ebb8a40e494a91374addcebb6dd6572e36349c96f081920c1bb302885cb1e5c1

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ebb8a40e494a91374addcebb6dd6572e36349c96f081920c1bb302885cb1e5c1.html
Size 288KB
Sample260912-2xpf9sbd39
SHA256 ebb8a40e494a91374addcebb6dd6572e36349c96f081920c1bb302885cb1e5c1
MD5 50c79c30b2cd1c833cd29251bd0fe4e8
SHA1 c6204fc0bc7a89f325bb410f097caad7c6dee493
SHA512 1bd918344e4e952385512f95b6538cdecb4ed15eeee747cfc0ba47859677c9ebfec392dbbd00c912b1f8ad7c01fd78b05a45ed2cf6ab9eed2bc3a51fa06c057e
SSDEEP 3072:3zv+AS3jGfs9UAkZN2NTq1OWOVOvfAqhf9ncnw8uxeFMx5nK7FfxbfKmSiPw9qH+:WqLCMxN
TLSH
T11A54E461BDA4849242DF59DD9076423823F68310DA8245D8F9BE83F843AFD7DE763A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3740	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338382749792118"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{AD412465-89F8-4C2E-8EA4-3259A33A2D5A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2456	1332	msedge.exe	85
PID 1332 wrote to memory of 3740	1332	msedge.exe	86
PID 1332 wrote to memory of 4144	1332	msedge.exe	87
PID 1332 wrote to memory of 4144	1332	msedge.exe	87
PID 1332 wrote to memory of 4144	1332	msedge.exe	87
PID 1332 wrote to memory of 4824	1332	msedge.exe	88
PID 1332 wrote to memory of 4824	1332	msedge.exe	88
PID 1332 wrote to memory of 756	1332	msedge.exe	89
PID 1332 wrote to memory of 756	1332	msedge.exe	89
PID 1332 wrote to memory of 2480	1332	msedge.exe	90
PID 1332 wrote to memory of 756	1332	msedge.exe	89
PID 1332 wrote to memory of 2480	1332	msedge.exe	90
PID 1332 wrote to memory of 2480	1332	msedge.exe	90
PID 1332 wrote to memory of 2924	1332	msedge.exe	92
PID 1332 wrote to memory of 2924	1332	msedge.exe	92
PID 1332 wrote to memory of 2924	1332	msedge.exe	92
PID 1332 wrote to memory of 2732	1332	msedge.exe	93
PID 1332 wrote to memory of 2732	1332	msedge.exe	93
PID 1332 wrote to memory of 2732	1332	msedge.exe	93
PID 1332 wrote to memory of 4660	1332	msedge.exe	97
PID 1332 wrote to memory of 3392	1332	msedge.exe	98
PID 1332 wrote to memory of 4660	1332	msedge.exe	97
PID 1332 wrote to memory of 3392	1332	msedge.exe	98
PID 1332 wrote to memory of 3368	1332	msedge.exe	100
PID 1332 wrote to memory of 3916	1332	msedge.exe	105
PID 1332 wrote to memory of 3092	1332	msedge.exe	106
PID 1332 wrote to memory of 1624	1332	msedge.exe	107
PID 1332 wrote to memory of 2260	1332	msedge.exe	108
PID 1332 wrote to memory of 2260	1332	msedge.exe	108
PID 1332 wrote to memory of 3944	1332	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ebb8a40e494a91374addcebb6dd6572e36349c96f081920c1bb302885cb1e5c1.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9bd0cc188,0x7ff9bd0cc194,0x7ff9bd0cc1a0
