623f0a020cf2c6cadc983f358d9f9ff2d286f47e53607936ab92c3675b183800

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_623f0a020cf2c6cadc983f358d9f9ff2d286f47e53607936ab92c3675b183800.html
Size 114KB
Sample260912-2qa1asbc58
SHA256 623f0a020cf2c6cadc983f358d9f9ff2d286f47e53607936ab92c3675b183800
MD5 c0da524d2de99397d89313bf4cef9ef2
SHA1 de230604c87a1215fb96e903458c2799a28d19cc
SHA512 0ce3a71ede67951944b557abf1a741be363215d181be41790af02a4983195a2ab93461056c6dfa338f00d193855b121f555d075e7ab881a1ba668da8c553bb25
SSDEEP 1536:2mxbYn+he87eRbZZHHhHIGluQDTtoNocx9/728O61bEaoEbEaomZ0FdaxJ:v/TQmN7iYdoEdos0FdaxJ
TLSH
T165B393C711208CFAAF605DB2465F486B3D2C5837B85391B9E3FD8F9B2B41DAE0245279
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2600	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{58CAC7D8-2617-40BE-B825-AC0247C5E8BD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 3416	6128	msedge.exe	88
PID 6128 wrote to memory of 2600	6128	msedge.exe	89
PID 6128 wrote to memory of 5080	6128	msedge.exe	90
PID 6128 wrote to memory of 5080	6128	msedge.exe	90
PID 6128 wrote to memory of 5080	6128	msedge.exe	90
PID 6128 wrote to memory of 4648	6128	msedge.exe	91
PID 6128 wrote to memory of 4648	6128	msedge.exe	91
PID 6128 wrote to memory of 1916	6128	msedge.exe	93
PID 6128 wrote to memory of 1916	6128	msedge.exe	93
PID 6128 wrote to memory of 4128	6128	msedge.exe	94
PID 6128 wrote to memory of 1916	6128	msedge.exe	93
PID 6128 wrote to memory of 4128	6128	msedge.exe	94
PID 6128 wrote to memory of 4128	6128	msedge.exe	94
PID 6128 wrote to memory of 2564	6128	msedge.exe	95
PID 6128 wrote to memory of 2564	6128	msedge.exe	95
PID 6128 wrote to memory of 2564	6128	msedge.exe	95
PID 6128 wrote to memory of 2864	6128	msedge.exe	96
PID 6128 wrote to memory of 2864	6128	msedge.exe	96
PID 6128 wrote to memory of 2864	6128	msedge.exe	96
PID 6128 wrote to memory of 4300	6128	msedge.exe	98
PID 6128 wrote to memory of 3460	6128	msedge.exe	99
PID 6128 wrote to memory of 4300	6128	msedge.exe	98
PID 6128 wrote to memory of 3460	6128	msedge.exe	99
PID 6128 wrote to memory of 5508	6128	msedge.exe	101
PID 6128 wrote to memory of 2904	6128	msedge.exe	105
PID 6128 wrote to memory of 1572	6128	msedge.exe	106
PID 6128 wrote to memory of 4928	6128	msedge.exe	107
PID 6128 wrote to memory of 1352	6128	msedge.exe	108
PID 6128 wrote to memory of 1352	6128	msedge.exe	108
PID 6128 wrote to memory of 3860	6128	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_623f0a020cf2c6cadc983f358d9f9ff2d286f47e53607936ab92c3675b183800.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x230,0x7ff86725c188,0x7ff86725c194,0x7ff86725c1a0
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,14717449344493913003,18116985625188898417,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,17370125613868936550,9432789917308703034,262144 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,4060867757006005137,13160961638045812267,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,3434334157908449215,10892347876721958766,2097152 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,10116016387323979814,17249381745599352168,2097152 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,6097347829062724535,1883990527030893868,2097152 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,2247306769423645007,17768818170314142912,2097152 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:9
