64895bee135d68ed8cd96528f8e136c8c74f401053d58177e0a70c9c495dcf63

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_64895bee135d68ed8cd96528f8e136c8c74f401053d58177e0a70c9c495dcf63.html
Size 1.2MB
Sample260912-vj3cmscl3x
SHA256 64895bee135d68ed8cd96528f8e136c8c74f401053d58177e0a70c9c495dcf63
MD5 8980bd84c94c08926737b3f62b561407
SHA1 04a9ebb18b2088ac020d3a4343b0499a658d4276
SHA512 c3a418761e7ed63b8f4f46d43d46cde60d31223d31319b8d570f9751d551b120dd9ad67b6d0fdae9e7a778b4746ca558f86f736e57936414789fad60d37ed09b
SSDEEP 12288:yCeSXyMTNrjTEY0+kC6bhxs7jGbLozkmWX:yCRyyjT3kC6bhxsELyTWX
TLSH
T11745C7DB9230717FF833A8B596C8A949F3988CC1E5164AB5BC70A61347EBBE61351331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338249003736726"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{2447CACD-CD44-4B51-B3BA-67B4CA00A054}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4292	4164	msedge.exe	85
PID 4164 wrote to memory of 3768	4164	msedge.exe	87
PID 4164 wrote to memory of 1064	4164	msedge.exe	88
PID 4164 wrote to memory of 3768	4164	msedge.exe	87
PID 4164 wrote to memory of 3768	4164	msedge.exe	87
PID 4164 wrote to memory of 3744	4164	msedge.exe	89
PID 4164 wrote to memory of 3744	4164	msedge.exe	89
PID 4164 wrote to memory of 2116	4164	msedge.exe	91
PID 4164 wrote to memory of 4416	4164	msedge.exe	92
PID 4164 wrote to memory of 2116	4164	msedge.exe	91
PID 4164 wrote to memory of 2116	4164	msedge.exe	91
PID 4164 wrote to memory of 4416	4164	msedge.exe	92
PID 4164 wrote to memory of 4416	4164	msedge.exe	92
PID 4164 wrote to memory of 4980	4164	msedge.exe	93
PID 4164 wrote to memory of 4232	4164	msedge.exe	94
PID 4164 wrote to memory of 4980	4164	msedge.exe	93
PID 4164 wrote to memory of 4980	4164	msedge.exe	93
PID 4164 wrote to memory of 4232	4164	msedge.exe	94
PID 4164 wrote to memory of 4232	4164	msedge.exe	94
PID 4164 wrote to memory of 3760	4164	msedge.exe	95
PID 4164 wrote to memory of 3760	4164	msedge.exe	95
PID 4164 wrote to memory of 3760	4164	msedge.exe	95
PID 4164 wrote to memory of 1756	4164	msedge.exe	99
PID 4164 wrote to memory of 2936	4164	msedge.exe	100
PID 4164 wrote to memory of 1756	4164	msedge.exe	99
PID 4164 wrote to memory of 2936	4164	msedge.exe	100
PID 4164 wrote to memory of 1108	4164	msedge.exe	102
PID 4164 wrote to memory of 3200	4164	msedge.exe	109
PID 4164 wrote to memory of 4244	4164	msedge.exe	110
PID 4164 wrote to memory of 4724	4164	msedge.exe	111
PID 4164 wrote to memory of 4980	4164	msedge.exe	112
PID 4164 wrote to memory of 4980	4164	msedge.exe	112
PID 4164 wrote to memory of 5100	4164	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_64895bee135d68ed8cd96528f8e136c8c74f401053d58177e0a70c9c495dcf63.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb4560c188,0x7ffb4560c194,0x7ffb4560c1a0
