834879b21cb5853b86e15b055ac7fc9404165a8d3b5a436858f4c82a6c0862b1

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_834879b21cb5853b86e15b055ac7fc9404165a8d3b5a436858f4c82a6c0862b1.html
Size 176KB
Sample260912-teb48azepa
SHA256 834879b21cb5853b86e15b055ac7fc9404165a8d3b5a436858f4c82a6c0862b1
MD5 f65117fafe1a927dd2f7e8dd747658cb
SHA1 d74c92f7dc322841d6fdce925e606055459b477e
SHA512 7a39055030dffc72b3878e1746b9456980b77f9d89be9320c4b4149feb895bfabd27b8bccba76ebd760f2914ede99ad1f8ccc0b55d575765b26477628cdf27e4
SSDEEP 3072:9QkZzs1/4zCq2SldLbXvpXVD++bvaf0wFu9/cqkODLTPVwgELS89FmO:9jZg1/4zCRSuqC
TLSH
T1970479A95B26DC0D9893716DEF732D3421CD0417CC9988AE86C8DC2453B25BE7BD1A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338241939921183"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{5B2FD97F-95A1-4207-AF95-67DDB6BA4ACE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2504	1320	msedge.exe	88
PID 1320 wrote to memory of 1040	1320	msedge.exe	89
PID 1320 wrote to memory of 2632	1320	msedge.exe	90
PID 1320 wrote to memory of 5092	1320	msedge.exe	91
PID 1320 wrote to memory of 2632	1320	msedge.exe	90
PID 1320 wrote to memory of 2632	1320	msedge.exe	90
PID 1320 wrote to memory of 5092	1320	msedge.exe	91
PID 1320 wrote to memory of 4040	1320	msedge.exe	93
PID 1320 wrote to memory of 388	1320	msedge.exe	94
PID 1320 wrote to memory of 4040	1320	msedge.exe	93
PID 1320 wrote to memory of 4040	1320	msedge.exe	93
PID 1320 wrote to memory of 388	1320	msedge.exe	94
PID 1320 wrote to memory of 388	1320	msedge.exe	94
PID 1320 wrote to memory of 3212	1320	msedge.exe	95
PID 1320 wrote to memory of 3212	1320	msedge.exe	95
PID 1320 wrote to memory of 3212	1320	msedge.exe	95
PID 1320 wrote to memory of 3128	1320	msedge.exe	96
PID 1320 wrote to memory of 3128	1320	msedge.exe	96
PID 1320 wrote to memory of 3128	1320	msedge.exe	96
PID 1320 wrote to memory of 3288	1320	msedge.exe	98
PID 1320 wrote to memory of 3288	1320	msedge.exe	98
PID 1320 wrote to memory of 2308	1320	msedge.exe	99
PID 1320 wrote to memory of 2308	1320	msedge.exe	99
PID 1320 wrote to memory of 1156	1320	msedge.exe	100
PID 1320 wrote to memory of 1156	1320	msedge.exe	100
PID 1320 wrote to memory of 1156	1320	msedge.exe	100
PID 1320 wrote to memory of 1976	1320	msedge.exe	102
PID 1320 wrote to memory of 2944	1320	msedge.exe	107
PID 1320 wrote to memory of 2472	1320	msedge.exe	108
PID 1320 wrote to memory of 4708	1320	msedge.exe	109
PID 1320 wrote to memory of 3660	1320	msedge.exe	110
PID 1320 wrote to memory of 3660	1320	msedge.exe	110
PID 1320 wrote to memory of 2884	1320	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_834879b21cb5853b86e15b055ac7fc9404165a8d3b5a436858f4c82a6c0862b1.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff92c62c188,0x7ff92c62c194,0x7ff92c62c1a0
