538d76790d1c196782acd765cc3f365596fdf0667c25901c2694754dadeb4209

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_538d76790d1c196782acd765cc3f365596fdf0667c25901c2694754dadeb4209.html
Size 116KB
Sample260912-vfb2aatses
SHA256 538d76790d1c196782acd765cc3f365596fdf0667c25901c2694754dadeb4209
MD5 d9cc851208ceaebd797d1622c1dd90cb
SHA1 d05fc84bda75435793e21e4aefe52c1a91dd83f3
SHA512 4f89c5911f2b9656760058d08b9ee8d51e51658f69831d1f7a84ab4be01936dc572b7d319d7f16200dbce97492ff22a3e821975aab1df289482e04ca5dce0bba
SSDEEP 1536:pPxyYn+hNv+PRDGMAvdIUelCQ6TtsNowxz6fqbEaoXbEaoU6xVFPVCCwR+3O9:B0DQtN9iqdoXdoU6hPVCCPO9
TLSH
T199C3C68752204CF5EFB41DB3459B086B3D2C1437AC4391B9E3FD8F962F9296E034A669
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2276	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338249788251298"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{6D147115-81FB-4805-A71A-2378F67D7F62}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3824	3900	msedge.exe	88
PID 3900 wrote to memory of 2276	3900	msedge.exe	89
PID 3900 wrote to memory of 5028	3900	msedge.exe	90
PID 3900 wrote to memory of 5028	3900	msedge.exe	90
PID 3900 wrote to memory of 5028	3900	msedge.exe	90
PID 3900 wrote to memory of 4420	3900	msedge.exe	91
PID 3900 wrote to memory of 4420	3900	msedge.exe	91
PID 3900 wrote to memory of 116	3900	msedge.exe	92
PID 3900 wrote to memory of 116	3900	msedge.exe	92
PID 3900 wrote to memory of 116	3900	msedge.exe	92
PID 3900 wrote to memory of 2684	3900	msedge.exe	93
PID 3900 wrote to memory of 2684	3900	msedge.exe	93
PID 3900 wrote to memory of 2684	3900	msedge.exe	93
PID 3900 wrote to memory of 4976	3900	msedge.exe	95
PID 3900 wrote to memory of 4880	3900	msedge.exe	96
PID 3900 wrote to memory of 4976	3900	msedge.exe	95
PID 3900 wrote to memory of 4976	3900	msedge.exe	95
PID 3900 wrote to memory of 4880	3900	msedge.exe	96
PID 3900 wrote to memory of 4880	3900	msedge.exe	96
PID 3900 wrote to memory of 3280	3900	msedge.exe	98
PID 3900 wrote to memory of 1372	3900	msedge.exe	99
PID 3900 wrote to memory of 3280	3900	msedge.exe	98
PID 3900 wrote to memory of 1372	3900	msedge.exe	99
PID 3900 wrote to memory of 3132	3900	msedge.exe	101
PID 3900 wrote to memory of 2380	3900	msedge.exe	107
PID 3900 wrote to memory of 3600	3900	msedge.exe	108
PID 3900 wrote to memory of 3160	3900	msedge.exe	109
PID 3900 wrote to memory of 1212	3900	msedge.exe	110
PID 3900 wrote to memory of 1212	3900	msedge.exe	110
PID 3900 wrote to memory of 4740	3900	msedge.exe	111
PID 3900 wrote to memory of 4740	3900	msedge.exe	111
PID 3900 wrote to memory of 5092	3900	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_538d76790d1c196782acd765cc3f365596fdf0667c25901c2694754dadeb4209.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffca906c188,0x7ffca906c194,0x7ffca906c1a0
