4f3069d557d9a8121fea41ee3d8afdf6eb0ebf4740172ad6d69c7d66ee966f83

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_4f3069d557d9a8121fea41ee3d8afdf6eb0ebf4740172ad6d69c7d66ee966f83.html
Size 62KB
Sample260912-kpdlcsdp71
SHA256 4f3069d557d9a8121fea41ee3d8afdf6eb0ebf4740172ad6d69c7d66ee966f83
MD5 d68aec928d01b8d75fee99b6330cf252
SHA1 b5aa130a734172b68bcb0cb5bb7c759aa5270f3b
SHA512 44dbcc18ac45d28c8f67c2473ed630d977cf337de276341b85f78f964657ffb7e223ec6fca584add56208c2d039f5a10d6de6bfc94a1c54f99364fbdaea56d08
SSDEEP 768:qjRFP7URNv+f5AfpUxnHeob4f1u0eJwO0H+UJF1WRx1PZXegSD2+oy:qjq6nPRx1PZXegSIy
TLSH
T1B3530A7765A23E0D9233580CB8C5B6D83718C453C40759EDE9BAA62CC3CBDC69172B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
680	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338179650312651"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{E38878E1-FA84-4728-81D8-B67DB197F107}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 636	2624	msedge.exe	82
PID 2624 wrote to memory of 680	2624	msedge.exe	83
PID 2624 wrote to memory of 4684	2624	msedge.exe	84
PID 2624 wrote to memory of 4684	2624	msedge.exe	84
PID 2624 wrote to memory of 4684	2624	msedge.exe	84
PID 2624 wrote to memory of 4504	2624	msedge.exe	85
PID 2624 wrote to memory of 4504	2624	msedge.exe	85
PID 2624 wrote to memory of 4168	2624	msedge.exe	87
PID 2624 wrote to memory of 4168	2624	msedge.exe	87
PID 2624 wrote to memory of 4168	2624	msedge.exe	87
PID 2624 wrote to memory of 4536	2624	msedge.exe	86
PID 2624 wrote to memory of 4536	2624	msedge.exe	86
PID 2624 wrote to memory of 4536	2624	msedge.exe	86
PID 2624 wrote to memory of 4680	2624	msedge.exe	89
PID 2624 wrote to memory of 4408	2624	msedge.exe	90
PID 2624 wrote to memory of 4680	2624	msedge.exe	89
PID 2624 wrote to memory of 4680	2624	msedge.exe	89
PID 2624 wrote to memory of 4408	2624	msedge.exe	90
PID 2624 wrote to memory of 4408	2624	msedge.exe	90
PID 2624 wrote to memory of 436	2624	msedge.exe	91
PID 2624 wrote to memory of 436	2624	msedge.exe	91
PID 2624 wrote to memory of 436	2624	msedge.exe	91
PID 2624 wrote to memory of 4240	2624	msedge.exe	95
PID 2624 wrote to memory of 1988	2624	msedge.exe	96
PID 2624 wrote to memory of 4240	2624	msedge.exe	95
PID 2624 wrote to memory of 1988	2624	msedge.exe	96
PID 2624 wrote to memory of 2612	2624	msedge.exe	99
PID 2624 wrote to memory of 3660	2624	msedge.exe	105
PID 2624 wrote to memory of 2364	2624	msedge.exe	106
PID 2624 wrote to memory of 3228	2624	msedge.exe	107
PID 2624 wrote to memory of 3392	2624	msedge.exe	108
PID 2624 wrote to memory of 3392	2624	msedge.exe	108
PID 2624 wrote to memory of 4828	2624	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4f3069d557d9a8121fea41ee3d8afdf6eb0ebf4740172ad6d69c7d66ee966f83.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff83016c188,0x7ff83016c194,0x7ff83016c1a0
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,13560668143262354042,9410702812239542015,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2339339141114432922,2034785434719457697,262144 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,3551625558124582193,23873674516947171,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,13515971249254171482,14146124726564327492,2097152 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16868347948163306331,11617915038638352233,2097152 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,4378155971247233776,13118811228284986597,2097152 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,2951821194640373661,6810873860220236802,2097152 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5024,i,1840736320839639443,18099141830665726218,2097152 