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,6050712702306518629,6218570684166211681,262144 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,7734580995855654576,911698964401786474,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,16774711301103454290,13970357104837679892,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,8148941119512332875,7040187408085104309,2097152 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,498703787396864417,3049157808762845610,2097152 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,8924279687510870990,8643951317044881735,2097152 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,17799675318704834573,14560186924877471494,2097152 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3624,i,12824774958571887624,7994541526407327992,2097152 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,597513941665529501,5108900688024932901,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9022957086692749560,17826967349438918300,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9837927928314324082,16358429841686158694,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9837927928314324082,16358429841686158694,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,2957691508857113260,11272190955779261961,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,2981147669076893928,10966338677706614350,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,6238927159010757813,858938557159385884,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13995946621365133038,9875025364560421726,524288 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6348,i,13880374513014463442,7337807300143980825,262144 --field-trial-handle=2284,i,16915979380528159484,7570803306700463073,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 800169992ef4c53b1f08df1067af96068a3c9c977c2d662ef1d46fc810bbc4e0
MD5 f4604308007e0d3c8d59616d1a9c5006
SHA1 e22baaffcd99fc3e3a1f8eab897688bd21a96c4a
SHA512 f3e63fc8d8a37a6862af3a175d239a4d4d30347c052887be9721f48fc3b06bd008d30b2db23bc17d8c89f6c2da07478c9054084f301dd2c4ced3bbd3709d71f1
TLSH
T174510DC256916895F3A810F2D1EF138335BD85A25A877E431398C8FC48C7B1F819C25F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d184.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d184.TMP
Size 2KB
SHA256 b16bf745388044f7e7aa6e6c3d362d8a65726be8099a8a676378c03709f4093e
MD5 5d623fb13f83da17c2d01ce758be9f1b
SHA1 147c1892a4aea0a3e9bbe81987da86d9b6f03edf
SHA512 875c20cedcd84e2c1784a54b0ed123683acd88cf7a8b7c4bcabc22855c21c46780cca29a78c739336a673ffcef21b40deb96314a4b8df8b139e39a7ccf0b135f
TLSH
T10F511DC256916895F3A811F2D1EF138736BD85A25A877E831398C8FC48C7B1F819C25F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5bd45760ca6371601e4349e0e03b1c6d34f119815fe9508531e0cc4bebe95b44
MD5 bb754b9aea46290baf84b5b8a35c9d7b
SHA1 aa5c3fa8f629e11d8a0fa4956a75fc09d0a6f5c0
SHA512 647d94a64e344ecbcbf52ec05ebd1f39f82c4a99da97589ebbc4d2c254d068cdaa4721a20da3b7be15d920ac7ba2329ec22fe7fe6f78268e730754435b8aa0b4
TLSH
T15D318BF7C3D486BEC90116F05A24AE1BDD2D0A1A822C3C5A89E5EF1B97F2475D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6158ae31f9d5fead820d3b6cee8732c091b9539d6ac81688516d33d480f4eca4
MD5 e950e56b426ef0200f3d30ce735f4dfb
SHA1 6611c04546cba4cd1b0b8c217a1fbe9785514fc1
SHA512 0e37d34e099c6160d27b10f82236c3bd86641688cf4c5dbbb4f3d4c6c0889b9a59c73625a365bc9e512844776386b097a7b0c3b1cd158b53647e27ccfaf61c26
