0d2797721a17e9eb26c022d55519b487f7853303652895a910a4d559fc915182

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0d2797721a17e9eb26c022d55519b487f7853303652895a910a4d559fc915182.html
Size 34KB
Sample260912-rsplcsdb77
SHA256 0d2797721a17e9eb26c022d55519b487f7853303652895a910a4d559fc915182
MD5 b9a7872cdd372f7e2a792a66f387dc41
SHA1 52db3eadb48689688ca5983b641f308585690393
SHA512 116116216a3a26dcabd3f91bcbc6011f2b645b8ec07eff1b84520a4faf2ddad78a7bffc7e93b043999fcd7b0f37ce3b247dd738cee0ad2cf24cd2d6be88ab5f7
SSDEEP 384:i/JNL8cueq7UtU/UnhMhSsRfvZ83+ltOGw2:iRp8eG8MU+m2
TLSH
T16CF29664B9C221230177937D4FA7920CFB39516782051344BEAC67E62FF0954E6ABEBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338344691303078"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{965E1DCB-1174-4686-92DF-39DCA0AA9034}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 4404	2260	msedge.exe	84
PID 2260 wrote to memory of 4204	2260	msedge.exe	85
PID 2260 wrote to memory of 4788	2260	msedge.exe	86
PID 2260 wrote to memory of 4788	2260	msedge.exe	86
PID 2260 wrote to memory of 4788	2260	msedge.exe	86
PID 2260 wrote to memory of 1560	2260	msedge.exe	87
PID 2260 wrote to memory of 1560	2260	msedge.exe	87
PID 2260 wrote to memory of 4392	2260	msedge.exe	90
PID 2260 wrote to memory of 2104	2260	msedge.exe	89
PID 2260 wrote to memory of 4392	2260	msedge.exe	90
PID 2260 wrote to memory of 4392	2260	msedge.exe	90
PID 2260 wrote to memory of 2104	2260	msedge.exe	89
PID 2260 wrote to memory of 2104	2260	msedge.exe	89
PID 2260 wrote to memory of 4580	2260	msedge.exe	91
PID 2260 wrote to memory of 4580	2260	msedge.exe	91
PID 2260 wrote to memory of 4580	2260	msedge.exe	91
PID 2260 wrote to memory of 1088	2260	msedge.exe	92
PID 2260 wrote to memory of 1088	2260	msedge.exe	92
PID 2260 wrote to memory of 1088	2260	msedge.exe	92
PID 2260 wrote to memory of 3540	2260	msedge.exe	96
PID 2260 wrote to memory of 4092	2260	msedge.exe	97
PID 2260 wrote to memory of 3540	2260	msedge.exe	96
PID 2260 wrote to memory of 4092	2260	msedge.exe	97
PID 2260 wrote to memory of 4260	2260	msedge.exe	100
PID 2260 wrote to memory of 2896	2260	msedge.exe	105
PID 2260 wrote to memory of 4292	2260	msedge.exe	106
PID 2260 wrote to memory of 1248	2260	msedge.exe	107
PID 2260 wrote to memory of 4820	2260	msedge.exe	108
PID 2260 wrote to memory of 4820	2260	msedge.exe	108
PID 2260 wrote to memory of 4076	2260	msedge.exe	109
PID 2260 wrote to memory of 4076	2260	msedge.exe	109
PID 2260 wrote to memory of 1900	2260	msedge.exe	110
PID 2260 wrote to memory of 1900	2260	msedge.exe	110
PID 2260 wrote to memory of 2356	2260	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0d2797721a17e9eb26c022d55519b487f7853303652895a910a4d559fc915182.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbacf6c188,0x7ffbacf6c194,0x7ffbacf6c1a0
