da7857995f1d136d80a44fefa3788536e35d8754a85289be23665c76f0a27305

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_da7857995f1d136d80a44fefa3788536e35d8754a85289be23665c76f0a27305.html
Size 1.2MB
Sample260912-sdw8bsde33
SHA256 da7857995f1d136d80a44fefa3788536e35d8754a85289be23665c76f0a27305
MD5 12ab52e4ddaf6fd32415fa1d389bb06f
SHA1 56803d57760b269e5bdccc9c39dd07e99486a7ab
SHA512 4df96a0f18023e7e4eaabf4cca402aaabcdadd78fa7b5d3420338957a5df3cccef77878387e963d82a610a105ecc8d24e0777dddb02c7c750b07398e289e7466
SSDEEP 12288:XCeSXyMTNrjTEY0+kC6bhxs7jGKLLgMWI:XCRyyjT3kC6bhxsRLsMWI
TLSH
T11645C7DB9231717FF833A8B596C8A949F3988CC1E5164AB5BC70A61343EBBE61351331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3580	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338347195085090"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{EA5EDA55-DD31-4459-B7B1-91C61DC13A5D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 5028	3372	msedge.exe	83
PID 3372 wrote to memory of 3580	3372	msedge.exe	84
PID 3372 wrote to memory of 1800	3372	msedge.exe	85
PID 3372 wrote to memory of 1800	3372	msedge.exe	85
PID 3372 wrote to memory of 1800	3372	msedge.exe	85
PID 3372 wrote to memory of 4040	3372	msedge.exe	86
PID 3372 wrote to memory of 4040	3372	msedge.exe	86
PID 3372 wrote to memory of 552	3372	msedge.exe	88
PID 3372 wrote to memory of 552	3372	msedge.exe	88
PID 3372 wrote to memory of 552	3372	msedge.exe	88
PID 3372 wrote to memory of 1240	3372	msedge.exe	89
PID 3372 wrote to memory of 1240	3372	msedge.exe	89
PID 3372 wrote to memory of 1240	3372	msedge.exe	89
PID 3372 wrote to memory of 4292	3372	msedge.exe	90
PID 3372 wrote to memory of 4292	3372	msedge.exe	90
PID 3372 wrote to memory of 4292	3372	msedge.exe	90
PID 3372 wrote to memory of 2500	3372	msedge.exe	91
PID 3372 wrote to memory of 2500	3372	msedge.exe	91
PID 3372 wrote to memory of 2500	3372	msedge.exe	91
PID 3372 wrote to memory of 8	3372	msedge.exe	92
PID 3372 wrote to memory of 8	3372	msedge.exe	92
PID 3372 wrote to memory of 8	3372	msedge.exe	92
PID 3372 wrote to memory of 4620	3372	msedge.exe	96
PID 3372 wrote to memory of 4620	3372	msedge.exe	96
PID 3372 wrote to memory of 5064	3372	msedge.exe	97
PID 3372 wrote to memory of 5064	3372	msedge.exe	97
PID 3372 wrote to memory of 4908	3372	msedge.exe	99
PID 3372 wrote to memory of 1812	3372	msedge.exe	105
PID 3372 wrote to memory of 4664	3372	msedge.exe	106
PID 3372 wrote to memory of 3144	3372	msedge.exe	107
PID 3372 wrote to memory of 3788	3372	msedge.exe	108
PID 3372 wrote to memory of 3788	3372	msedge.exe	108
PID 3372 wrote to memory of 4572	3372	msedge.exe	109
PID 3372 wrote to memory of 4572	3372	msedge.exe	109
PID 3372 wrote to memory of 4160	3372	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_da7857995f1d136d80a44fefa3788536e35d8754a85289be23665c76f0a27305.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff85b01c188,0x7ff85b01c194,0x7ff85b01c1a0
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,2296069187687909655,15700258735985016659,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,9504594341707545836,6508994862107321722,262144 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,569400944268728014,9177483950552573206,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,982482863662881995,10835060091839070295,2097152 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2706898129508685048,8187688546116316806,2097152 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10927065439786036361,3908777549697773939,2097152 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,18432861599206060587,6407632992627287966,2097152 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,2003088212938101771,7046941695520636104,2097152 