SSDEEP 192:sxZDR+W8/f8sGVIdpdeHW6+WNGYYBad+rIgrJ:sxZDb8/f8sGmYHbGfsU9
TLSH
T17B12A6516E28A57B8CCBE20DBB15BF53E6F9503251941E98AAFCCA1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9de43cfc984f3e880b9cfba4cebcc3641099d545f337c87d9f3ccc3775e5ba94
MD5 efa473ce6b3bd67ecb4ffce9bc2f1349
SHA1 5e157c9b97c9856e620fffc6e8ce8c07b0668476
SHA512 7fdf7bef7ecaa619242da679de6749af478a1d82288a052b2041632be1c573f36dd1e3c07a1230cf18be348d1217472ca4889768c6b3354e8264a5a66fc19df1
SSDEEP 192:sxZDR+W8/f8ssVIdpHeHW6+WNGYYBod+rIg5VJ:sxZDb8/f8ssm+HbGfaUp
TLSH
T1E222B8516E2C697B8CCBE20DBB15BF53E6F9503251941E88A6FCCA1C05E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 70de0dafc2f5e3288d0bb9b8fca54623eb3d941fda6db12f20a48ceb99b21d7b
MD5 3dacfaebe99d9ef2619de6bf20d1ca37
SHA1 87d38b335068b05903642fcdbf9e49a8224869cf
SHA512 313d8a38cf209c94bc14b2133706da4e5fe3fac4952e7f749e0c608c5f267c4634aff693d1907d1249d327538725aea400f3e77765cfe31b84edff50c1a816aa
SSDEEP 192:sxZDR+W8/f8ssVIdpdeHW6+WNGYYBGd+rIg5VJ:sxZDb8/f8ssmYHbGfYUp
TLSH
T1D822B7516E2C697B8CCBE20DBB15BF53E6F9503251941E98A6FCCA1C05E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8fb85ce9296099c11b22037ffa729c0495b4c141d8a6b2727799e7d92abe8634
MD5 9e81e262358d0ec718a8fdf7fafa33bf
SHA1 167cc453400bdedfa667180fcd8d10caa66c58ec
SHA512 cdcec30079b8b1205cbaee58ba4ba20d2a94f019773bb6787e01fcf58a2237dcbabea5a737736296670d4576e4060b9e0f4539eed1602617d6830ab9ec16830f
SSDEEP 192:sxZDR+W8/f8sUVIdpdeHW6+WNGYYBad+rIg5HJ:sxZDb8/f8sUmYHbGfsU3
TLSH
T12722B6116E28A57B8CCBE20DBB15BF53E6F9503251D41E98A6FCCA1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0cd8a659e7e93a658cc2a5cb3d7da66fde1e8b5ad1ee935a0f4203013459dac0
MD5 0793cdffffbe1e397b8a2735e4e30d3c
SHA1 598fbfc5a76ac2efe149442566e5b070b0e5e758
SHA512 7c7088cc1b3b38f3de110e8a2639c17713e5d573370f331318c583097a242763ec3b0873442d671b08365217344fd280a348e69a427a96af4d0a36d13cba9b79
SSDEEP 768:qnyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXxropjYHFAN1:qnyYR7jWv3NpBu1ja/CL8OXK4Fc1
TLSH
T1F6C2E93B640DCB7E4FC01A9DDC5AAFD72E9802C7A6548D4047FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ed3b31844b5440ebc2f638c6a2f6f0d4ff02f6973115f0901571a021e61a50c7
MD5 08e0dc8fa580a2ea5f061e1099551921
SHA1 1e59d8cd25cb341d7786c1ab2fc260b714b30b0c
SHA512 1531f6fad89366184c1000ff40f2269d9826e05f1a5c9278636915fd1c8677581c2754d07a2880f75d868304c092f06972242855379dca8ac273d8a26838d606
SSDEEP 48:KgFk51Hznob7+7ISNoK9t1foxt4Yuf1lyLuJkomscVbgnoISAVK9k12VxOFYfgcJ:KY+4K/K6ud2K2U6uTyK4ox
TLSH
T18D91C11375BB030039BE254890B4976B454231F37054EA2ABFBD08E58E6FE185EFE4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596e12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596e12.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5b0775846761a98a70d48b38a68cb054992f7242466680b3614d9bb25f325d56
MD5 d3e579288168d2688f64e900d5c87a89
SHA1 e64ebe90837b85d5706deb2049c468538b60558d
SHA512 346879289dd2534ea7cec69861189e24beb02d8021c652c2ca54384184664a61f882b2ac0eee254beb1eda48a2631b0db594853b9898daa197ecd92de5537b30
