17afe05311f7f7a276955f93a08a537e866cd96849cd16be7a53481067659875

Analysis

max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_17afe05311f7f7a276955f93a08a537e866cd96849cd16be7a53481067659875.html
Size 111KB
Sample260912-vls7rattcs
SHA256 17afe05311f7f7a276955f93a08a537e866cd96849cd16be7a53481067659875
MD5 acf6a5cc890e54528ebbabda5ed2060b
SHA1 94af2f2302cd6e18db6918c38e67eac622e11b54
SHA512 5e2758c10d127ac6a04aa791f5fc1ab8bc49df85af10eab88c6ac5518f6a52772ef60f192e810f6acf59c6c4de4d0d3519856b098bc2d47dfcef262089f66393
SSDEEP 1536:imxsYn+hTBhGRDqyh9w+ualsQjTtDNoAxNSTTbEaojbEaoKsvsFzc3:725QtN7WTdojdoKsvsFzc3
TLSH
T130B3C68711205CFAEFA45DB3459B086B3C2C1437AC4391B9E3FD8F972B52D6E034A669
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2372	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338250245135894"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{EBF5F6E0-4FDC-4EF0-A8A8-DEFF1D8E0634}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
416	msedge.exe
416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1520	1232	msedge.exe	84
PID 1232 wrote to memory of 2372	1232	msedge.exe	85
PID 1232 wrote to memory of 4880	1232	msedge.exe	86
PID 1232 wrote to memory of 4880	1232	msedge.exe	86
PID 1232 wrote to memory of 4880	1232	msedge.exe	86
PID 1232 wrote to memory of 4520	1232	msedge.exe	87
PID 1232 wrote to memory of 4520	1232	msedge.exe	87
PID 1232 wrote to memory of 4780	1232	msedge.exe	89
PID 1232 wrote to memory of 688	1232	msedge.exe	90
PID 1232 wrote to memory of 4780	1232	msedge.exe	89
PID 1232 wrote to memory of 4780	1232	msedge.exe	89
PID 1232 wrote to memory of 688	1232	msedge.exe	90
PID 1232 wrote to memory of 688	1232	msedge.exe	90
PID 1232 wrote to memory of 800	1232	msedge.exe	91
PID 1232 wrote to memory of 800	1232	msedge.exe	91
PID 1232 wrote to memory of 800	1232	msedge.exe	91
PID 1232 wrote to memory of 4448	1232	msedge.exe	92
PID 1232 wrote to memory of 4448	1232	msedge.exe	92
PID 1232 wrote to memory of 4448	1232	msedge.exe	92
PID 1232 wrote to memory of 2952	1232	msedge.exe	97
PID 1232 wrote to memory of 2952	1232	msedge.exe	97
PID 1232 wrote to memory of 4680	1232	msedge.exe	96
PID 1232 wrote to memory of 4680	1232	msedge.exe	96
PID 1232 wrote to memory of 664	1232	msedge.exe	99
PID 1232 wrote to memory of 1256	1232	msedge.exe	104
PID 1232 wrote to memory of 4816	1232	msedge.exe	105
PID 1232 wrote to memory of 3708	1232	msedge.exe	106
PID 1232 wrote to memory of 1804	1232	msedge.exe	107
PID 1232 wrote to memory of 1804	1232	msedge.exe	107
PID 1232 wrote to memory of 5072	1232	msedge.exe	108
PID 1232 wrote to memory of 5072	1232	msedge.exe	108
PID 1232 wrote to memory of 416	1232	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_17afe05311f7f7a276955f93a08a537e866cd96849cd16be7a53481067659875.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa3288c188,0x7ffa3288c194,0x7ffa3288c1a0