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,6719485398421445305,11934003361704074584,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,7964649194223782063,2496368238843076810,262144 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,8990005126804709901,2995705521292633135,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7610399278019172658,3755172379748288187,2097152 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,3402114390227557302,1951028658902218246,2097152 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,9460462309351413547,1305477820474215804,2097152 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8370417405905042936,6401290321116752905,2097152 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,14629912120262910339,4582553411447475956,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2948,i,8137329912525014443,13759019974893172531,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,17681858954410878136,565025787456494188,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,17681858954410878136,565025787456494188,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15357894170295882753,2505903034525258651,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,11349844201145108593,4960828243727836983,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,2630336359934414785,12800868541456311504,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,16786341803355924535,10186408879206911807,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,11089061995993343010,8569355513522975269,524288 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,14061103817870248065,6750837361691435897,262144 --field-trial-handle=2268,i,293200372893641485,2643668780961558207,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6d8d2468f6b94c8d3c7499bd25a8025562a3723b888e56d74b0b8b5b87221986
MD5 e2c7141a9266a72d33d6c25d983c9e77
SHA1 8a27622e5cac04bcd7d782e6218d5bf6170fecd1
SHA512 3e1b2f1090a0aaa5f8375ff23f72327f132b9a3b4eddef97924b121932cd7984920dd58571bc8deeedab2510339a3c46373e9e71cb918afd104198b582a0d66e
TLSH
T16451C5C10D7301A0E78B42704CD3D9837634A87249832E1B1EE7C4BB5B4E76A4DFA344
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c75da7a21eed82fb46b492da2473cf0f5d5b364738516f6da46369d4225d96be
MD5 c49cebb42cf2858b0e0be26a179a7dd5
SHA1 999b79b27c7fbbc7312dfcc562dd642c7d723095
SHA512 ca011a4df6deca10e1607eae3e982f64f2458fe3ca183565afa90daaf4321c2318e79e5031a6c913c9063f1fb73287a10a572fd463c3bca8af5336eb269afb93
TLSH
T188418BB7C3D4867E890156F09B246E1BDE1D0A46426C3C16C9E5AF1F63F24B4D20199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a625578881554ccc807f4c0d297c47f73d331cb9ec840994eecd45a0b6b357d0
MD5 67c6313e0ab9e60f6ad146b7bd5b24cc
SHA1 a13fb9fcfcb08713168ac5019d2a5b38080b4674
SHA512 875c92047fc8e279f5c5cdb2b4fec4434e6feb2e06ff1b92437d96047f0cdd486bf82581ee730f40c1259b3807dff4e072d2b1e0ef53891c7e62e632af90b5ab
SSDEEP 192:sxZDRIWg/fFsQyDIdpd9HW6+WNGY36at8IgrJ:sxZDhg/fFsDcfHbGXl9
TLSH
T1F512A7526E28A57B4CCBD20DBA25BF13E6FD503261D51E58EAFC8A1C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 aeaab0de5e771b177f9a9684a9febcae0c3c22464bfeb7f45575289c6c1e553e