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,13592829699654258752,2756004913290883518,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,18284458428976432183,15571838527906255139,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,15926980449344120963,2938689855263770688,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,15926980449344120963,2938689855263770688,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,15684486971836838164,9915204903491946632,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,672558590085062903,7786715470363754108,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,9784271226095737829,6041840802269822180,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,5654217664273911572,11919727966660444973,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,2539012584933731223,7272715718565040091,524288 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6336,i,2893908650652222373,7062612781879331452,262144 --field-trial-handle=2336,i,12644320313948612640,3527983533719658673,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4e5ce88728804a982ec51a268ca7b934e6a158d3a5d07364922a40ad4202e75d
MD5 96562b61f6fb39e1f4ea9a32371ec4ae
SHA1 60829d7791f4dfbc475116978b0c7f8cba27f484
SHA512 8edd9543e4d044ad88da60b329167e25ae5efc83237ebea813d5302599f3c9d32ab8e9e4a3c2d3107afb50ec705402adb959833f5dea625513d948fa17d6567a
TLSH
T1CC5184C01AA407D1FFE890F449C4108B3A3D6CB15A432E323AEBDEB6E34A759703C084
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6b762910b45dad4a7d43cbd9654bd70ba28a6bcd01b55d270331b00de1d666d5
MD5 07cc524be6ca7f9e8dd66a28caed5fb7
SHA1 26d50394daee53ea5e1abd3f666ace9b9633be26
SHA512 38d6a697f1011519fb43a786784e16d604c63dffa56fbc545c661e647e66fcfc4a038cf6b426ec984b4e3cda2b64969c2f36f8044c508afa197ecf88db743910
TLSH
T194316FF7C3D4866FCD1156F05A246E2ACD1D0A17422C3C1589E4FF6B97E2475D20259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 bb90c91bd5cb9e098a44aa7517ca7f700cc5ac8e034951200f21b6e144b6647e
MD5 5a72b08a55e1fbae240268dd5d940abc
SHA1 224b9601975361aeda95a43038f0f96c7629f2da
SHA512 12bec4732445bb85842e9cd52ffad39004db630387865575bd22a26c0b98731f72de25dc1531eec59ebce9e944de038b8db153977d1014fdba81a65201a86b67
SSDEEP 192:sxZGR4Wq/f/s1FIdpd0HW6+WNGY36aZSIgrJ:sxZGNq/f/s12yHbGXr9
TLSH
T14912B8116E28A97B8CCBD20DBB25BF53E6F95032A1D51E88E6FC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2861c8f27c1665d6c7c32bdff23db0311229521cdddedccf456e3d79f3c46166
MD5 d0086d792c222d63e8c42e84fb7bd35a
SHA1 3faee0c23b46a7e0bb54096506d526d704ff0616
SHA512 477985a82f1816645bd16154b870ba8f5cfe76d5dc140b445ffb3fe0be55ed728cad4a9b6194ef4c82f37f67ee83428a73bfd75cec002c5fdb44afffd4845dd4
SSDEEP 192:sxZGR4Wq/f/sjFIdpH0HW6+WNGY36bZSIg5TJ:sxZGNq/f/sj2UHbGXkr
TLSH
T16A22C9566E28697B8CCBE21DBB25BF53E6F95032A1D11F84A6FC861C05E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2566b22fef4120db0cb18aca0864a77f07b1abdc49d39c29400cf8a8679933ed
MD5 0edbea78674ffd1e85b3241343598d96
SHA1 b117c58d72f5cab145afe8a28e3ccab1d02ddad9
SHA512 4ebc731df3dc5cffbabbcd6faf7ccb425515d31140a6873fd178fa2b95e9556442728a156090b8e099caaddfc459155d1bd695d5c0960930dc0b8f9858aff35b
SSDEEP 192:sxZGR4Wq/f/sjFIdpd0HW6+WNGY36OZSIg5TJ:sxZGNq/f/sj2yHbGX3r
TLSH
T1A222B8556E28697B8CCBE20DBB25BF53E6F95032A1D51F88A6FC861C05E76CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 daa23e4a68088dfa0b267c46c29879b8a9b60c883f7d5fb6c9ed8fca392d38ac
MD5 6a79c6756cb6400931a5c9c07418c571
SHA1 e9d7bcd31da4e78524af4ad88bfed47eb213b4a1
SHA512 ee2205aa026ffe738c2aebc7f89efaff7993977923c82a01726529e4d5076536c5a17f0cb142c7c74f7195723dd5f9e6a9c6ad173875070c0a50c111dc4fa6fc
SSDEEP 192:sxZGR4Wq/f/sXFIdpd0HW6+WNGY36aZSIg5pJ:sxZGNq/f/sX2yHbGXrF
TLSH
T14B22C8156E28A97B8CCBD20DBB25BF53E6F95032A1D01E88A6FC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 62b7bc16a5449fda3f5b1cd6869b7dec35dd167bfe7a77dd0e78fb672f03258e
MD5 8c5b068d1785fbd2109a3e2b80bc2b15
SHA1 08891be12c4466d96ab67638fb3065e5a26d10b0
SHA512 9c60aa890a2f896f0411cff8dc0f0ff957f3c387d4d958fa2d4498f04f62a7083673eacdb036fe441cbb96d90176e9be764ac97cf26cdc00a31789420a4a3d30