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,18297399058706486660,12407516444828846466,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,11658301327852987703,11927595034820327430,262144 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,13569251491772317273,17025893666461545179,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5132259642524292651,9754387916044469323,2097152 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10437682698051582132,5159831153015171098,2097152 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,10339476621769311685,13588594520412898160,2097152 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6070902482917425673,16135165498048877469,2097152 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,862375019149465812,11844864229068089008,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3232294591550743961,8971387215696826857,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9430706785134640049,13612297049153865500,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9430706785134640049,13612297049153865500,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,12346790052419144291,7739346589205986256,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,7636675181282430177,841598092726002246,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,2461282321754390150,2274909972645774187,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,1803442682278878540,700170109469440596,524288 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,3448316518781755276,1046666099812038051,262144 --field-trial-handle=2376,i,5738231216499070473,1664896427456505879,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7788d90fc09878fe0fc516e600b99c7ceba8231d65ea3965fb95713b82912e5e
MD5 7a4ba07a0f6f61f325b85b0fce66c17f
SHA1 c88dcee02d9da9c3f921ececd351a5922152f7bb
SHA512 badcad1ca54a4a37c53a582866f5fc0274e238d8b8a545d0abe1ee165d1c97cf0b68e66e613cc5f4b0982216d81a4d3dfa4401194ac032d7959e9bd9733bc4f5
TLSH
T1906183C1649240BDD79803B07DED2CEBB53C1AB966A37D10C59BE43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58be59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58be59.TMP
Size 3KB
SHA256 2723cd48f3c8bdd3540b4d40abba5c9d337c9a038e0d0f60c88c48df6c1d0252
MD5 2376176754a2c87a9562c5658c5da096
SHA1 15c4e8a955ee650cce322a4949fcba7e68936c31
SHA512 e01c8ab9b799e07e3a6c29d1f1f93b0e35a518aed9ec8d421c8d39b2cc969b752eae91bdfebefb02a2f6fd6615c1c6cc2812bb5635eb677be6b3fa9090e44dcf
TLSH
T1076183C1649240BDD79803B0BDED2CEBB53C5AB966A37D10C49BE43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 c5f06553e5e7a7e515cc1d3b69a2c74914dcdef7f503db2599f6bbf9c13f2893
MD5 9b32abdd759e3af37a75c573062a5564
SHA1 a748fc6c36cf1584fe441c2c07413c76a3c40fa0
SHA512 3c9acf98141033d53e5197b3eba8516570725c83a75c39b1eecf078cbc3a1b89e7e90dfb6e31e3f0b2f25502f217fa9764b50bdf2e5f72e904a055a555dd623f
TLSH
T16C117AF3C3D585AE890156F09A28AE2BCE2D0A16422C7D1989D4EF2B93E3475E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f1369830d56888db33fa0b6925cadd7ea0f75682e444b868d3c8e9bcb9c423e2
MD5 038bfcc612ba078ccb6dbcee9eb988de