MD5 c90fbf155abc01618ac3fc65aed6ee1c
SHA1 aefffbb83a884ad1f86387f8da3fbb6ddfff1ff8
SHA512 bd9efad2aba0503fee06cafc1a34f2a757ce3d68eea43ffb371097c0b3a198d56564f7ddd13780104ba7233404962b33e8966c3eb8495c52186d296d481a2e3b
SSDEEP 192:sxZDRIWg/fFs0cyDIdpd9HW6+WNGY36it8Ig5cJ:sxZDhg/fFs0fcfHbGXta
TLSH
T18822B9526E28697B4CCBD20DBA15BF53E6FD503261D11E58A6FCCA1C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c19c426078aac7e4b2dc96c95458fe50935e9876d8a2bfe555d82e9ca59b7c8d
MD5 7e118fd67a20dbe85a16a65f9508977f
SHA1 8746ed6980f3a006ef0d9ebd372781ea63c2c444
SHA512 66540685431ac78975a4118857b81d08cb836ac7ddfeabb9e7a92c8bdd8846f24e4c59e0fed82fc4913a33ed095f3fa2b5fec40d46e672349085a5dca6060d87
SSDEEP 192:sxZDRIWg/fFs09yDIdpd9HW6+WNGY36at8Ig52J:sxZDhg/fFs0EcfHbGXlA
TLSH
T18122A7526E38A57B4CCBD20EBA25BF53D6FD503261D11E58AAFC8A2C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f1eb5a0d948d4660da7334d5167d8334424a4cf94d46a549a23cec25843c2a34
MD5 ff1fa01d3e784033f816584a641b8f19
SHA1 e9438dbffcd70b3b188859b9a0666e27ef3c4074
SHA512 fd944b6905d33b70c4eaa9ac140f485dbbc95d4e5edca300e761080dacd636227b713090a9c7b4e00edf15a77b6bc6580aae82edc76926f3d22fa8395235d253
SSDEEP 192:sxZDRIWg/fFs0cyDIdpH9HW6+WNGY36qt8Ig5cJ:sxZDhg/fFs0fcdHbGXVa
TLSH
T19222B9526D28697B8CCBE20DBA25BF53E6FD503261D11E58A6FCCA1C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 166e8b6c255488bac1ec9a584713c7d0ab5d62763b3277410cedfde85d846ed3
MD5 4481a5eca13e12d6c222b28c06ac03c8
SHA1 1a00c35665ca09ab175a7019111f623b73a84862
SHA512 d94c07faeff15682ac2cf868ac3fd8d3495235ad7594ec5b142a3f77982cebbc8548f1869dece77574dbd8af11fc84f937a32fd487b8e7ea4e458e8acfe5b472
SSDEEP 768:XPKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/prose:XPKlm7QWvUYe0u1ja8/L/E/Cse
TLSH
T194C2FA3B640CCB7E4FC05E9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4480f011faae90870f034c2e6bc1d776f6936e89f7273b54d2ab7bb4e4ba639e
MD5 831c30bb134a7c3d30a74482f138dc80
SHA1 fa55343a99a1be2cc7b0a8152eb7021a883db504
SHA512 0615946b0ee262e7d83649526ab892f9784294e5f6474fda0b85fc3d91c6fb9220bf2f0686e4be3ef3dace8a5b953394b38731555d4c5846b638210b3a7f7cde
SSDEEP 48:K0q1YEqo4pb0TkIS8pK9g1apxS5YrMYayL2xMwuUUNb4PgISINK9s1uNxmdYHYg2:KIRyKqoy+h2KyQFZiKa4C7
TLSH
T10591ED1131BB1211387D3A4881AA9B1B56427173341DE62B7FFE10B2DE6AE084EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d42774378633857d84e6741f4a23a2899ec185d0bf5a826973edb7f02cb00f84
MD5 aa798ecae8933d75fa05a842f561a610
SHA1 405c79e976b439d96861294c33c9a7c6b9fe87c5
SHA512 5e0a2d77b27ef1fb5b52a41fc6fec36702816bc374955eff4a42cbc750966bf1c5c53f339ba60bdaf6e1fff49cd9a9a4dbd70c62e207cc984c79127006707f3f
SSDEEP 384:IZcIFsNQ6PbIFGh//TylJ7O6R2Feo5h7U0oJ:2FdW/baJ7TRIpW
TLSH
T13A827D726CB8AC7759A7D185F44736138FB8806397C51E90D6DDAF2E04DB2A8130BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ab05c83953e429c2c093e2d46b4eaca90fb282bf166c8b051aecdb1abe869a18
MD5 899f89e2750d9b3786b59a9bab1ed7f1
SHA1 34b416914715bc121db92b38d7cc0dcc6a3a070a