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,975012276082365790,14024923352332962766,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4349795332301771976,8994554493670247390,262144 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,11407118646634244524,4900787058664737037,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,9624658492409084992,7163611139648036280,2097152 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,5182988181849913572,16505389578696942253,2097152 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,10717963667180964305,8143316708070964404,2097152 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,6668299213871347890,13294422203501486374,2097152 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,15202253938466387625,641471154181062634,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16448968064694109033,1253363320942248923,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,12578405567613176396,13988256110474312559,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,12578405567613176396,13988256110474312559,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,6225501416530008867,10084936093496452788,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,14331753903480443340,4371774179154341843,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,2444419938177300741,11327135169510271303,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,9904833265312266362,14435638797042621961,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,16665066090032041364,6732636314016762547,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,2859242734590715233,13144801103392208634,524288 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,13594809208399533085,5264198492379292337,262144 --field-trial-handle=2260,i,7953272244341216258,13034060124496984472,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1324041e05cb3d2c7e5fab8477dac5499dccfe60f2efe71c76315028d92f1e33
MD5 5f7e1764f76b80408eebc8944191c7fb
SHA1 538cd2a616f759da519e08a4c1cced08d384b959
SHA512 c57606b97b6972680319f47d7da9069fa19dce10283ed710dc1f07f714f5025368c43f4151812f5ac1ffbf6019d84fa5b807bb2af30de9ce7b2e3b2f6ea915c6
TLSH
T1B2E07D844FC8C26EA390E5474168C70CCA90374FD3CC6B8A17488EC97145064BBC6B90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5ebfa86e0039068a55922fd725626f85bf5ebd9d374458b1342acee57f57384a
MD5 1d921085f81dbd8de3e174a0743e71d2
SHA1 120f859c51d259cab7939069279823f54adb29f7
SHA512 825c1c69fe34d0183310856568d89a1d291e835a7c90aa193e66dcfe0096a5e2d4232f41f22677eb78858e6f97d64e6ddfe85369649dcb4556736dbbb1079dd6
TLSH
T1D661878E516A4AB5FF5F9278A9D120CF3A7056E07F436D223D7ACC7870263818338354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b5af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b5af.TMP
Size 3KB
SHA256 d19cf27895a4cc52e92416663fc140b384189ea6db2431da5b4350885d22ad08
MD5 03f0f56b610284ceb8c445412e6540e7
SHA1 2dfad65a197d4b3d273bbaf49cd193016e338c7e
SHA512 621c7d3aea034a614609d57271565e21e8d0c7df8a1f696924a68a5a0614e99d4015a26e7f258a6a20faca302fb100480d46d71d46d4723cdd33eb1b6180ff21
TLSH
T1ED61878E516A4AB5FF9F9278A9D220CF3A7056E17F436D223D7ACC7874263818338354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1d8d403889da17ce98cc33d99fe05a27d59807882a0b0cdfb0a17be962528431
