffc9107c1a0
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,13796313041745992857,7864410714230033091,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,2213301388569730737,5674539167646515143,262144 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,14057975885552926302,8036264144657512227,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,12958348833271194824,9324964860267451523,2097152 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,17729694389660803646,3455631687130354967,2097152 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,13976659571812530217,4537701938585451389,2097152 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:9
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,2940226380209796665,16442254965584195683,2097152 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,13405788896356593620,16120489242151562215,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,18247925658502048981,13985094117722545994,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,4488723195206056519,12581153629130272594,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,4488723195206056519,12581153629130272594,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1368,i,13908059277203873316,2670278326781814439,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,3033033372173484243,2670168767519233252,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,13559700445703971828,17559766527063622716,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,4438898257521027287,177454021783330455,524288 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=828,i,18428815409699634873,7879312298496377924,262144 --field-trial-handle=2668,i,8190247414300469953,17504608077795282409,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6a969145310759f749c6cdb8aea61c8f40a95c03d3c2e421bc5b2d20b2708e46
MD5 40db6afdcb2ef0710fd0e37bab1804a7
SHA1 798b328ef81c2f5fa5894a02294c46231b07f3e9
SHA512 2ec79b2882f84c6d061ac225b14b96147ffb3b492ac534ae12c5f3f5e6132ae544f336dce338e4320599666fa6573eb8e9a9a16b43fb4d9058e5487134ad5101
TLSH
T1AC61B6B05461865DFB7860B88BCC5CABF6345682CEF72F620497F874E14673B6C93298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596f5a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596f5a.TMP
Size 3KB
SHA256 a04b8f5b8936da22e6bf48950d292c0a0c7639197b7b03303d39915fd53da4ba
MD5 f8c66d3725c8b5def15c00dc7d08507a
SHA1 aa1d0eb173189dd6d256c0194c11f6997980faa9
SHA512 63bf26f64e6020c554071db131dc6fb07066eadd1ab9b057ba3c78af3280d324703e202c21832a0bddaa8be8aff1ed43640ca5b14a2feb3531eda5bdf7808349
TLSH
T12B61C7705460865DFB7820B88BCC5CABF6345682CEF72F62004BF4B4D1467376C93298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d087c78-b426-42a4-ae46-162dc13b4cb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d087c78-b426-42a4-ae46-162dc13b4cb8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4cfee665f5197beb23f06e208aa3b944d566472ead0253ed91ac5c82b8aa8208
MD5 9b209f6b502e46e0f9ff678dab4b0c0b
SHA1 7ceb4d12275e58bfaf10c210a4be6f46c0b91bd9
SHA512 6fafb515f521e9ee3f43fecddb0014b38553704bbf69867130dcac07493e81c1db024af3fde13f276f6d595887053aa2f2fae4deb08867b2202035aa4bd98956
TLSH
T1A851BFF3C3E4867E890156F4AB186E1BCE1D0916432C3D56C8E4AF1F93E68B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b9e54fb75f03275df09da183629fc66e7615c5a57abd9ca33f8001d80fcaa378
MD5 c0352f79c41e8443d41f4e07fa707b4d
SHA1 263ca279fcc0c49bc8f2f2496afd91e9138426f3
SHA512 47bf47a7590b451cada569756c57d4daf12f3bf83d79ad25c47df0d3ce8f107c2740f8dfffeffbf178ab43d83a26c60e3dadb460b1aaf3f7531874a958b06b2c