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,6433090417723397104,13965919821858584566,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,7891771107827526633,15757317468839667682,262144 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,1685386610086820665,11660371201876931560,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,631442765586730470,3738633143779212498,2097152 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,10542899987532772193,2218202614053389760,2097152 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,10059916680731706214,17921833216523735633,2097152 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,10727278074682826588,818748583326202910,2097152 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,17780083976646907624,4814259858162336271,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,15525206324705297002,16192221040590562444,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,3238324758828039639,13189604663508916094,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,3238324758828039639,13189604663508916094,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8223160595840292497,16081291372817431835,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,856164060353211867,1235706793766906768,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,9797857829227006886,1901714705225964253,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,10329833721112800116,14823876318495849846,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,17037652535051338741,12092293308611891464,524288 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,8302017873702684245,9536851565326266100,262144 --field-trial-handle=2284,i,15198420778145081106,16969585515521417019,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

84848f73-e8c3-4de8-9787-2247cbeb42dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84848f73-e8c3-4de8-9787-2247cbeb42dc.tmp
Size 10KB
SHA256 b47abc33345a70c91f8b86bca1d7efff81cd2068b0389cf0583528cfd933c4b8
MD5 be8a7b19e6816f213a049b92bc5a9db4
SHA1 db5efe8abca3ca598fda64b95dca072c08009aeb
SHA512 8d3d44182c18e1379f192a581af1271e9f015e472971686d8ee41a5c728cd57b7a1627634c80d075983ee89be31745bd8801c66f7be6d382feb2e23840384fad
SSDEEP 192:sxZaREWT/f5sguXAIdpdxHW6+WNGYrzqeIg5nJ:sxZahT/f5sguXBjHbGgT
TLSH
T1E622B9526E38A97B8CCBE20DBB15BF53E6F9503251951E54B6FC8A1C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37bc836d7163e51304592de8ba8740465abda72ba761b5a8e65ca483c4a01aca
MD5 065adafc7ea924c19bb05c27306c5d1b
SHA1 b6b045f56fea3f9efe86b93bb03ee634080964af
SHA512 398c0110c681f4a7975df43601e2f81279b43c89998bb52942f9da982197315b3b9d80d26e69930cfe753bac1badc027887a726e187e72bce0d15262f62cdf19
TLSH
T12361A64412F08159F7987072D7D803B7BB307CB23AB79E31A2A8F67898663797128083
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590f67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590f67.TMP
Size 3KB
SHA256 4ede2c1ab97db2eae64437c53dd772c1d7fa19a2ec62f32f7fc26dc3a9660738
MD5 fe513226924c216adea8a06670cec030
SHA1 b672896b2431a7d67a2caf8173c0462850c22b73
SHA512 661d3105480e2b75fb923b273032af4d60fb6dfca6a4c74fa53cb3ee3d974457f02c747b1cf9f2cea40b539d2e9a0d1efcd6a38dc19748249c9642c60ebbf9e8
TLSH
T10B61964557F08159F7987072D7D803B7BB307DB23AB79E32A1A8F67898663797128083
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6a9de75c0a2260ed873f27f6d845ae9aa5e9068f39f50b0c3c797fd8a37a4787
MD5 04507dea0955a8fe5406e6e7a6d16e65
