286c4065e2b8e8d040b7530126a943193254927c0dba4ea41d155b1287156a62

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_286c4065e2b8e8d040b7530126a943193254927c0dba4ea41d155b1287156a62.html
Size 111KB
Sample260912-kb9rmsgb25
SHA256 286c4065e2b8e8d040b7530126a943193254927c0dba4ea41d155b1287156a62
MD5 76be515eb2c2e67530eceebb62777544
SHA1 06143e25545aad42287adf60976197c23a7f50ad
SHA512 e4b811ac260efdee7fc23479cb74fabd1bde125fa21274e36dc78e45f0e6f2d2f3a8e85ef8a44b68647e5559b3e50322f1a54444e3f60d3ef258cd7796dd4809
SSDEEP 1536:wPx+Yn+hR5GRFr/KrNHhh4HTl8QkTtRNohxqu61bEaoQbEaorOhvX6U:ucZQaNDH1doQdorG6U
TLSH
T1F0B3B58711204CFAEFA44DB3459B186B3C2C5437BC4391B9E3FD8F972B569AE0346269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338279508171505"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{831A6CC6-6B1C-4C11-9B87-A0270573D901}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 4116	4612	msedge.exe	83
PID 4612 wrote to memory of 4964	4612	msedge.exe	84
PID 4612 wrote to memory of 4840	4612	msedge.exe	85
PID 4612 wrote to memory of 4840	4612	msedge.exe	85
PID 4612 wrote to memory of 4840	4612	msedge.exe	85
PID 4612 wrote to memory of 464	4612	msedge.exe	86
PID 4612 wrote to memory of 464	4612	msedge.exe	86
PID 4612 wrote to memory of 3924	4612	msedge.exe	88
PID 4612 wrote to memory of 3924	4612	msedge.exe	88
PID 4612 wrote to memory of 3924	4612	msedge.exe	88
PID 4612 wrote to memory of 3792	4612	msedge.exe	89
PID 4612 wrote to memory of 3792	4612	msedge.exe	89
PID 4612 wrote to memory of 3792	4612	msedge.exe	89
PID 4612 wrote to memory of 1712	4612	msedge.exe	90
PID 4612 wrote to memory of 1712	4612	msedge.exe	90
PID 4612 wrote to memory of 1712	4612	msedge.exe	90
PID 4612 wrote to memory of 3504	4612	msedge.exe	91
PID 4612 wrote to memory of 3504	4612	msedge.exe	91
PID 4612 wrote to memory of 3504	4612	msedge.exe	91
PID 4612 wrote to memory of 2856	4612	msedge.exe	95
PID 4612 wrote to memory of 1404	4612	msedge.exe	96
PID 4612 wrote to memory of 2856	4612	msedge.exe	95
PID 4612 wrote to memory of 1404	4612	msedge.exe	96
PID 4612 wrote to memory of 4520	4612	msedge.exe	98
PID 4612 wrote to memory of 3112	4612	msedge.exe	104
PID 4612 wrote to memory of 4372	4612	msedge.exe	105
PID 4612 wrote to memory of 4376	4612	msedge.exe	106
PID 4612 wrote to memory of 2560	4612	msedge.exe	107
PID 4612 wrote to memory of 2560	4612	msedge.exe	107
PID 4612 wrote to memory of 728	4612	msedge.exe	108
PID 4612 wrote to memory of 728	4612	msedge.exe	108
PID 4612 wrote to memory of 2692	4612	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_286c4065e2b8e8d040b7530126a943193254927c0dba4ea41d155b1287156a62.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa7730c188,0x7ffa7730c194,0x7ffa7730c1a0