SSDEEP 192:sxR/kRSbh/fUsjuzoA8p48/g6+WNIYojJGukmIgIJ:sxRcGh/fUsjTd/5IBkes
TLSH
T1CA22A515AE28A97B8CDBD21DFB657F53D2F91032A1911F48B6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 be42d9cf21529828ff8d61d091db920ab72b78c36d4a63f9da7096455b3e423b
MD5 08d54cbd244729cdf60c20ce1f601b5e
SHA1 1c605f6a9cc402a887ed2b8539a19fd3bb110900
SHA512 d34372b3b50549dbbf62e508286083bfa6461b009f6d945d3d7abbe8bf726723c19b36e12fe3b567698b4e84900c440616f750d10aa95b80f1fe5bdfe8631867
SSDEEP 192:sxRMkRSbh/fUs/uzoA8p48/g6+WNIYojJGukmIgD/J:sxR3Gh/fUs/Td/5IBkeV
TLSH
T1B832A515AE28A97B8CDBD21DFB55BF53D2F91032A1911F48B6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 eec19e91fe6f4e68ba1efd7df5a01dc04f9a6f165c124d3029e9c5ac3be8cd1a
MD5 743b7c84ef717b36554ad2de28c0935d
SHA1 3d19c28dfb88a7cf86abf40289cc016cb8cd99b7
SHA512 5295d903659e4b76981bf3776b5432e41e5faebf42479ee2fe3434e6e40d5a0dc637d21b85a3fa92641f0fbbd4de04d09dcf0de07cd544e9a6d6bad0d45b183c
SSDEEP 384:pFZwWWPfCtg/NFf1pKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt5931RUUrond4:p/wWWnWg/Xf1p8F1+UoAYDCx9Tuqh0VS
TLSH
T1ADB2D92B744CCB7F4FC04A9D9C196F9B6D9802C796588D8047FED94C02C77EA922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a087d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a087d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 31b80dc306f00c6ee3f2d7e8bd47daef678a528bb66ae2e52148a3e1f9eec5b4
MD5 f10c977193c21d17acea9deaa18c2773
SHA1 dafdfa095547a7683ee5cf99dc989123a08224d1
SHA512 8c6e30efd8d612e5d00e4841de0c0800d2d17df43ce7c56aa19bc3d671a399929bfa487cfa2b7e23e37725e436a7eafb40d3b24f6bba6d7d895ecb11dc7bd39d
SSDEEP 768:0/UxvxjgC+Y3ldkO29JVu/9OA9at01j0iq00+IaipoKy:hZj3+Y3lQCHq00NaaoKy
TLSH
T1B703BF31ECB59D239CF2F294730A23939FF40523C6C95A944AEE2E0D054B6AD570BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c52227a51b1f3df5f08e915c172f94af2495abba8d89acc8ec825b305bcd0745
MD5 e5d8d923d05c51b80be0a36edbb63065
SHA1 d1d654d0148fd41ec9ebfff84f29a241e918849b
SHA512 2d7f1af7050fc9822112ca943eeae047afbd22fae43c88ec6517d680a07cf639cc510f09e657e0d1b320337d501208096d48c011794952430419dcb9f3ebd87b
SSDEEP 768:BFQJ3ywgdjkO29JVC/9OA9at01j0iq00+IaipMg/c:QJ30UCHq00NaaMg/c
TLSH
T1ED039E729CA4C97BECF6E7C5B70633429FF44263C6C9AA9086D96E0D004B5ED130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a95414c916716001f201a0b4d9840603d91b5929ff5ebe0fc4ae31b5d354b648
MD5 108a41c138da131f416285d2dc76b424
SHA1 ab7661a6b26ff4a63227a544832bf4320e729d1a
SHA512 e754264acb1dd29e712f5ee47b8abc379005b427751b147f72dbd9defe80670d8722100390bb2fb072e05c96e4c2acc4648ccc14802638cb861d45c4f0136846
SSDEEP 768:cJ3ljkO29JVK/9OA9at01j0iq00+IaipMg/c:cJ3lkCHq00NaaMg/c
TLSH
T14BF2AE71ECA19D779CE6E3C5B70633429FF44653C6CD5A908AEE2A0D044BAA9130BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 5075ba9e5a87478efdcbba2d1627d3869b13725d46fb229686a430da8e2480ad
MD5 e03d4b2b2ee109b89183cdc9a43c3130
SHA1 cb60a6316abab671bb25eb4e25310e028885594e
SHA512 a86ac5ff1b36d9126776e7d5905de4c96a402c2ce5f880a1b79103631ee414965e19a20f6129b381a98d63606a2ec75cded3e1b3711e9288b8c99dfc9fabddeb
SSDEEP 768:X/UxvxjgC+H35nGO2p/9OA9at01j0iq00+Ia2fSHxRz:KZj3+H35NCHq00NaMSTz
TLSH
T1EE03C031ECA19D779CF6B384730A6397DFF44663C6C56AA04AED2A0D01876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce98e344-983b-405a-80b8-91b2769a25b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ce98e344-983b-405a-80b8-91b2769a25b1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download