SHA1 c36823074739adbedbc55c3dd9632cebe0f0200f
SHA512 0dc896b1e2c9a4b094237370e3974ec7e4aae5d6dafdf05a185c96aa3286823c8220d791539f4884a259e5cbf56f51d6a2f346876b68887a4548301be815e6c2
TLSH
T1CE416DF7C3D4867E890156F05B296E1BDE2D0A56422C3C1689E5AF1F63E24B4E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 792f9f81391e0ed0228c6a55cdbc1038c3f8d4c49e00720c197937b213553834
MD5 a5dde8eeefd6123e59078b256572f808
SHA1 8a3f01bb4a55370d8085b38bcf1e0eb87f369906
SHA512 bd8e4bf8b60ac98b5edd005237732bbf6e0ce174e76509907fbc724f0cf307f174115a61747da145ef991584b471c0b3fc62e3d78416a3ef7b868ec6abfb3e44
SSDEEP 192:sxZaREWT/f5sxZXAIdpdxHW6+WNGYrbqeIgrJ:sxZahT/f5sxZXBjHbGy9
TLSH
T1B812A7526E38A97B8CCBD21DBA15BF53D6F9503291941E58FAFC8A1C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 322359cbcfcd039389e868ae2fc612a83d19350567ff4ba30294588d51c2a9c6
MD5 0a3112145eceb46fa5e9a4163746e258
SHA1 bdc742c231e247cdb546f7c84418b3388c469377
SHA512 ae2ba9411a8dccbdd7f920d9f459a951c00a38b1e6ae63ffe3691cdeac3622470746d041eade85144cd481ce8a5fe87b76df0f40636c7e15e271eb182a903eb7
SSDEEP 192:sxZaREWT/f5sguXAIdpHxHW6+WNGYrVlqeIg5nJ:sxZahT/f5sguXBRHbGO/T
TLSH
T1D622B8526E38A97B8CCBE21DBB15BF53E6F9503251941E54BAFC8A1C05E7ACD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d77fffeef323a9c69e0675e1a14a3a83ae15c622aaefc8049535c3428ac5570c
MD5 8369b0a99c8634aad5a7212cf00d9247
SHA1 285dc10c8ea374a3730be119b141519b0b87e28c
SHA512 8053e5020b148a0c3a276f3d26a5d34dba94b6d49eee7947334edd2ae7a29665d96c79a83e13e3ed1ca5c1b86867f2b3ae771b10614d50047072b75ae13bb32e
SSDEEP 192:sxZaREWT/f5sgZXAIdpdxHW6+WNGYrbqeIg5NJ:sxZahT/f5sgZXBjHbGyd
TLSH
T14122B8526E38A97B8CCBD21DBB15BF53D6F9503291941E58BAFC8A1C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0c08079a47b22422e38869ed8063b81c5537032395e448a935e41ec2907251cc
MD5 6bd9c601e8b480599c9f940f4d2847ba
SHA1 c233d8b05dd7a3a0eb05e4e0921e72a5cbc68b20
SHA512 9ab636a5e9f2ef821b69421ad6d0590341b6548a22ed29b7dffb02df21b1b2ee5c07b4c4e77bf7af7964a5d28af3e8469ae2da854465a7316cc8a931740f0e68
SSDEEP 768:j0y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbMroRDU:j0y4J/DWvbtBhu1jajiLm0bXxU
TLSH
T13CC2FB3B684CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 35339f17ff52c21b72a1ab087d93069917adf79fe51e209b8d65b85331768ef9
MD5 2f803906c08db821cfc87272cc0a3528
SHA1 ae4dd708c208833a9d531954a7c6ac6b381f65d6
SHA512 89670e82aa9a8fd02b2f8dca23a7979d062b935c2aab2ae74fcaae91c2f276d7d2e277f985ea4876f564b9d1c49d2cde88b5e66c39f6449ea15b17b5df3465e7
SSDEEP 96:KIDCKs0+eLGKYk6WViK2MY23aGg8AokE5d:E5RFBr23aGg8AtE5d
TLSH
T1B3A13D9831BF124138BD294880B1DB1F524236B7751CE66AFFBC10A19E6BE085DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59aabd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59aabd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 8c1bd2fa39e92318988464a74ac18827b7762688cdf1e87887e7a2e9714e0d64
MD5 78a1930d80f7bcc08ca359b4f9e532f4
SHA1 9b32899d78657e5ad2747ce98ba05bda869a1a60
SHA512 a46d4df97d0f132df3aaa78dac564b5928da08d24dee1309375345b6df0b800251e61104ad6769c548fe10b8d489bed93cfcdd64e1b5f69aa1be60716e61eab5
SSDEEP 384:LsNjWNZZs9cHX58ED8pXR+2/jq7O6R2Feo8h7U0:Lz09Ca5Rlbq7TR7d
TLSH
