610712e6bce645de24443505247ee05331c8798b5af492547107d027bad1abb5

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_610712e6bce645de24443505247ee05331c8798b5af492547107d027bad1abb5.html
Size 91KB
Sample260912-jvycaadj71
SHA256 610712e6bce645de24443505247ee05331c8798b5af492547107d027bad1abb5
MD5 a6a48c6ca442170590c1c8b032092a03
SHA1 d5ec0022807475f4e4c5d7ad188a69c1b859e39b
SHA512 b6fa6d0498e5a8ec9e5d0832ceb091f18a39ac5015c315260dd65f2b44e7f107f505ff6dbe276122531011f3f4ef7a3edd6b4d73cb08196f41128957ba9218dd
SSDEEP 1536:woUWVUvHgioUWVUReyo2beuEW+0jXRqjkbTMKgnOfykU:oM4euX7vJgnOaB
TLSH
T1AF935E56B3013C7A87D314E6701B521E33AE14BBA809A5F4D1F9E8D42FFCD899026B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
87	sites.google.com
107	sites.google.com
39	sites.google.com
40	sites.google.com
45	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2504	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338176571543477"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{8E493BE4-FF38-4322-9018-317F97263EBF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1384	2492	msedge.exe	85
PID 2492 wrote to memory of 2504	2492	msedge.exe	86
PID 2492 wrote to memory of 1664	2492	msedge.exe	87
PID 2492 wrote to memory of 1664	2492	msedge.exe	87
PID 2492 wrote to memory of 1664	2492	msedge.exe	87
PID 2492 wrote to memory of 1460	2492	msedge.exe	88
PID 2492 wrote to memory of 1460	2492	msedge.exe	88
PID 2492 wrote to memory of 1948	2492	msedge.exe	90
PID 2492 wrote to memory of 1948	2492	msedge.exe	90
PID 2492 wrote to memory of 4656	2492	msedge.exe	91
PID 2492 wrote to memory of 1948	2492	msedge.exe	90
PID 2492 wrote to memory of 4656	2492	msedge.exe	91
PID 2492 wrote to memory of 4656	2492	msedge.exe	91
PID 2492 wrote to memory of 3144	2492	msedge.exe	92
PID 2492 wrote to memory of 2816	2492	msedge.exe	93
PID 2492 wrote to memory of 3144	2492	msedge.exe	92
PID 2492 wrote to memory of 3144	2492	msedge.exe	92
PID 2492 wrote to memory of 2816	2492	msedge.exe	93
PID 2492 wrote to memory of 2816	2492	msedge.exe	93
PID 2492 wrote to memory of 2948	2492	msedge.exe	97
PID 2492 wrote to memory of 2948	2492	msedge.exe	97
PID 2492 wrote to memory of 2948	2492	msedge.exe	97
PID 2492 wrote to memory of 2516	2492	msedge.exe	98
PID 2492 wrote to memory of 464	2492	msedge.exe	99
PID 2492 wrote to memory of 2516	2492	msedge.exe	98
PID 2492 wrote to memory of 464	2492	msedge.exe	99
PID 2492 wrote to memory of 3544	2492	msedge.exe	101
PID 2492 wrote to memory of 1648	2492	msedge.exe	106
PID 2492 wrote to memory of 4812	2492	msedge.exe	107
PID 2492 wrote to memory of 2328	2492	msedge.exe	108
PID 2492 wrote to memory of 2496	2492	msedge.exe	109
PID 2492 wrote to memory of 2496	2492	msedge.exe	109
PID 2492 wrote to memory of 4880	2492	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_610712e6bce645de24443505247ee05331c8798b5af492547107d027bad1abb5.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2c0,0x7ffc4359c188,0x7ffc4359c194,0x7ffc4359c1a0