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,7763582242481453822,18204273582861410495,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,1036593378497002964,989867814082856054,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14860024994118189071,4879673274423832925,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14860024994118189071,4879673274423832925,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,13481359207922886551,3618642976613254520,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,2817216899638601977,9834842266826684494,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,9225630334037616959,6462996315451112514,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,7991450423008119461,5805142418938307462,524288 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,5994195292996946608,15860056162466800479,262144 --field-trial-handle=2156,i,16817240634390171410,6156880812472313694,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a78a2f8dd0bbeb590534560578df5a3f4042da1b5a498f58852dacb078a77eff
MD5 6b4caae456387bc6c812daf762d776d3
SHA1 2cebe181e8935b2f3c5f201808a55a036cfb3049
SHA512 669dd7fc01d1a1f24f7dbd704fe99dc5ff7d2a88e56aa64e08609bc3e7ef48b5474f1a11f4db8171bb732b193a9a70e0d0d47182963c7d552bc61eb41f8f850f
TLSH
T1F351C5829FE303E5FFDA88F68FE428EB373E45C081836E72C198C6B8C9473548090088
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59548f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59548f.TMP
Size 2KB
SHA256 06b2b23e752183e6f069095698494396355307ff2a801bd8a9e6a3f7f2b89af9
MD5 deb0001269e80364fe4b1468be5f3048
SHA1 909980e7da731522599376caeb3df9d6190c067d
SHA512 28b4afc4d3ecba9bbae4de4ebb302cf7a629b33103268e82667058b791e9f1ccc70c9b7e532bcdba4677e77e51d6eb8690a5aaea572d42465cc18f3072528394
TLSH
T1D651A3829FE303E5FFDA88F28FE429EB373E85C081836E72C198C6B8C9463548094048
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9970052a8301f130e7e7f3cea2bf4e1e7392068ce5012e1a77ef451574f677a2
MD5 cfc2e3e1e205e38a93af026f64031f97
SHA1 3ec04d79d522dcabf61a5b988a20ead177b2d9ee
SHA512 cb382e0a1e879b6e81eebc93eed7590ffd71e9dacdb0a5d49de730fc63b4df7120b91f870c6f3c153033c648a98839ec52303998cb16e2c2a8eab0190a518db9
TLSH
T196318EB3C3D5867DC91116F46B296E3ACD1D0A46422C3C16C9E4AF1B93F24B5E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5f409cbd2cb43f93ab5e6beff8bbd4124dadbeef3aed7c0d9ff0d3d9d7ce06a1
MD5 835a7b8dc147b52be41609d88dac5095
SHA1 4cce74ef720f17a093936ee0d8a7e9c1efe0034f
SHA512 78596ecbd7023c98b08bf1f5cefc2aaec48beff8e10eeecc5d91603fae06218aa17a9c092f8afaff4f39fa4baca686cec0cc54d2d3b838b4e8954b812dd2ad7a
SSDEEP 192:sxZMRYWD/f7sN/KIdpdGpHW6+WNGY36aPCIgrJ:sxZMZD/f7sN/DIHbGXl9
TLSH
T16A22A752AE24A97B8CCBD20DBA25BF13D6F9503251D51E58EBFCC61C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 930ce0af4e097c5ee94d69f7bff62cf253d86059598811666f5fccdeea770607
MD5 396c6680ba16b24ec2a53f7f812508ee
SHA1 961e8afbb425642c14faf690e7016ba88151dc2a
SHA512 85d8827f6c4fbd850b04797bfb156e2b95bcf90fb74782a4d57f5e0750f781e2d3f0f968d91198774a00e721cbb84973d7e7c0b8544cd476be3d56b3d97ecd4d
SSDEEP 192:sxZMRYWD/f7sIMKIdpdGpHW6+WNGY36zPCIg5PJ:sxZMZD/f7sIMDIHbGXOT
TLSH
T1ED22B852AE24697B8CCBE20DBB15BF13E6F9503251D51E54E7FCC61C05E6ACD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ac7e4cb938832822ff6ba3c9e61229c7ca82e75a6a2d6b8a4d18dc8114662acc
MD5 2deee1d416f78ae40042fe73f5d5cb55
SHA1 a59e28245b17b37b020e7e98d979a8aa06fa9289
SHA512 0367b01066cc8a26ab20edf54e1cedf07a54436c81eed84ac1e52ba0f3d95d567818cd6f4edeb2610071a60750c1615d3bbf3848e0ca963f2f8f5f74109c2657
SSDEEP 192:sxZMRYWD/f7sI/KIdpdGpHW6+WNGY36aPCIg5lJ:sxZMZD/f7sI/DIHbGXld
TLSH
T11322B652AE24A97B8CCBD20DBA25BF13D6F9503251D51E58EBFC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 226c94fecfafd17088b98fa9ad8d4c66ede4373e4e91b545c9d4912056a78609
MD5 5face9772a22a11b2fd643116dcc00ca