T1BC623A32A878AC275DE7E145F40A36139FF950AB87892F94D6ED5F2D00CE69C531B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 cae39978e34bc15d03466a997d8dc093a6f755ae96c1d6eb55bac0f3bbb5c348
MD5 3b592d521cb23b4bafa3c6f94fa842c8
SHA1 f00eb10ea23a348a778086c21342a78468e6b84e
SHA512 0d325fe51851cfd870207b5790bf950df81b76a3d98531851b921a620c09b8bbcf0cb9ee7625ac2a8dd9cc14c50791e34612ee7ab4b0fbe356d320db427b584f
SSDEEP 384:LsNjWNZps9cHX58ED8pXR+2/jq7O6R2Feo8h7U0:LzA9Ca5Rlbq7TR7d
TLSH
T1DC623A32A8B8AC275DA7E145F40A32139FF950AB87892F94D6ED5F2D00CE69C531BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5be511d37cdd5107fbe49439c5fc7aab5231f487c390d472d425a3737d6c5ba3
MD5 4077dc6ef69dc8a4e8be0df48c05ce22
SHA1 387ac643b62b9f0644eff8f347913c05915c0a9c
SHA512 feca4b71472872a281baeba48b597b06608cb271958a24a22a48bc7ef4d879ed061d793127f33cebd4c0c9d544ff368ca500f071e4cf229b4c7e38ee42c85e97
SSDEEP 192:1ONV6wlDgQmiUyAAW4X58gZTjzor22DlJDU6:1ONV6kgoW4X58ED8xtU6
TLSH
T10302D934A9787C6B8EF3AD09F48A26139FE5112BE6556F40CAEC1A2D00DB65C2347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ae1be39cf0e4701bf3ffc96bc25e72e833cbe7584ee01d1cb13d035144ab8fbf
MD5 be6ebee65ea83c6544f2c1e3bc787d6a
SHA1 1640e8b47d97aee1a5c4cf53de34f4c970a35678
SHA512 bd93df4ed5b6b20b05fd50d3f14199e0f2db1150a66c53004147dca1de9adfd70b80c9c661667f81b9b5d58ca7dd25f5f73f0e999c71597b77126d643e9e3142
SSDEEP 384:RZcI+sNjlNZZs9cHX58ED8pXR+2/jq7O6R2Feo8h7UooR:5+Y09Ca5Rlbq7TR7ha
TLSH
T1CC828D72ACB8AC3658F7E145F44A36138FF9506797C95F80D6EC9F2E008A6A8131BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 a56592b36f739c81f09d806231df9f666b950a8d86ce529ccf72b94186b68d5f
MD5 c4ed2208e681833ca57204ce09079a0d
SHA1 2a3fbc01590708610186195e6e5a216a90082167
SHA512 489db14dcd996d5a793ab7285a72efef8ba0731d9b887550a3156bbd2280d47d7c04efd6d9f294af43dc68b5fe26161b6f4a5586944e712045fc7959defa36c9
SSDEEP 384:LiFiZcIZ4sN98TUNTUlIllNZZs9cHX58ED8pXR+2/jq7O6R2Feo8h7UooR:mFQmgwgZ09Ca5Rlbq7TR7ha
TLSH
T195A25C729CA8DD3BADF6D645F9593213CFF950A7C689AB50E2DC9F1D009A59C0307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 01970176630327fe746a10d2e70b5d3429d336755e7f4864706237ce3dffa110
MD5 162745dfa0486108460d14a9c04727d9
SHA1 29c06132ec59b0f79511770629d142477dc679a5
SHA512 0b0ffdcd02e6fd817ba5535d887edfa50928df83c676eccca2f541f577c3c87e48af40a86b47d2972505cdb3e3ce5ea8588ff625e921b1b785a435b21fb09197
SSDEEP 192:1ONG6wlDTQmiUySAM4X58gZTjzor2cX77R+2rzIvef/6U6:1ONG6kF0M4X58ED8pXR+2/TqU6
TLSH
T153121935E868BC2B5DE2A445F08B31139FA9512BDB896F90D6EC1E2C01DF66C534B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f092e50-4a0b-4c77-8578-fa745c9eba80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4f092e50-4a0b-4c77-8578-fa745c9eba80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 356d47feaed71e925bca180b384c753904ffcb0470363fc8072158963975d025
MD5 9c8490ce067e392cc5e8cc40bf5d02e6
SHA1 7431a8ce7bac447c0b4f6968c59bd848472da32f
SHA512 b74894757b687b152cdb106296f649e5a8b056de2f83e31b6bb69bcdb9c21ec5fb9995e669c359c0358976f53686a8be038850eb2304322349608727914e6e7b
TLSH
T1E041D6ACBAE91148B3B76E5A6FF2B96E447FBD371E06D06D00410D4F0A62A00D971737
MD5 SHA1 SHA512 TLSH

Submit Download