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,15823300391665331970,11236318035962752710,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11928214514617981501,5406860041547895498,262144 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,4387525311185274667,5718046061707296974,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13777388579503379715,6629332429322993823,2097152 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,14557488613853545477,17417293147089630228,2097152 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,15021442995470692533,2537244961582132868,2097152 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,11007368315460382015,7013771604751153528,2097152 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,16975827614737890824,12727126738102764826,2097152 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,10813272483609813818,4977346403176933973,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,17639229496457635793,13613126692873877003,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,14874388837337573457,17261158190519334618,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,14874388837337573457,17261158190519334618,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,8611226803113295198,12525573208326712800,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,12346816360696226324,6421147680990664194,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,13945177526815805287,1103641167543276640,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,17623496755586725170,10789756993168396757,524288 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6128,i,7805552290119352132,9090663789259727691,262144 --field-trial-handle=2332,i,15525182100400018308,5472701755457342431,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

95b1da89-5663-4e33-9d64-57856361754c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95b1da89-5663-4e33-9d64-57856361754c.tmp
Size 8KB
SHA256 afa4bc653d3c21012536f1d39a98403af01f772f13cf455d3935649e30159918
MD5 681e05370cd71af3b809b53f71bf4343
SHA1 e4a0e820d41fd67a9c7f274986fcb510e0a5179b
SHA512 35a927e6089031af6414ba54559e482e7da09714e1f438589dcfd23c1a97176a2e267d283c9f9ca0d93b3d99c785f570ece7b6532b12cf97bfb1537d1b57c73b
SSDEEP 192:LJON96DphmqQmiUy+Nq8wGYX59ez8CvjzorQRRkk7QgU6:lON9619TRwGYX5EN38wFU6
TLSH
T1B902D735A8B8BCBF49E3AE45B44B26139FE8102BAA956F54D6EC1E1C10D764C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8ff26c6b91e590202ae05d8c0977e866a60b0b1fb1413fc9a13019a83a02f643
MD5 74ad56b42f1b0426b5a0053ae0b2a334
SHA1 7e60e0d72c187abc11f46d7bb9269f19bea2bcd1
SHA512 47b782b40115c17e0381b3fea1c1bdd272450bd0cd474e7654c4e5a8e2930b80b8555dc922a572769eddaa676c1622bfcf773e1e7282398227713512b1279fb5
TLSH
T18B71EA819588B397EFB5C378D0F61D8B363C84B4B4936D2312F4E5B95706F10A6279D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59746b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59746b.TMP
Size 3KB
SHA256 45f4fdb7109238602686a3b43439b055b631eae7c6fcad1956880d372657dd9a
MD5 081683630cc19e110cf7eac44da2d979
SHA1 38cfc78167f3dc9b04e359cd34a07e120631229e
SHA512 dd16afaf93e0fe7335d4f981620eaad02c34f46035e9c515852c8e0cb02ce22d1c18d16c6eba0d1774a29acf1dcd31b82eab69629b9f20f687b01d197408e207
TLSH
T10461B5819588B397EFB4C3B8D0FA1D8B363C84B4B4834D2312F8E5B9570AF11952B9D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d1b4e0429106df0b9fbe149fef69526d6da8bb3d4807c2442694c639526a5355
MD5 92d3c3c5abe4320986ffe43975e0153f
SHA1 f7e7527e3ea6e9992708d707bd701d243f80870b