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,2991429332458897874,8942275802781126045,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,16049456570846967252,1115819694915684428,262144 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,5302721841446431636,8106575691193998972,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,9204035826399556026,14073412299947986598,2097152 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,12885777008688216486,4147205234124294519,2097152 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,8742968949921173736,6576463973206308165,2097152 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,9086289578604846369,7638210224524611736,2097152 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,2664066349483104590,4755174504710991086,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,7780006670807925832,13416558437814164530,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,6997799370350301853,10080004375866134323,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,6997799370350301853,10080004375866134323,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,12758383062125706831,13298918568847771292,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,14340971518004883835,10194646695285659735,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,11832737147825377497,17193440787709396561,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,15048328493333926078,4321732216289568625,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,15918341658985339893,11796545387670313805,524288 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5188,i,9133504544057149716,6783542381069368416,262144 --field-trial-handle=2316,i,15651500114339832802,4751472500734026735,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3f967b5c36a3fe8b53d7b4a08a099ca40832e4113558e7a1a06fb350a6ea2790
MD5 6002e54d716e5900ef05252a7ae6deda
SHA1 02056d1e764a0d5fc7948ba64155a7b6ea4a4cc5
SHA512 12ce354fdff3042380982cd3fdec8d26ef78b4afa318d4bba7379994c6fefd9f7138bec26f4803f5f69686f8fd43ffd818e2609c76d3c6ea9ca6ccd36a07042c
TLSH
T17B616178B8FCC4D5F7D8447CDBD52A873ABCEA829C979EF201A0DB786D8AF101154046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e097.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e097.TMP
Size 3KB
SHA256 ba11eec20696488b04e577b74dc2aae9c33d26639369926c080371d9b28723c4
MD5 2f6115ba50e6bcb76307597d5968350d
SHA1 66cb86a2afb51db32807ff609ad2b240fc1cb364
SHA512 5aed549a9ac1425f5061ff35b6012fa5a748937e4119ce73a4529ccbff20413c41ad34713a0f3367bd0aa7dfbec8d1795db306920e3553614d8144b31f991f3e
TLSH
T1FA615078B8FCC4D5F7D8447CCFD52A8A36BCEA869C979EF201A0DB78AD8AF101154046
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 300e254c9a8e460fc5a024317728263457037f1ae7686ccb9fe9fd5045e90080
MD5 f4c3217766f0a06fa1d8e091a99ac13d
SHA1 1c621dfd66d083140b13f16435f635114d486263
SHA512 6099b60336998ad02a3721a0c2eaf35e8b9afa6d22fa29eb95aaa4b03d25997ff750c49c4957774fd7a7bd4573002348b377b8ce48a0a843454ba2ad21560adc
TLSH
T1A0417BB7C3D4867E891156F09B246E16CE1C0A56422C3C1689E8AF2F63E28B4D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a8bb6e2f0bcb81ced98be57191708becd7e26b7d686cc3fd86bf5fc1c7f21fb9