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,3927610639266331158,11212361519747098881,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,1768285407087448423,5520680095473732228,262144 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,7634726390240648924,8880682047629917952,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,1713274202088019942,17015298605610560919,2097152 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9996720553401699951,15358021327165951640,2097152 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4666805544317257183,8773569647991135302,2097152 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,10861412163052077439,2950177967857184478,2097152 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,6208254791214152951,15984575771222682653,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,4407640870765776532,4654896141003041685,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5836,i,9682435422918012704,2874722227214268767,2097152 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,16196456734323409667,12794844076311322839,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,16196456734323409667,12794844076311322839,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,13359045343486244023,2376465623912496676,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,5081810763147124244,10111878536632576722,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,17214261932950361474,17539125185938354934,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,5403340996518585870,8752870385621341486,524288 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5816,i,11370306513311440329,14498159080968054793,262144 --field-trial-handle=2356,i,6899408651716394755,4719406848631296479,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 41b6b96d74ecb1015210c6f912222126cda57b8486c60d42605691de0a71ef3d
MD5 efcf82ca8bac4889bcb2e623556381b8
SHA1 0d9c240a9591123b48a5394aa8d7e8dbe4504822
SHA512 04aac978f8e161f477e1cd734b867b50303f87ea8340e6e4be859118b4d70d1b26c2191de2c6123607ffa1e8e6de914aa47b76fe260d80ce14112c09481ed401
TLSH
T1446194E1508C8034F7BC64FB57DD814B3538D9867FE3FE1229E4E938982636A3398A44
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595395.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595395.TMP
Size 3KB
SHA256 141a83be73ab431b851304c45e797a7f21cec01c67063152ad82300877c1059c
MD5 d525445d27787e627bd836a2842c61f7
SHA1 f7b89398fc5c4ad1a30a16d4f8b2f738e9241a32
SHA512 d09c32aa5367d1ff084125d17854d5c2c783b9b123a4aca1ea1beabad59960b2b1040b5b506a169d4c6b12c037a0fce31e0e46c7657f749fc81291aca773937c
TLSH
T1AF6195E1508C8034F7BD64F757DD814B3538D9867FE3FD1225D8E838982A36A3398A44
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2d7eee4ba19c8a4799e69d23aea21f23ffcc7bc529fc75c7ea4d5603649fe88b
MD5 a8c3a7d1336a5dabeff635e5825f71a4
SHA1 c1c4c90b398f6ab0dc65fa09b95a0b145ea2e535
SHA512 d97570cdaeccaa119cb6ff239500fa70cacf0c91f05b28f3dcd0bb3a311048a59970a183b45389736463d1c3dd193ad4a92c3169c599a24ab5622ab8f97a9c79
TLSH
T157318DB6C3E546BE891166F09A24AE2ACD1D0616422C3C5A89F4FF1BA3F2074D10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ef676780eb9125d1cec9cfa44065ef8c5dd262c0300603d518a428ed5ca1f288