SHA1 ebe4de0a91c4d1eee7b8865908a8ebbe0bf9abaf
SHA512 9ab45f482194c1e8c172f31f0d30083ab17e8a067f1dba4159b6b664f95051353c088cd5a065019c08fad33a138f9db965290cef2890f5ec1385e564965c6e41
SSDEEP 192:sxZlRdWS/fnsjRIdpdUHW6+WNGY3RaIIgrJ:sxZl6S/fnsjaOHbGS9
TLSH
T1F522B8166E28657B8CCBE21DBB25BF43E6FD503261D41E98AAFC961C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 955da572d66658c4dfc32f8e82b5df28b1ebb4bfb11889ea380257734fe3dc90
MD5 8ec0f291212b3248902260f30f2bb9dc
SHA1 4cb9cc3f425ecb703869b864fbb6b11220140137
SHA512 3061e5cb3454a095d9e137f2bff82dded438d0eeeb55a453dac21e3a930e00f54e60ac27f036e147e22b875da6a21b6b89ac3f17d61a8aca017557733b917f7e
SSDEEP 192:sxZlRdWS/fnsTRIdpHUHW6+WNGY33aIIg50J:sxZl6S/fnsTa0HbGOO
TLSH
T13F22B8566E28697B8CCBE21DBB15BF53E6FD503261D01E84ABFC861C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7a8e3231e819ca6a73bda50b31f1527fccead9b11aa2fa4813ddeac86d52d278
MD5 799266551a365f112c9906d1be6915d7
SHA1 827832f703fe4de225981a7ec4416bffb3609642
SHA512 1c5efbe02f1c03300736ce26adcbec21f6d7af0999ff84cd1fccdcdc95fb2fcd2983157fcc6d7e9c6d3a1554b11148d52cd6e107101d804ab957a0e018bc46bf
SSDEEP 192:sxZlRdWS/fnsTRIdpdUHW6+WNGY3IaIIg50J:sxZl6S/fnsTaOHbGnO
TLSH
T10522B7566E28697B8CCBE21DBB157F43E6FD503261D41E94AAFC861C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 df8c12dfaec6b6f952821cbcc3e63a60287a5331681104431c1c2198e63e8c17
MD5 f02bfcc649ac9852365a858515ca42d4
SHA1 a31810388b0f31b272e870cc25ab4d9be052bf44
SHA512 cdb13df90fb59f2db4fc214b0a022b3bb44296d758d78e2f24f39734f57b52a5625adca54b8f1fa0a4619129e16dda621e98045a84b7caae795a1661b83aec64
SSDEEP 192:sxZlRdWS/fns9RIdpdUHW6+WNGY3RaIIg5eJ:sxZl6S/fns9aOHbGSk
TLSH
T17722B7166E28697B8CCBE21DBB15BF43E6FD503161D41E98AAFC961C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bc6bc8ae806a2f7d1c3dc8c6e53134c042a6156f9e81abb614539e99a56c9160
MD5 ba8fc40d7664781cc1280d587dc20f75
SHA1 ade371474cc6631dc29eec5758318152eb1b5495
SHA512 a9ce929f4e27803cf37a65c8f4ab3c6dd352384c8de58c82c65531cd238f1114cb03b91c846fc4905a16838b36b4f072a1100357818088155eaa8c927d17a86a
SSDEEP 768:H530AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72OrolZMZFV:H530AbSWvS2l9u1jaLmLZ12FYFV
TLSH
T117C2DA3B640CCB7E5FC01A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d0603d0497a005ade0f3d9909099924e22cb4b8381cd791218d10d8da41e7c5f
MD5 5a1a5c35785bed19eb17dce7013d0bc8
SHA1 53f3ccabe61e889d6c7b1cb88924011ef4d62371
SHA512 80a1c6b64c817d847a90373b038270296fca2a29ddabcc65594d60862cdd9c4cdf9d0b192ceb50029ffac073bcdffb7d0eac0fed6d78e5dd2d3d780c22f6fa7e
SSDEEP 48:K06lI064I5bkjUISs5K9Q1K5xipYb8IKyLWRsQO00tbYvAISotK9M1OtxG9Yn4gI:KwhyKSQSmdiK2otNiK+MgP
TLSH
T1B891115035BB5210797E7A4C96A0972E12427173301AEA6BBFBC10B59E2FE150CFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20f20530-5117-448b-adc0-b2672eb60b39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\20f20530-5117-448b-adc0-b2672eb60b39.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b044451310fba703d0b0107b9a6e9ce5f4d63534d476b74d0e5b90f96dbb8dcc