MD5 5243f6cd3822aa0471a3bff2f166c477
SHA1 e7d5475d522ca6d7895323ffe354d44b0104d373
SHA512 37a526f8efe89af0ef5d0729196e834281cbd47fc0164dbc27c09ab575483b95491a79eb95952bd6e66a20fc97ffb74615df32d5cb1384579c699559e58e21c1
SSDEEP 192:sxZiR5W1/fHs7okIdpdxHW6+WNGYaQ4cIgrJ:sxZiu1/fHs7o9zHbGE9
TLSH
T13812B8156E28A57B8CCBD20EBB25BF53E6F9503291D41E48ABFC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cf0487a01a34b05af93a3b2389746689ea47eddc82353d2eb6b557dc790a2b3c
MD5 7aae11877ac4ca3428c4326ddc2d2c62
SHA1 284337f5da1770cef4dbba48630f77ed47e33e98
SHA512 62989cb46035890283baa390ff06659a50c0c1637d27e4e10ef11ad9ec68cee15c0b4faa9912c0c2922c1dc13c716ab23a491e60f515157c1d947a338a9a4500
SSDEEP 192:sxZiR5W1/fHsKokIdpHxHW6+WNGYaS4cIg5NAJ:sxZiu1/fHsKo9RHbGqPk
TLSH
T11322CA556E28A97B8CCBD20EBB25BF53E7F9503291941E48ABFC8A1C05E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a23a0ea26c9ac1b9137a00e5bf7a8e913a956e9bc733f7abce500d99011ae687
MD5 a0cfb91e3ae8bbd11fb13062ef2d33da
SHA1 feb50c8b5cc6db2b765995a9371877ca843e751c
SHA512 957c58a7fddcaca0d58ff03d28751b139e551cce76aea943447bea486150b4cea284df64021045593fe4b366bdf50264dffa2aad3a5c973d1a6ccf54716d28d5
SSDEEP 192:sxZiR5W1/fHsKokIdpdxHW6+WNGYab4cIg5NAJ:sxZiu1/fHsKo9zHbG5Pk
TLSH
T1EE22CA556E28A97B8CCBD20EBB25BF53E7F9503291951E48ABFC8A1C05E76CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 03a8aaa5298262555b291585f11c93c43abe29388ba8250bced5d2a6dc0ed539
MD5 23a095e527d751f81328cbdb2933eb57
SHA1 7c1c6e30a43c10937ffd1769f6c62ceace7602ae
SHA512 1f7d1125cfd054a908ae6a6613f41f72a8d6ba77ca1d5a1bb2ddab4651999335365b101a88ab076996375b0e41fc8837d3e10476d14d5462125e3f0296c00706
SSDEEP 192:sxZiR5W1/fHszokIdpdxHW6+WNGYaQ4cIg5NqJ:sxZiu1/fHszo9zHbGEPm
TLSH
T1B122B8156E28A57B8CCBD21EBB25BF53E6F9503291D41E48ABFC8A1C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fc178902d1a97303d152c35d5fae4c15fa14036ab2f9f0c344bdec5a3d94b4ea
MD5 addff538c077f5df84ad025131f0e7df
SHA1 6e5ef3f159c98d531f68e952cbb4d1df81bb8242
SHA512 bfbabe9812d0b1c870553a4d9675d076c4a8117fc364f6befcd8476ac042e48f7e2ebbff8172c30a5c2bb47cd21a885837c2c5f0c9e6a744e718173c98b35c9b
SSDEEP 768:BayQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH32roqZUR:BayQRbrWvvlpZu1jaXKLf33NqZUR
TLSH
T102C2F93B640CCB7E4FC01E9DDC6A6F972EA802C766588D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ffdee0253748998f342aec9c2d8584ffbf246b134d91adc57f9d66f7f18fefbe
MD5 64baca9f1b9b05bf2c90c057b4c46c0e
SHA1 6426c36b94de3701244d0410f57fd1bf41ed5f90
SHA512 17fcd04c6f568e9b9f8c747ac32a1f4d4c6ad6dee0864a69f2567cdbdba5a588d25db9b9c9812d9ac79aa3c39c046260aefb4541e61c9e042b5fc5f3e88acc91
SSDEEP 48:K0hwdR7/DcbvaHISpcK9J1jcxBMY6LBByLtMBdvbfAbzGTISVAK9V13AxFQYWXbL:K8S4K7S6aaoKnKUYgK1aCuz
TLSH
T15B91630131B7160138BD666885B1976F574275E3302CE63BBBFC20B68E6AE044DFDAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597c0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597c0c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 76badc9a7da63e28592f5a5b292741b45c220d89201fe2a8a0bf761a657b978a