MD5 6154e9dfe65cb518526965b41a766650
SHA1 f6ecf53966024c17e940a24e2f7420689d347034
SHA512 0edb4fb7f476a96769af4b384c878eeec601f26608e8b615820b4d9fb50647ccfca230298775253e98958f15ab02c3329ae507844301fbc535727a135a7ce629
SSDEEP 192:sxZ8ROWw/fns361IdpdPHW6+WNGYaQOFyXIgrJ:sxZ8vw/fns36GJHbGI9
TLSH
T1E412C8516E28A97B8CCBD20DBB65BF53D6F9503251941E58FAFC8A2C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2187efc1d22c31d7cb0623d4b632ff3d2df3b85ec71e38d9e0912c855e22c848
MD5 2124a71142b222618c0dee60c5b6e176
SHA1 c782917fa549cfe5548e33e7499c6a3399e8e91b
SHA512 34646d448c55541a882a0536f762f4cd403bf93f4c544a8c9bcd49e5c97ea291d70684af2ea45a7ccec36390e19d4318602f95626e959bb53702dd90427ffd3e
SSDEEP 192:sxZ8ROWw/fnsa61IdpHPHW6+WNGYawOFyXIg52J:sxZ8vw/fnsa6GvHbG48
TLSH
T1AA22D9516E28697B8CCBE20DBB55BF53E6FD503251901E48EAFCCA2C05E7ACD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6fe6ee78d8ddcd8b06a61bb3b506efa30f61d34380600f09c262078c6052e905
MD5 681c67c076839353dd36fa018775cb62
SHA1 87e610bd2df00317d53f65f13c7d4d5b2e59c19f
SHA512 b3568bd1bf4f9f507f87ebe97b02ba581487defcdd4398b755826b2371837e7816474d04256c1fd148420d403ca36284e9a329a1c8287d77b7949edba5de385a
SSDEEP 192:sxZ8ROWw/fnsP61IdpdPHW6+WNGYaQOFyXIg5UJ:sxZ8vw/fnsP6GJHbGIO
TLSH
T14622C8516E28A97B8CCBD20DBB55BF43D6F9503251941E48EAFC8A2C05E7ACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e8d09553cfbc37d5a12549c624d0b384608284f474ee9ba0d12e0b76aa248563
MD5 16a7d46789f46ce78fa0e6b7f4b7eccf
SHA1 1a2d75bfca776b07f0d4716355b486f2e6fe833f
SHA512 1a27296cea3ada378e5663f3022833f7375d6e3a5a4b5a9ccf8ee60011c826e3b0435acd20959446556338a27218739319cf91af57bcc1769bcf926ebe22ce80
SSDEEP 192:sxZ8ROWw/fnsa61IdpdPHW6+WNGYaQOFyXIg52J:sxZ8vw/fnsa6GJHbGI8
TLSH
T15022C9516E28697B8CCBD20DBB55BF43E6F9503251951E48EAFCCA2C05E7ACD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2001b25d7dfd478672aa77365a7da1f9388d958919021e6ac4b550fcdc6a43f6
MD5 434912ee60fd958118bbf9bacd9aa7ea
SHA1 d1f674751324a4424302ca7e397a235dc4691228
SHA512 5e50ed66f5d2a0bdd5585eea3eb11f421ec91ee70735443a5c86b82a315920e5d8e45bb7f5275a991e1a44273ec5d35019ed4d4d4acd60c20a13c4b83880e44d
SSDEEP 768:J+yQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3CrotZ+D5:J+yQRbrWvvlpZu1jaXKLf33ZtZC5
TLSH
T11FC2FA2B640CCB7E4FC01E9DDC6A6F977EA802C766588D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 8de6669bc157a4ac5c9a949153cc443b6305c94e6121257c954fdacd56abf1fd
MD5 1de94ca9d5a050aad972aa4c522a99f3
SHA1 9a7e4b402d235ba9bbd680cbb7c297567c3801ca
SHA512 59ab54c9883b6c735b7c9f9f0a99de8dfafec61802440609ca6b9ab1fd470d47ee279141a7c5ae6de69f722bfc628c24a5d4d6a9f214b13298d4b1bec80c14b1
TLSH
T127112180A3D640857E8DBA85E10F4B2395A5FAD7260D9931231F84F09F84C2C0F5E964
MD5 SHA1 SHA512 TLSH

Submit Download

0129c38d-a274-412b-a7ad-4da76aefafb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0129c38d-a274-412b-a7ad-4da76aefafb8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 043d73ae6a47a691d032138af3b711dca10d00c24287c7f2fb7f6c5a2617d265