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,15027158068421574332,16240396771834513799,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,16179405372149179461,17088898836365947145,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17046544847242943989,11888120808583286555,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17046544847242943989,11888120808583286555,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,2994552537088765366,14466909427488427697,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,16979438904356087857,12678447775457954169,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,3508151602023055177,984121178551896778,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,12121062694676961308,666202724762035913,524288 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:14
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6016,i,4965016689356367250,13236722334926057072,262144 --field-trial-handle=2640,i,17982115720869093656,10274596684621411337,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cc0fb3b5acd634af10178367787245c0c1316232c144c7144b440ad07018dbfe
MD5 cb071ff8c2eedccd0c5c87406a7eb5ff
SHA1 6cbd1ec169cb61ab6cb71655f6507b655b046293
SHA512 2062bcc763ad048cd5446a091a33c4d55a5a22c35cd85aa8f00c3bf84354b043b87e40d2a5ed545fcec5a9031f23ea234ddb8e622057b836bcdff88859427f41
TLSH
T11E61628C5391C3D5E76CC272AEDA90C73E3D95F2538B1F3105BCDA7499663A9E104928
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5956c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5956c1.TMP
Size 3KB
SHA256 7d135ed8c4e13ae75f01f6408a5e1a69c1d01bbddb21d57e6125e19ef3ff887d
MD5 9e213e3940a9a193a0a9d8f716bb27e7
SHA1 0cd8c43994afb6124da8c17921834a37299d6d5f
SHA512 6f7c85f042a736d84036f7a3f100762754fd776ea8d1f9233afc2823e1dd6dfde614a4f672ed922700ba2fce19dcbe012f28c2519081f25fd04f3ecbab9a6a71
TLSH
T1AC61628C5380C3D5E76CC272AEDAD0C73E3D95F2538B1F3105BCDA7499663A9E144968
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a68492a0bbb7575a26a7a73066879c640e68f941da125cee775902c5b56de48e
MD5 423dd02641225c9260b3643004a71f5e
SHA1 4bb179476096d9de260bab4bddda053236eca36f
SHA512 d89b72b53aeced0a20b3bd3e569a9cbed456d974096a0bae52e333d460fcc26515229a1525ff3e4f34b2faa0e81f7b4b2d484ec61990cc65bc2246ff95627013
TLSH
T104619DF3C3E8867E890196F4AB142E1ACE1D0915532C3C56C8E4EE2FA3F24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 641057f1f075e392c10e0c56fa9ce77b53e8fb9c81032bc21e21777aad23d39b
MD5 cf463a2701174be1dfa2883b1227019e
SHA1 c286e4d2f9d8774149cd3482f88591729ba29b68
SHA512 f97a3bb5575fdb167e5abeffe89aa73b6b178e140c8c9c1e4df8e48dd6595dda5d1f047f637d18305da0eab80906876d7c17a937a048c7022b85a6443549c11e
SSDEEP 192:sxRxjR1by1/fedlsv6KzoA8p4z/g6+WNIYckXtiT3GLIgDAZJ:sxRxj/y1/fedlsv6He/5IE9iT6sD
TLSH
T15A32A715AE28A97B8CDBD20DFB557F53D6F85032A0A51E48B6FC8A1C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 93ffe85d939dc730de9520832f3c8cd4868af59ac6590eca4d9b94bbfb8e5ae0
MD5 b9a5b75fd9ec2ae6a1017718e27b2a93
SHA1 2c33c3fa0b20d4b60ecf08b5001088413b741730