MD5 cb16a0a5c90b392929161a51cca1997f
SHA1 ab8f201d285d9349d07fc0d0626e06f4ab2e1a29
SHA512 21f15a0332ddf2563d8c54287cd8d0e8e19b20be8a7e4ded4123c0053572809db2c7644a2a7128ec122879e9adf7cfb0d864a3874ba178c19ffba54423486d73
SSDEEP 384:yAiFiZcIw2sN08TUNTUlIlxYOnQqxsQp5u8i0+aZ3Bkwc0auFoD:ybFQBhwgvnQ7KkCZ3BkuauFs
TLSH
T16CA26D725CA4DC7BBDB7DA56F94A3603CEB841A7C6989B80E7C89A1E01DB1D81307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 59030e4bd1938b433fcc35a0763113b8734012ed32c6e17c39b687428038bf59
MD5 7211b9a0b4be22dc5ad54085172054f2
SHA1 647e28cec8aa3901d7bfd2a22be58c37288b84ac
SHA512 18dca3f8caef9747aac8087815c94e73360c6639444ca989f3a3577b854cbf35c3f5bc76049f24f8abf600496d85ac49eedfcdefdfe80b65b9a20fa5de3ad798
SSDEEP 96:PqONkgQsjpfwDISp5ih/cIPURHl8h4otop5pmDkBfPGxvw45RxmJm78lFIxCYbqn:SONo6iDCQmiUyyIHq5u88PAgSqzaqU6
TLSH
T1A6020939AC787CBB9EF3AD15B54737139FA4116BE6941B84DAE81B2D01E768C1303822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 086004f48daf05aade54fa4aea2e2e24cc8a6d08819f4e07837dc46f8b982101
MD5 6e31dce3acca6e8b10a741b57445f517
SHA1 da744e9420def6f58c38b9b33ac3d5942fc2ada2
SHA512 5c78ea9cee6f70d318a3db928131c763f34a34cc279244aa1ac12effa66fef9b12870b7b0e6bbcbfd89d7dd47c110bfb788a0e9bdb9205d4a05dfcbb6d12a0a9
SSDEEP 384:qAZcIwsN8xYOnQqxsQp5u8i0+ak3Bkwc0auFoD:q+wVnQ7KkCk3BkuauFs
TLSH
T17A928D711C74AC76ADB7E056F5473A039F7880ABD3985F809ADCAB1E02DB5E81307912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ac8d1d246819e2ac60117ba1eccd00e24e09e36768fe5606bc90740481c5c5a1
MD5 fca66e6b613ee74438afe80e4e22e4c5
SHA1 149a11c4f743c5001f98f54b7ff516bae86ab2cd
SHA512 fe28767a97e1ba62e2250b0850736d820f8ecd0973e101bb5385236e6f9db9c74dd20b9e8919d7fa458aeae8b45573125a2c2a9e71acf582246e4188f3a80fd5
SSDEEP 384:jZcIwsN8AYOnQqAsQp5u8i0+ak3Bkwc0auFoD:7wUnQUKkCk3BkuauFs
TLSH
T1C1828C711CB4AC76ADB7E056F5473A039F7881ABC3985F80DADCAB1E02DB5E81307912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 004d7120448716229219e92a694751a396eaf69a29e9776799b442e4d99ed8f9
MD5 c39e5312fbd0542df0247f8d6440f406
SHA1 a4b9ae7be16a41521c599fa8b129907c45f932d5
SHA512 7f77900fe388d5fa7b113d8051f4861736dbfbe5d3bd61e59870341df4daa2155ad8e06c1223fc2bed47875e3ae916fff0b1a00cd22941abac37938fd72b3a8c
SSDEEP 192:SONl6iDAQmiUywIQq5u88PA9+aVuZy/QU6:SONl6RwQq5u8i0+as3U6
TLSH
T115123C35B8786C6B6DA39965F44736239FB4026BD7886F84DADC271D02EF19C1307512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7dc00721a505218f5686f58d812293969751782f09090791de0e53375beb00dd
MD5 66034668a07d31a0ee9b7dc9fa71e3ca
SHA1 65e0801818d7cd0d858e8225c45da7ca9a770922
SHA512 8fff747932ca2630f489b8bea2f54157b0c8d0830a013d96004c277521cb7b3bbc2691545f96c791455e859a76e659d4468407065671907892e15dc5f867eb3f
TLSH
T16A410B68A6FD1148B3B77E5A9BF6A96D487B79732E0BD49E00110D4F4522E40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download