MD5 e6273fded0f8845176ca6dca7b0eb49d
SHA1 f488325b1568d8151593e5cabefacee239613876
SHA512 3764b82537699c7edb607b54cde4ec5aae43f5f886e32dec71d89e056eb2607ada656dc5d6043c231c352d4baed3784b00394288ac8ab9ccf648432aadee4f50
SSDEEP 384:HZcICsNmLK1n9dPp5u8i3xKslBkwc0aGoj:vCWHk3oslBkuaGc
TLSH
T125827C711DB4AC7BA9E6E551B44B3603CE7880ABD3C86F80D5DDA72D05DA2D81307D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4391c033c002720768216504bb8167ddf539577f6e2c49e61be064282834210f
MD5 e6fbb7524618111b51bd888a44e10eec
SHA1 5a0a930c9cf95a06aa7f74aa1392544e5b8f5386
SHA512 e28fba6ef08715295c8ebd2f5c46cea73b18c065833daa0f689db2ffcec555e089282e4ae71115840a1f880c4b57b0ef8042765ef5e671aa45e75a65e0a9423b
SSDEEP 384:+ZcICsNmSK1nydPp5u8i3xKslBkwc0aGoj:8CUHk3oslBkuaGc
TLSH
T1A6927C711CB4AC7BA9E6E551B44B3603DEB8806BD3C86F80D5DDA72E05DA6D81307E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d4163b35e3324d442504f78c1bedbc760d3ce1f3b75929f5cd924cc7f3aa5f3
MD5 d61ba1c379d17b28a4c68fcf19912025
SHA1 5dd06c73138811366d263fecd5818d387f6390df
SHA512 716b8be79a3a69670e63134e57092b9c43bc3e4daf08c7a1abb2c46f690584c14555f2a8828d6a972715a52d85e79c2a1304e084d78f42df4da30111749192a6
SSDEEP 192:SONGh6iDCQmiUyOvOlHq5u88P3ESqynsU6:SONa6/AHq5u8i30XU6
TLSH
T19C02FA396C787CABADE2AD15B5473B139FA4112FD6942F84DAE81A2C01E729C1303933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b2c8cabfb900e3af6d681f63172fac6be34c928944fae1cf819aab99838bddc
MD5 17e21207efe59c04da12944204a7dec8
SHA1 06bbb25da3e414e7409fdfd18094899a56b3a5f6
SHA512 2a6985e4b1b7d48d206e3a563234b1920981025897c8ad449d7ec3c6ec015e0ba0e50986c4510ee67d97a8b2746d703fd99a9cc48df822b7e3de6ed7faeedb57
SSDEEP 192:SONf6iD/QmiUyOyOlNq5u88P3xiHYuZZ/RxU6:SONf6YVNq5u8i3xK/lU6
TLSH
T1B4122A356878BC7B6DD2A961F48736139EA8412BD7897F80D5DC2B2C05EF69C130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 637ad5685b51042f2e63b14d63f9ff4e99046dabc5737edc727f77a5d9a2572c
MD5 349b9f8ab6e5c1bdc427b754b26eb321
SHA1 e973164a9428feef440634e91db4916d36fba492
SHA512 fcee3c73dd76b89f166193209af3ecea87db873bdd42745f17c60c8dfa0b51fb7b362f6ae40b4c1af7eb68edf034b7d1d698f0294fb19690968fef52b2cdff8e
SSDEEP 384:HiFiZcIYq8sNm8TUNTUlIlSK1nydPp5u8i3xKZlBkwc0aGoj:CFQwvwgEHk3oZlBkuaGc
TLSH
T1A0A26D725CB4AC7BBDE6DA51F54A3603CEB880A7C784AF90E6DD9A1D01DB1D81307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ba4363b-7796-452b-91b8-b9829f4310d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2ba4363b-7796-452b-91b8-b9829f4310d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dc82488451e511f6f91fd179f93a97024737aa026e9ec740cf43f7032571f255
MD5 4abeaae04c81f8f33330a8197eeed5a7
SHA1 f779a46ab47a1337dc0fd33764611d25b418fc2b
SHA512 6e5a5e3eddcc88d8ff41c862fc2f41a98dd5b63ee5a4bc9fd6e4af2bb433ffb1d7378536cdf2485afa4f1ba547c381601efe0c5274ca4840041dba3582fae0b4
TLSH
T173412759B6EA1108B3B77F569BF7A86D487ABC772F0AC55D50010D8E0A62B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download