SHA1 959d05fde0af0fdaac9ce8b55d43b516fd4164f5
SHA512 a0491dfec7a243bccc7a52150c1946a5a3562ad2330a797a19ac13d445ecafbaa5f4174192af8dd1f17028524345124d9b9ab07d88da5633fbf0c059450510fb
SSDEEP 192:sxZMRYWD/f7sIMKIdpHGpHW6+WNGY36LPCIg5PJ:sxZMZD/f7sIMDeHbGX2T
TLSH
T12022B852AE24697B8CCBE20DBB15BF53E6F9503251D11E54EBFCC61C05E6ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f8015936ddb2ec4bbb7a9e584454b0fb3c45637baca301f3388f5b3d3ba61e69
MD5 b172b34094f75bb81525bbba622ca775
SHA1 0be1c4812cbd1fc51168dd5b851e37e49b325a70
SHA512 7cc8af930206594e11a3f17b7b9ca1e77a848b6b0e190c78172ee4ef44a019dcfe42710c62589c4a6bd93fb3b51208b11e9f0a17e588943b28e62db6b673c306
SSDEEP 768:AqKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/UroAp:AqKlm7QWvUYe0u1ja8/L/E//Ap
TLSH
T1CFC2FB3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ef67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ef67.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 47bf9199a4bb7ee0dfe254d81565a67f64b913bf836d9ab51372b5b84da23219
MD5 d7bac2302a71c6ee991f6040e52857b0
SHA1 df78a9b3e1f6dced9df56ed547624aa8b8b46dc6
SHA512 2427e498df1e54b6cc363465fd6a5061fa934ac4a01651a4685c93b6344b97729ed209d54f8626efd22547e64a497a7762fe057231c199b22625f52784f104cc
SSDEEP 384:VDZcIKsNOsNqNH1bDgKh//at67KPsa+VYMd7UfoO:lK9NaC/OPhgXCF
TLSH
T1C3828D31AD74AC7A9CE79291F44776138FB880A7A6C82E90D7DDAB1D01EA5E81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 07a81757c13a079591f4380ec5ba683d85ae25b1624537a085b2c73b28c7d2ba
MD5 b913be4b03294cff485c61c668cb86e6
SHA1 cf0d664aca03357d09714c568f508453e1afa3bb
SHA512 94c1bf0046d9cb0195967835e1bdba91936b3ff2a3358db8a2305ed3b9bfe1eedf703aba6ac904c791a2c2e81575e299ff442632278e973472d1cf98e42cd72c
SSDEEP 192:BONO6JUm0QmiUyHcso//OywtvCxBCH2U6:BONO6+mEPso//at6WWU6
TLSH
T15902D739BC68BC7B8EE2AE45B0477B239FA4107BAA911F84DAD92E1D01D715C1342C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c1cc5ba15fc2bd0c905e34cdd430a75956d5d7e1302855903a12026eefface0a
MD5 d23cc0deda8fec9212195c340df14499
SHA1 cc84ae1d4a035d1337390607425ce2949742ae17
SHA512 18cdcf993bdc42acab9326b9c1ed1e04f12581c3ec3c759eae782316d2662c958fad025a3eec9284da80e8904669cdd036bbf1788557e43a961685a8ebb825dc
SSDEEP 384:26DZcIKsNOHNqNH1blgKh//at67KPsa+VYMd7UfoO:LK6NAC/OPhgXCF
TLSH
T112828D71AD74AC7A9CE7A291F44736138FB880A7A6C82E90D7DDAB0D01DE5D81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9effed3b08b5cb4af32b9d0201aaeb6698f0e9dfb3c8138d70569e569780257e
MD5 87f88c5bb2a6e77083340d767eab77d7
SHA1 7e21b35887dbedf7d0ed75c197ca67dadaa81526
SHA512 4a59f9b527ce663c2018839e8805df456dd680775c36756e53eb3536fd5a70f734e0305c3ca77eb2c0bdfa13109fb498a0d72b3431fffcfd77ec7819f6a036ab
SSDEEP 384:u6BViFiZcI+0sNe8TUNTUlIlHNqNH1blCKh//at67qPsa+VYMd7UfoO:5cFQBjwg+NiC/uPhgXCF
TLSH
T1A7C219F258D7983AD9AE9783B77E2E128E7CC0A7B5845950B3C95A0CCC961BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f99872423d2301794d805d31af1f91bec42fb1e3c38db1a9150b4bcef2a95aa
MD5 6af0f1173fae8f480641950995ab38b0
SHA1 4ce5099dfbfebc7ebaf0f691f9f92abaf4787d46
SHA512 0280f273fd8021e5bbdfd2d12e7fc1b84b788de0bf7fa207d54b20ab17eede05e86f1180b6064a36efb546987d302964c005679948fc49e0c78bf44c44e3f4c7
SSDEEP 192:BON/6JU5QmiUyIcWo//OywtvC7OezfeNxz/zU6:BON/6+XcWo//at67CPU6
TLSH
T18C120935A864BC7B5DE3A595F08336139F640167EA896F90E6DD2B1C02EF19C630BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5924a85ccfb23aa8e49fb5e3accfc95359525aa7d17437738bb3f0603ffcd9fd
MD5 03d4bc9538231d13787d99a764d28a94
SHA1 eecdbe42283884cc56c6a956d7be32a3b23145bc
SHA512 6b5a0b6c51988febe3b79ce85357f849cc5acc49774d56debb42fe7cc54ff6301ea08f197375f8510cebc85f5b4f284d3476347cedf8125e1ef1f410d27aaeb5
TLSH
T12D41F658AAEA1108B3B77F5A9BF7A96E447FBD732E06905D10110E4E0626A00D861737
MD5 SHA1 SHA512 TLSH

Submit Download