SHA512 ff84424f922a29cd472b61a604b2e773ddb7a52cd1cf4320fa7f976cc41a8b32f6e34bc5a3c54d08ebccfb29758a2958e487fada0d4b146a03df48b871dad5ba
SSDEEP 192:sxRxQR1by1/fedlsB6KzoA8p4z/g6+WNIYckXtiT3GLIgIJ:sxRxQ/y1/fedlsB6He/5IE9iT6s
TLSH
T1E822A615AE28A93B8CDBD20DFB657F53D6F85032A0A51E58F6FC8A1C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 070ba71cb59137c1a64b98e573dac54368791a07ee1ea245bd2e8e6de6c700ae
MD5 7573ad80444d86ee42bcb20c1c130f62
SHA1 f814305ad53839a17c299712061d924deb2a37b5
SHA512 a98c32fd1c17edb0f0c2244bf88ed2dda0a2f6e83395b889cf48ccbcb62c5896a71e3222c5378f2a506d2b3205a52612c1cf657d87e68d0d5cb31a3a9a15cd4b
SSDEEP 384:D7JakElfCtg17Ff9tKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXn975RwYroMXp:DFakE5Wg1Bf9t8F1+UoAYDCx9Tuqh0Vq
TLSH
T138B2CA3F744CC77E8F804A9DAC196F976D9802C79A588D4087FE994C03C77EA92294DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f0a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f0a0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 91dc35a41c7f80a8e88bca03507b047e33bdf747b2d02b012135ea3f44b423b5
MD5 8acfcc5f28c75b56bf13a3a37f09e5dd
SHA1 b18c0f771a32473af0bc433b9b5d8dc3db70036f
SHA512 812a689c878964cc4370c26612180dd2787901518dda7b760e348a777498921e0c4b33812f33e7c20806eaef9fcca62c06f174482e0e460cf6597338347f5a1c
SSDEEP 768:vm/UxvxjgC+43JE6mieOEU2gSkLnUPO4Qp7cPAiSm2eo4w4cciGrTFlPMgCMR:vbZj3+43yHW2XkLwQpYoimeoR4ccFFRz
TLSH
T1CF13BF75A9A8AE739CF392817A4E6343EFF0556394C62DA889DD6F0D028739D4307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ab65d5520f299d50e58bdbd4212fa2349ca50f5366bcc3f55ab127a184a61bc3
MD5 d63775a43c9d835ed3569ca967343540
SHA1 9bde4013ab4350241f2c44f2e40aeded9dbacd53
SHA512 95a59d3bf0450e3da1d9a64abddaf2f081a9b645a95c290846ab47e9a4381ebd0ddffc71786cfa634049eb29d4689c323e4fe324f2cc96e88daa0cb73a1709d8
SSDEEP 768:D+13JRymieOEU2gSkrnUPO4Qp7cPAiSm2eo4w4cciGrTFlPMgv2:D+13n/W2XkrwQpYoimeoR4ccFFRMgv2
TLSH
T115F2AEB1ADA49E739CF383C1BA4A6702AFF05153A5C92E98C5DD6F0D018B6AE0317C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 5b4e2dd2923bca37da632135ba06b12960988f9528d33ae86aaf9533b0a9f953
MD5 5e5c664313658031a26319ec0d5f5a8f
SHA1 cfd8414049b23c109ba7965370b84c95c7f4ea79
SHA512 1f5bdbcf5015c7be5991047bb57d52004c71bf3a24afce8e5979c591cfbc3cf7b1c531642cd20d6ffeed16d123448f292ab3a22e1244c0e39ec93a6acaf4fa79
SSDEEP 768:7WFQ13CwgBRymieOEU2gShmnUPO4Qp7cPAiSm2eo4w4cciGrTFlPMgv2:7d13C/W2XhmwQpYoimeoR4ccFFRMgv2
TLSH
T1E303AEB29D98DE77ACF387C1BA096302AFF041A3D4C6AA94D6CD6E0D11876DD030BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 bc7d385ed15a0dd15ffff2c8c45c953e7932aa0560ac94aa075f6055de05419b
MD5 89f86dba50f1bd1d2174fd6275876dd3
SHA1 3e042c812d9d23f344d94c5c160833417886e03c
SHA512 2ca433680163db87c8f62fed34bb3e1f4119da29993891672de8af4fc0a996d783bb63152b449b968a7328d69d061cbc99bc5488c94aa913a325240497f7cd52
SSDEEP 768:vw/UxvxjgC+5j37VKL8AieOEU2ZjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5YAgZbCl:vdZj3+5j37ULzW2ZjFwQpYoimeoR4ccV
TLSH
T1AB03CF75E8A8AE779CF39784365D6343EFF0416395C22AA4CAED1E0D42873AD530BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cff6544b-4292-44d9-aec7-2ec6b2be209e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cff6544b-4292-44d9-aec7-2ec6b2be209e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download