SSDEEP 768:hNKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/qroNk:hNKlm7QWvUYe0u1ja8/L/E/BNk
TLSH
T124C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 54da5e96bce80a5effa939a4421a253105bb3d283562da3739a3c2693b7f5d5c
MD5 995e37b40e0b886880b4771b0be6a804
SHA1 546e938c9210f1a18fef9cfb5e30604e0a917315
SHA512 22312421e3ec9b155ab5735d72290270c20e89717fcfc0be823423a517ffd60ba113ea3b5b0e69a547c8c186d9478deaa2c14b5bf3ad5a0b7d9a2fffd09d8c79
SSDEEP 48:K0BQ9xbfj8bP6nISJ8K9p1D8xhsYarhhyL6lI064I5bkjUISs5K9Q1K5xipYb8gu:KUuQKTS2OJWKK0VcYKBuSX
TLSH
T1EB91541232F70251387F656885A18B5F424175B33418EA2BBBFC10B2CDABE481DFD8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59bf3f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59bf3f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 c56050bdb8d004c8eb036336706cf21afc1b4db895b2da9486ed008c05ddb612
MD5 13b936e3e499fa67cad39259e1004c51
SHA1 81256d0a188f2afbdcd740f2e631569f09fb2a87
SHA512 51ca49d272bee728540216e6e565c7f5f303a5c2f118ad37b481f41573325f6cec47e6eef51bae521eca330b0014c9570522db5ac24965f88f9e6b0cdef43018
SSDEEP 384:HiFiZcIbjsNs8TUNTUlIlPUd1b4a3h//S3KI7O6R2FeoEhoZ:CFQXZwgWdRx/xI7TRbK
TLSH
T114A26D725CA8DC3AADFB9685F44732139EB440A7D6C5AB90E6DD9B2E01DB19C130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d8d19696c9027fb36624a4b3bcf684d5ace83474e6e79e0b3dc6ae99562f7bc0
MD5 20e95a7879b51374a824bef12f2d9f00
SHA1 a3e08f55d56099c049b7f92e4ec318059a5c96ad
SHA512 f8204a0cabe60fbc6774c40d43b80e164836aa75b3a64c32eb3d24f09a8a57f3a09fbfd5c8e8324648510538eddbfd6b3bb36558216ffbf83214b4f03b17595a
SSDEEP 384:sZcIBsNkPUd1b4a3h//S3fI7O6R2FeoEhoZ:6BsdRx/gI7TRbK
TLSH
T157828C716C78AC3659FBD195B48737139EB88067A7C91F8095EDAB2F05DB1A8130BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5aaf4abbf8ba5cfc11eb0292e529432300309e463ff470a3eb2d2be73d4c06d4
MD5 b58d170a70e152734ec8ea23feb18810
SHA1 2451064aed4d1349a4f5d279c228de369c8d0d8e
SHA512 8954f9e674b9bee0e0c7fa14507cd1da946bcaaee048725cebd6029f5fdfcee0e2aaa5785b707ffb71dd4d96e37ece6a9c4fc62e51f152f05f8e16c4f2da79fa
SSDEEP 384:KZcIBsNkSUd1bDa3h//S3fI7O6R2FeoEhoZ:oBndox/gI7TRbK
TLSH
T171828C716C78AC3A59FBD195B48737139EB88067A7C91F8095EDAB2F05DB1A8130BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3f76a34789740e2b90712284b28f5d26e8c28c49b5703627468c92507d207f19
MD5 4ddfb98c3fa5f13b130325e3cc40aca8
SHA1 054619075558736142d050e40980009c622bfb62
SHA512 4261eddab0f33bedc251f1f5f6f2d18e186a5a7ffcabf506470b6ad7356991e7d20041063f79b1d067fd134ba1f3ee2c556d618a06b59b667c64964b46aecfad
SSDEEP 96:KqONkRQsjpfbUyH5ih/cIPURHl8h4otop5kNDsBlP4v+Y1xf//ojdDxv3ywxxPLT:BON16JURQmiUy4gFo//2yw3cNxs/hU6
TLSH
T1B2121935B868BC7B5DE39580B08736139EA44127EB856F90D6EC2E2D02DF16C5307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1f8797eb82046d1a2afb6fff26f0b7601e22e23cebd2ccf59563d332980c76f7
MD5 fa65ffa3676d60d8ec9807314238635b
SHA1 fb5ad57646ea1956a72438847067373c26cb1c9e
SHA512 b7366f0eabd29cb08703b13f0de33150470bd8c82b10060f6a71f2750c13ab0dc175c89ee0b82dcaa503d28d2cb4643a0afc63ba92b01f8f742c5956d7ff428e
SSDEEP 96:KqONkCQsjpfbUmjH5ih/cIPURHl8h4otop5kaDsBKP4v+Y1xf//ojdDxv3ywlBCj:BONy6JUm0QmiUylgso//2ywlBC3NU6
TLSH
T12B02E739BC687C7B9EF3AE45B48777239FA4106BEA912F84DAD81E1D01D715C1303926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1d206e0-5fbc-4ecb-8ddc-c2eb3532bfab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a1d206e0-5fbc-4ecb-8ddc-c2eb3532bfab.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3bdc2ae89c9892eed34a53475aecbcc9a01ff716a5826a6cf75382f58bee750e
MD5 aa9a3a7b6dda4cd9568e9393d72f2621
SHA1 73c296e29a7207589a898f087d63750b23822fca
SHA512 2480819ae9cabc62dba1ba277a66fa67f90dacd4a5d2551bc4e3f153708a98827ef95044174cea495c30f59cda520d4f13caec9be492a093c10fef2f48247411
TLSH
T1F9414D5CE6FE1148B3B36E5A9BF6A86E047EB9372E06C59D00110E4F0663B00C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download