MD5 b160544fcf036a115c2fd02e7b059140
SHA1 7324a10b0977056a6f5f802bf46a86e5844b15b9
SHA512 6b14fbdff1b447310f771d985d1dbf5cf3dc818a0a40ba43dc6d25adf9d22fb94f29fdd220074f744039507368345da62ba5eef3bb935ba55c36145b36d687ba
SSDEEP 384:AZcIOsNRRkcupuLi8H9iX5FA+eML17O6R2FeoGh7UFoN:+OI+i7daE+L17TRJYq
TLSH
T1BA828E7268B85C3B58E7E156F44B36139EF890A797C86FC0D5EC9B2D05DBA94030B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 019ac3fce9d791bc8ee121086156eed6702facfc0ad122f39addf21ffbc9f075
MD5 1d178ffbf0c107b8eb460f8850d16e6d
SHA1 adedd66d94e6170b577339d41342dfa0f18a7e1c
SHA512 f7b0a20ddee50968e422bf12836956d8216a5ee4cd439e49274cff583f7d465b109b97dc3554b6b223cb5ed4c560b0e6f1b6d2bdf1c8757eb558315d2f27695f
SSDEEP 384:jiFiZcIwcsNj8TUNTUlIlRkcupuLi8H9iX5FA+eMl17O6R2FeoGh7UFoN:OFQD+wgP+i7daE+l17TRJYq
TLSH
T175A26D7358A49C3F9DEA9A56F50A36138EF940A7D7C4AFD0E6DC9B1D01975D8030BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8623ce1b5d6650fb0d2fcfb078b5906b58d75a4b26f5325dc4c824c91118a724
MD5 beb02f99954bb919b0c9e4d2cd57501b
SHA1 f500a64ccd2e58c434820d9f29130dbf4bb50a75
SHA512 40b822728a63a32ee09a80ef2e4afa4d7bd7f5b1967bae4b0337e05a10c035a4d93a33a877d3230e57c8107adfdae45d45e26d7a0b01fe46f94843fa806db33e
SSDEEP 192:LONe6AmwprQmiUyau6siX5FvY+9JisXU6:LONe6ipdM6siX5FA+qKU6
TLSH
T18F020B35AD786C7B89F36E55B44B37239FA9117BD6942F84DAE81B1C01D764C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0d36e5a09233b525a6b7f5febe1486998cece8c2780099eaf825bc0fc5e083bd
MD5 cdaf5860b47d7372723e4cd6e3f56602
SHA1 00ac338ae5269a4b2fcde4144fca08647c25860e
SHA512 4e3ea709b0e0e0a94062cf2d2c828fd181fc6593c45d434cc2be11427e2196aa893f5a91f12eab9351ef438aa5b385aa295de10c1e3c7b9ad820e661c219b173
SSDEEP 384:eZcIOsNROkcupus8H9iX5FA+eML17O6R2FeoGh7UFoN:cOB+kdaE+L17TRJYq
TLSH
T16E828E326CB85C3B59E6E156F44B36139EF990A797C86FC0D5EC5B2D05DBA94030B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df0358dfde055b7b111e2398e664ddbe264f74c03047377f1332a521ff6d5e4d
MD5 6bc7406f0741dcca7fc16851192a3274
SHA1 b68a67069060845c9062ede57b6cd30162bd399c
SHA512 a0d35ec78b2d51742ac45f508bdd7087b070e2430a2dd5c74674cd31240c0240d29698b3a5bd2affa1b3f7f6f4dd25d940df4f0272c0c1eda9a20b64b77d069c
SSDEEP 192:LONk6AmwpqQmiUyKu1siX5FvY+eMMlRo/MU6:LONk6ipmI1siX5FA+eMm1U6
TLSH
T19E122B35A8786C3F4DD2A551F04735139EA9426BEB886F94D5EC2B1C06DF598530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 41f59492fcc70b26a619fa398522b0b36190629717dc5c2e8bc791dd56c2de77
MD5 6a2c787dce6313cd8494d4c41fee92d3
SHA1 830634ed431dc3df071134460528eb6d234c5e85
SHA512 10c91fbefac5a7dc32cb29de8efe5d79432e5370db671eec96d4eadd5bf542e58f07e6a4f3669f068b2a0ab4a9367571a90c8066293edc4076f631ca7547d601
TLSH
T1EE412848BAEA1158B3736F5A9BF7A56D543B7C772F06D45E00110D8F0A72E40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download