SHA512 bd6f344af235aa3b99b6ffe1d10fa77cf5db81b0f6fce24d0855350a9d714a4449643dce01b55de27130aa03c8c16f7ae736e6514c243f2d08308bb3196fe11e
SSDEEP 192:D3s0TtD5o9gjvz8f0HAnY4UV8RUpHCRmT:D3s0TtD5o9gjvz8f0HAnY4UV8RUpHCRc
TLSH
T11DD17FB7C3D8872DC85156F49B196E1ECE1D1B19422C3E67C8E4AE5FA3E1470E20179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a21fc726e697432db547dd327f35658534312832cf00504d42f5f6d59a01e821
MD5 6ed97dc5d7ea4cf05da037f0bd68e926
SHA1 ae5797a52ad1a75fe0352a36f37d3e33a3dc50fc
SHA512 1c09aa43bb7558ba54a1a6a9bf4f66c2b4b19fdb2836236046f05be8bfba5c3dd4781f55d38917f9172eb2b519e7665d9be0b058573f49c3d3a1efb217588d1c
SSDEEP 192:sxZukRyWc/fps8KIdpd21HW6+WNGYgUJcIgrJ:sxZlvc/fps8DEHbGd9
TLSH
T1FA229652AE28A97B8CCBD20DBB15BF13E6F9503291D51E58E7FC961C04E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 42d94c6bfdcfd7570f0cc123b3c09e495241f5e9489941877ccf2f9ba51b80f9
MD5 92e6b90d4a84baf11dd813b5adc682ac
SHA1 1fece5bbee40f9458c55258b9c62360018eb9b68
SHA512 b279791bf5e1c97357c2aa63d27a27e0cf2d1e42b1ffe3ace92d7563ded23399fde0243cacd01b86580e31fa4f2f9dfa3f123fafb56af731759a621ad549d70e
SSDEEP 192:sxZukRyWc/fpshKIdpd21HW6+WNGYgvJcIg5aJ:sxZlvc/fpshDEHbGM8
TLSH
T17D22A652AE28A97B8CCAE20DBB157F13E6F9503291D11E48E7FC961C05E7ADD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e6bf58fe9764be748fed02912580302ae9f21ec5b4443e06eaa2b01c8bf58805
MD5 56b4d61911dfa36ea0506b8b613ae2fa
SHA1 ba47c38c2b5ae523b4b96627fbadf2f024e947a5
SHA512 8287b89abd316ed0adabfbcbbb7a420ac6f6f62dab1977e3eae7eed975899eb7801d46e10639b0ad5645eebd44d52e3ae2bd00c812901e5a9572c358ae45236c
SSDEEP 192:sxZukRyWc/fpshKIdpH21HW6+WNGYgSJcIg5aJ:sxZlvc/fpshDSHbGf8
TLSH
T163229652AE24A97B8CCBD20DBB157F13E6F9503291D11E48E7FC961C05E7ADD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6abf84e962c7e5f5a913f2ec2fccca93f3c01fe943b3f9fac9c4b4edf948dbbf
MD5 c2bdb00569d70a9cd5f41087e9f7019d
SHA1 0f85e4e8edb96f9be0854ad5045b0bec25914fd2
SHA512 bff91a7b2809bcef4f2eb700037156505422c5f768a3f0e6ab2a45adb644e123c2cd0a13cd979d227c481a043ecb8961e857df8d313426899000bcfe5b831729
SSDEEP 192:sxZukRyWc/fps6KIdpd21HW6+WNGYgUJcIg54J:sxZlvc/fps6DEHbGdO
TLSH
T18222B652AE28A97B8CCBD20DBB15BF13D6F9503291D51E98E7FC961C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 da777722381a3ec8dce1c339077f458a893622f0a51b4f100abc2a549773da82
MD5 a6ca83e256f26c2e6b74f20e688a6244
SHA1 b8a93b5d9577088b16a63fa32f9f280dbcb2133e
SHA512 2fb9dfd9edb90eb14bc9ffc417a2210ba8603e5cd959ddcb20775711645833a0993581d1bc0699e958722d64a23b69e3fe0e812bba5fbc41f4cd9dd6e4765ef0
SSDEEP 768:XIichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzoro0+m0mu:XIichfPWvPZplu1jan+LKgzT0+Tmu
TLSH
T185C2FA7B644CCB7E4FC01A9DDD1A6F9B7E9802C7AA548D4047FA984C02C77EE91264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6143641097ae055b18c2bdd4147dbeaca63786a678cfa2b3f1ffcfb472a94feb
MD5 e712c99dd71e95a3625cad097a347183
SHA1 234e0a03921b32652ef134d7c792588bc9bbe34f
SHA512 a31544faffc48ae1e85cbec2509aee992ca138839664fe13c2082c083eb20ecdedccf92704e08b0005cf373b9dbdf7cdb8db9db95558dfd5ce4f646f3f8f11e1
SSDEEP 96:KnH4pNf95bgpiq+VbKWi+LbCHP6RZouLeKwUfLuKI0aeDSKsUfXW7npT:S35dlZt
TLSH