MD5 f65502ea746f395006c19253dbadaf1a
SHA1 45a3765591855e3da51c9744e945b82b6ff23e5b
SHA512 bd9a45b5f13bd716b64fbf5529f4aa26e601b45436f5a8296391f3e958cf7c62a1a2dc637f33ba369149f7030a9eba88760f2226f7e74f5a16c70dd0dfcc250e
TLSH
T1F3216EF3C3D5866E890156F05A24AE17CE1D0516421C7D1599E4EF2B93F2475D10295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d5778e4402e8d98559e2c508f61ffb1c48dc11c9c180253bc1ff0a437080ff0c
MD5 d03e47e7f8ec08de43c27bca3e3f9e91
SHA1 675850d634dc5a3be37cb712f5d7ffab84f94d63
SHA512 afe759264632527c17b93cec04a5899a49aa74b928b3df02e08504eea0eb0127ec5c4273dd34492bf39dc429c5103a2ca791d25258e7f69929fd3e9af9c6a3af
SSDEEP 192:sxZxR2Wi/f5siP/IdpdSHW6+WNGY3RU+pIgrJ:sxZxvi/f5siPw8HbGHq9
TLSH
T1AB12B7156E38A57B8CCBD20DBB257F53E6F9503261D41E58A6FC862C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 be7aaf9d91848a345778fdfba080cf2efa3aa4ebc83deaf245a34246966b2964
MD5 0914745c50043ade14fec07538048ed0
SHA1 6391757dd1344a654f4bf3980ff5c821170fc950
SHA512 ac4af0f41c9650c09238381232d37fd7de72596138edde65d7fe5dff0384d163e4fc84c79c152b207656956385d0a9a6deb69ab57310e771ac1d79d2a8005984
SSDEEP 192:sxZxR2Wi/f5skl/IdpHSHW6+WNGY3xU+pIg5OJ:sxZxvi/f5sklwyHbGlqA
TLSH
T11722B8166E38697B8CCBD20DBB557F53E6F9503261901F58A6FC862C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 18a1baa5a0e17c055ec10959de56ee32d287302dbbb4cf4f214de40a7b82a388
MD5 b7e56742d0e5f162a2c1ce9cb13b66a4
SHA1 860678fd588b2dbe56f0d7dbbb5a5613fb58f561
SHA512 2c8d86220a0be7f1dea592dfb04dbfccb877a690d960e270457a6df48f2b3ff30e7b128b009d347f90756faf12346f38b42340d011755d5ffd6dd200538120bf
SSDEEP 192:sxZxR2Wi/f5skP/IdpdSHW6+WNGY3RU+pIg5cJ:sxZxvi/f5skPw8HbGHqC
TLSH
T1C022B7166E38A57B8CCBD20DBB55BF53E6F95032A1D01E58A6FC862C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b870d4022cd3ab1e89be5af32d2c27a3ac43d5eb19c99c96028e76cf301eaf04
MD5 27ab2831098074d9fc0b7cddd1a537e3
SHA1 aa5eeff2537578ac6323839a8ea6b6a4a7229730
SHA512 480d6f982792e010bbf6ee4dd9d0654ea6034fe18287001d72e2326e7115d4f33369a919e06af92c25de6c0ffffd1d5cdc6b0d984c4bdc6925661ce05cf0d8a0
SSDEEP 192:sxZxR2Wi/f5skl/IdpdSHW6+WNGY3AU+pIg5OJ:sxZxvi/f5sklw8HbGsqA
TLSH
T14A22A7156E38A97B8CCBE20DBB557F53E6F95032A1911F58A6FC862C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2596f6512e4da08d2e4a39ca3e536ba980369f77f13c09a7e0c90010994e8767
MD5 185b69c305f5fe647e5cd6546b9e6f80
SHA1 4094d3a81e71a615280d4d36f00668ddf0f5ac80
SHA512 cae53e53f8235e47a7ca6e3a10ec4fba8a424533853015816a1be2559cb2d676e4f0ad683ae72bbde7f67214a444b98dd8cdc532e6b66a634d780e996ca06388
SSDEEP 768:tn30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ726rolZMDw:tn30AbSWvS2l9u1jaLmLZ12xX
TLSH
T11BC2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796548D4047FA944C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d939749-4cb3-4de8-9030-169c2780eee2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5d939749-4cb3-4de8-9030-169c2780eee2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 283814455416755805364cff6e679d41906db0e4fa5d74635619d01e9eb24b38