SHA512 152abb7267d50e99ac8f6aa6528a45416243259089d682122aeac11a260b9e5fea80329ecb11450c9aa92234f9b827bf1ff622b76fffe64c0c752af3e9808b7e
SSDEEP 96:KqONk1QsjpfbUmjH5ih/cIPURHl8h4otop5xaDBBKP4v+Y1xf//ojdoxyqsoeQBJ:BONl6JUm0QmiUyq3so//TeQBCOVU6
TLSH
T18A02E839BC786CBB9EF3AE45B08737239FA4106BA6912F84D6D85E1D01C725C2303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1c903e496684305ab092de6f719d8e4cb466028a0f908d8d7c9cefcbbbdc01c0
MD5 637a81fce49169839ef3d4c777ed25e8
SHA1 9093cff0782ff6ebb6e4a766829a81788497113d
SHA512 00aa8b625d4fff78cd1ef9c7b96afb609c40a0f7f0d3dd1a37c9054ecdbe0c19d476f378f76f8d3c94e0f442758052f866abbd72dcabaaa6b458c41bb811dc53
SSDEEP 384:VFiZcId3sNQ8TUNTUlIl3PbIFGh//TynJ7O6R2Feo5h7U0oJ:VFQRJwgmW/bwJ7TRIpW
TLSH
T153A26C725CA4987BAEFBDA85F54A3613CEB440A3C6C5AE90E2DD9E1D00D7198030BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c1309f8e4e977884b5753cf51279718f5c55a94187f26ee444b4bcc85466b12
MD5 643e47a2af66bca812dd51a8d5aeb016
SHA1 c4351a6bba442c488b5ab8b3d4f5583bee2fa080
SHA512 2d6327d191c8e7270aa1307f19be3e8bded971314a65b1eeaf679d04f8e5cebf685aced1752a2056211383bf7f5d8d22252eec9c0a26bd1320fa008265c92250
SSDEEP 96:KqONkBQsjpfbUAuH5ih/cIPURHl8h4otop5xeDBBAP4v+Y1xf//ojdoxyqsoe8xe:BONx6JUAlQmiUyW3So//TetnNxf/5U6
TLSH
T102121B35B878AC7B5EE3A944F08736138E644127EBC56F94D6DC2E2D05DB25C6307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 168bc5b497ea3f5b132cd3eeaab778bda3e7d888681309fde345a5abd1a94d70
MD5 dc85f306cc09232549f2ef7a9d50c38b
SHA1 5b4a58b0ae87fe9ae142266c521bf407fe5030e7
SHA512 abc3a9b7040f69fee65aeefe293eb15f4216efdf3e34d8bd45a15e90c0fb63c2d04691689d8f41a7b5bd44caac5b6f251b241160c4d549fbb040dc2f7e72644a
SSDEEP 384:3ZcIFsNQ3PbIFGh//TylJ7O6R2Feo5h7U0oJ:/F4W/baJ7TRIpW
TLSH
T142827D726CB8AC7759E7E185F44736138FB8806397C51E90D6ED9F2E04DB2A8130BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 1631ebe73a9d7dfbcdbfe437bc8abc06beb5091d3ce0ca732f781dbfca0b979e
MD5 4e0197ddadff910e0a76adbb0d63cb91
SHA1 5a5d7a35a842ad6b7146bcd65b3df93d8baa43df
SHA512 5aafa222d149ba3eb71a112d06351b0621c36c334c64b1743d57952fbe9f51ee039caa49019e25aa90538beaaf1bdd0fd16cc5cff8032b1fa43d545e9dcbb1b0
SSDEEP 192:uWPsNQCQZUbfaRQmiU1jvZ4h//TetZaof/5emO6R2IMMXor5h7Uc:zsNQCPbaFGh//TylJ7O6R2Feo5h7Uc
TLSH
T10862493278B8AC775EA7D585B00B36138EB480A79BC51F94D6DD9F1D05CB2AC130BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aceed52f-4c83-4f0d-81c3-0a68e2c18086.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aceed52f-4c83-4f0d-81c3-0a68e2c18086.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 35d0cece3ed73448ff35c52379fd5b9d96fe9a94e8204562723f9fd91f1bf14a
MD5 b5de33fcfb68a8cd8631403498407b84
SHA1 d84c4dfc21407acff22876c34f7034ed5bb0d26a
SHA512 6d6f40fc20b2ebf4847eb3bc8f58ac0284db49474789652bf938acfa18ae9c4f98db3ab67ff1074f880051b0093f8369fad2b1b1c2186e6d54a9132b2e94f37d
TLSH
T185412A58A6E91158B3B37E1BABF7A86D58BF79772E06C45E00010E4F0936B40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download