T1D7C1050171BB120138BD359891B29B2E5241B173315AF92BFF7C90A68E6FE585CFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e536.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e536.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 320c54d2bdfdb04c9581b311ab4e2347cc3a9a1372304f07e47e23c96e4a9d61
MD5 f5cec427ff65de6fb7068c02c606cddc
SHA1 91ae01ea0f968a0426a4a39bae5699473f63a2b4
SHA512 3860e1c23149bbb1fb5583fa250d94f3d5d65c92d192e0b90d4e2a9baa9bf187918caf34e30ff917dd44c47f4a06a7a119dbc7d6706debc9e2d40150073ee657
SSDEEP 384:CJZcIZsNGkCtFLm5HHdEBGYX5EN3862XO8p7O6R2Feo0GoF:EZbKHeGYuNL2O8p7TRIO
TLSH
T1A2827DB29CB8AC3B19E7E146B84A36039EF8901B97C95F40D7ED6B2D05D9694130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 549e6d2ef72ed43ba8b904448e83058d938be08f4dc270829825cc64972b14eb
MD5 2bd3cc5e98693a4089c9497975881072
SHA1 598334156c27cc7099c5029aaef59dbbf3fc227c
SHA512 dbd1fab20624be9ccc52f54a51c38dc01728023c923699325d631753ada64190fb619ba283fd7dc9b089c4dc13b98f09b98b37c9e26fc200d10ac7588de708ed
SSDEEP 384:KuiFiZcIRo7sNG8TUNTUlIlkCtFLm5HHOEBGYX5EN3862XOip7O6R2Feo0GoF:eFQaTwgHKgeGYuNL2Oip7TRIO
TLSH
T16FC23AF248E7983AD9AE9743A73D2D028EBCC057B6859A50F39C5A1DCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 74386a8c89f4483104c2125e7c86bc0038481ba5a08af3c6d2f9e99789743d48
MD5 c106f96089fe0f66622af09a59d1e270
SHA1 d3609c3c01644a0d0a27562331058fc3c59199f0
SHA512 5bcd18c2d3edce49ab3be625aae4dd0bd4267cb37611f789c0e4434e89c5725e8ca279dea58140b7723d5eef1999fe24a0ed8a1ef9246f8e384925feb1cd2b1f
SSDEEP 192:LJONv6DphgqQmiUycNEwGYX59ez8CvjzorQRf2XpEfkII6/5IU6:lONv61TbEwGYX5EN3862XOopU6
TLSH
T1DE120B72A8B8AC6F1DD2A585F44B35139FA8511BDF856F50D7EC2E1C01DF258530A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a404a6b0cf9b94f2ca77e0756f34b72560125870d554eda9f0ea64f6c259f93b
MD5 4188a3531692624a29292fb02147b9a4
SHA1 a64f16501e9fd7622b938a3362148b7ef0cf945f
SHA512 c9c8b80604384fc49d54fae5c319867f6d88a511dd7bde990c5a898cf9cf4b5a026b3536ee2f870d1f387d952817fb8a6110d9441f6f632cc9901547258df6c9
SSDEEP 384:2JZcIZsNGpCtFLm5HHdEBGYX5EN3862XO8p7O6R2Feo0GoF:4ZiKHeGYuNL2O8p7TRIO
TLSH
T125827E729CB8AC3B19E7E146B84A36039EFC801B97C95F40D7ED6B2D05D9694130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c44412f0abdde1e355384689e2e800efb3452c5a66aff5c30a9cfe081f0c9cf5
MD5 9d362bed81203c675ebe71bbff2c339e
SHA1 7e0eb15fe48d22986f380e2337b3d71bf52461e0
SHA512 66001baf6905d8090d43da28ee307c4e76281a5b1643e69ba7c2bfbc4a515cdd60454cba93ee1a8e9f948bd46cc3e0616225ecb6ad924412644c4acf38d5dbf8
SSDEEP 384:6JZcIZsNGpCtFLm5H/dEBGYX5EN3862XO8p7O6R2Feo0GoF:cZiKzeGYuNL2O8p7TRIO
TLSH
T1CD827EB29CB8AC3B19E7E156B84A36039EFC802797C95F40D7ED6B2D01D9694130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76ebfe33-dc10-412a-af36-fd9b37d81958.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76ebfe33-dc10-412a-af36-fd9b37d81958.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b4e1696e7326296cc052bf4860c898733621f2121003d7baee495ca6f3fd8b35
MD5 604f2fd0cd0fa3fae56eb7fc1875d87a
SHA1 0a1ae81f6d7ccb6e280c6a20cc78cc879c837ced
SHA512 fea82f58f7927a767024700a919d7b2187d336d7ddca7b215a15cc886a41a7caa6bf31db1f6f33cedf21b5653bb87c37f8cb729e65e8364c762c19705e8c71f8
TLSH
T1D041D658B6E91158B3B36F5A9BF2686D487FBC372E0AC55E10110D4F0A27A40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download