MD5 921a119c438c37a8ba2cf07659e566a9
SHA1 c7a1e9f4fea7bc4501353f069a7689618c43b6df
SHA512 96400fcd8e65619596ca48ed150192c1349ad4916754c3fd7175af809d6d5d59c65a8583db5e4d48ca8ade73f12cc9c3378e45ec0ebcc75e3f43c4f74594281a
SSDEEP 384:nZcIDsNVU5yZpuRM19iX5Fbzxy7O6R2FeoMTo3:PDSZtbaVy7TRRI
TLSH
T186828D7268B86C7A58E7E155F44736039EB8415797C86F80D8EDBB3E01DA6D8230BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ba66fd1222f62a92251aaecc2692a1caa65ff7db0dc57cf199e1f8b8319422ad
MD5 4ccade4a577ab03dbabb3ca3907ac582
SHA1 b1afa899a0bc1ae83386948fe1bb46f499266ea3
SHA512 bdf4c9e9c081e1b84812fbee863f36113e1e16e173d7f183e2bde8732bb4abfee9c2e2eaf328c1ed200724caa8401474f5883eaa441191123e6032a10eb4af95
SSDEEP 384:7iFiZcIyVsNG8TUNTUlIl8yZpurM19iX5FbzAy7O6R2FeoMTo3:WFQYjwgLZzbaUy7TRRI
TLSH
T14DA27D7358A89C7E9DF7D645F54A32039EF940A7C6C4AF80E6DC6B2E019A1D8130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a18e381387f16c7f5c9d3ad0b37be8ea303ff8379751a13019f8258c73e6af78
MD5 aa8dcce77ae14eeb39d84b1990b3621f
SHA1 e0c5039a768d073ed1b3c5ac77fef56e63cc3f84
SHA512 29449c0dcb04d565d7028a788a3888667b55d00434dd0c7a39674ceb911511d8d58c65fc8d1d4924dd4e50240c0f8d0b352966f44b8b752351658e937bc7b756
SSDEEP 96:gqONkEQsjpfuMVwptaL5ih/cIPURHl8h4otop5+iCDSBIPuva6zx8X5FxbxLYviq:LONM6AmwprQmiUyGy6siX5FbeJiSNU6
TLSH
T1EC02E935AD686C7B8DF2AE49B54737235FA5116BEA902F84C9E81B2C01D769C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ce83af954bce121b62f55f42c4b9ab492cb8d66d8e385d4b16d960e9d0d66384
MD5 5b168ae43e11695da6060c075ced5207
SHA1 8292c60f01345b4d4b5d92aad037a8a44226479b
SHA512 0e7025ededc3af2de1e138d89e8b594f1fe18553e1ded51fce6a96f2716b291b925ada66c52df1a0ff01b3c3903b225eb11b09a6b6ecf4f0e8ef718f76648c48
SSDEEP 384:1ZcIDsNVU8yZpurM19iX5Fbzxy7O6R2FeoMTo3:NDHZzbaVy7TRRI
TLSH
T156828D7168B86C7A49E7E155F44736039EB8406797C86F80D8EDAB3E01DA6D8230BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cfa0ea99babf9606b3592f6c038bb8db47979adc6dc7c5091d56d681819bf0f7
MD5 5dbe0938ba917f64012c2e9b56a0c162
SHA1 13830096963bf9e3826a1e516bdfe8785d37ca43
SHA512 2c92a5a603f1122563ff4aa848de3aa261c5558e0053ed8138989ed2f032b65e08c14111888cc7a6d94cfdadc337cb2de436f3f507ac216f94636adda8daed65
SSDEEP 192:LONn6AmwpDQmiUyUyHsiX5FbzQe+lRG/tU6:LONn6ip1IHsiX5FbzAyU6
TLSH
T107121A36A8B86C7B4DD3E554F04736135EA55267EB847F84D9EC2B2C02EF59C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a37bd6af-4456-4c29-b23c-b4f8a5a6fd86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a37bd6af-4456-4c29-b23c-b4f8a5a6fd86.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6860307142ca0a63e7bbd052f3f882c8f3b45f88b60da48fc8445826f7e6ad22
MD5 ae159e2bfa2cacdaebae1a0c68dabb16
SHA1 fa87d5447d974c89228b0dbe4da0a75a440f2122
SHA512 23b2af04b45b35fb060eb46a5a366461063065978a1740b3ae530be4ba3e32ba58a2b645b5d9f1e81dc61e022b5f4049548898e0ff9b0de18825964d9762dcf2
TLSH
T190410A58A6E91148F3B76E56ABF7A8AE887F7D272E07C55E10110E4F0676A40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download