SSDEEP 384:VZcIysNLULciCjoyUckQX5+Dt68xXuNDuXsa+VYhvoM:tyw2gkDHWSXhgGP
TLSH
T120827E31ADA8AC7B49F79295B54732135FB8506392CC2B84C6EC6F2D01D96981307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 98b36e5ad069bf3d42b8da1f4be1de39f0ad63dd2849e95c11909bd135f947c7
MD5 bf1768a910a0c46009ed047701db7016
SHA1 34e89f3ceb663b0fc481c0d0467a3db75a8714cf
SHA512 ac825d2be27105d98589d63062777843d0023536a7e689da64af2c9c3a011389caae5dc2c7ae205cb2ea006755921f8dbdac01d1de02a5fe6912d89d4e541b23
SSDEEP 384:HZcIysNLUeciCjoyUckQX5+Dt68xXuNDuXsa+VYhvoM:vyl2gkDHWSXhgGP
TLSH
T1A9828E316DA8AC7B89F7E285B54732139EB8506392CC2B84C6EC6F2D01DA6981307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 bd943ebfb05942bf40b53c23d8bae2f9ff250f4406261d2457262c0bf9d54d3f
MD5 c111294acab9660e62d4517e87201dbf
SHA1 26380e997ded1dc4c43e9997ed9e62779d36e7f5
SHA512 5f71d2e82a0b8d3f437510c5df1b61e783a893ca518c406dc878b169a2496908d5e9738e32532fd9da64263d6f59e516d56d5c1188c7d8925485f499ea30d538
SSDEEP 384:QiFiZcI34sNg8TUNTUlIleciCjoyUckQX5+Dt68xXumDuXsa+VYhvoM:rFQIRwgf2gkDHNSXhgGP
TLSH
T173A26C329D98DC7B9DFB9B86F54A32139EF4506385C8AA90D7DC5F2D019A2DC030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8f27c9365f18b344d2a266ad8a3e5504611aab63ed6e709ac38dba6ccd5f3e36
MD5 287869a55f8b50bcdcf563d5d3739f28
SHA1 54fec51b25cd79bbd9ccb0382f6100ab599f6910
SHA512 27c2ffb8f4ab66e87f70690b3940def364b64c6a0030cc833ca28a7d0d104aabc35abd7cf15143c6e60ac7cd171585a60cbae9ad01a1a3041859818af263dbaa
SSDEEP 192:EONs6nnHGQmiUyq1qRQYcX5hQDP12jzor21mfMcDl0U6:EONs6nC7wRQNX5+Dt68DDuU6
TLSH
T1DA02DA34ACA87C7B9AF3AD49B4862713AF95313B95942BC4DAE81E1D00D765C2306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 781063ada1340f2b47103d449adc7d61b74f1b3e1eaa56fb275ec4f40f678cc9
MD5 65266846fd2d77a917011098a8979ab4
SHA1 a99add6b1f7185b2c407b7db153f85d750414cb7
SHA512 bf7d8ce7595bb237407e2185e2b565acd62d9525a0bb986dcc193d8fcac9f56b1ffeb2637d36045b442b846c791b6490d309d85278729b15c1ed5d8201f07efe
SSDEEP 384:bsNLUcciC4oyUckQX5+Dt68xXuNDuXsa+VYhz:bndgkDHWSXhg2
TLSH
T1AD624C31BDA8AC678DE79295B1473213AFB4616796CC2FC4D6EC1F1D01DA29C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30e0bb04f21db5720e30685605347632090a152e8e372a9074ffe31351bcd078
MD5 a39a22618164155de959885e570af9fb
SHA1 f84c2cc6151c15eaad11e664701f5879138169eb
SHA512 30ee608f7d280475852f2a9ad584dce361296b9f172d0ace5563d7686fed48a1b8ffda465ad71f152552412786cdf12f6fa1b11b177833b8ffd5e1a48a68461f
SSDEEP 192:EONh6nnHucQmiUyqQqRckYcX5hQDP12jzor21mxXugg3Ds/5XU6:EONh6nOs75RckNX5+Dt68xXubDuXU6
TLSH
T1D812FB31A9A8AC675EE3A595B0873213AFA52137D6487FC0D6EC1F2C01DF66C1309D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a797984e2cedcc82bcf654a496c3faf35bb63499979dbbac7db88d87ad51483d
MD5 3120d77a49dc98c67125c9fe091e5725
SHA1 64b766fb12b5c91cea3e8c4a5a638f80c37f10f6
SHA512 df2c0102ee62c7b1eb944e39a5a7c68a176b9aa7948b3d976f99b33ee834f453385c2eec37d9c3937adba038bf93220d20954414dd5a94ccb6629ce204c3d05f
TLSH
T1E9410959F6E91114B3B76E5AABFAA46D483B7D732E06D45E00110E4F0A63F40D861737
MD5 SHA1 SHA512 TLSH

Submit Download