c52de382a80ba4ef5b3966f3fc6015d2ecd01743830f4333555ce6033c4dd673

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c52de382a80ba4ef5b3966f3fc6015d2ecd01743830f4333555ce6033c4dd673.html
Size 114KB
Sample260912-vv5bdatvft
SHA256 c52de382a80ba4ef5b3966f3fc6015d2ecd01743830f4333555ce6033c4dd673
MD5 4ed0cd6c9913c75392f356e2f20a84c6
SHA1 e93d27f01c998739a53f06f4a2789c6571d98111
SHA512 c09b33941c36a16146a1b67d645c28685b65260c19e4cdc35dd15546f180372294fd96655b48c46cd4d369a317a685c74d7e44f3c33b829e4f69a5c2855a2776
SSDEEP 1536:VmxHYn+hTnRgRImQc33XTRyzlhQYTtCNoCxqPohbEaoCbEao7APJ:Ur7QDNOQhdoCdokB
TLSH
T1F6B3C6D752204CF9EFA40DB3459B186B3C2C1437AC4791B9E3FD8F972B5686E034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338252195914928"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{BEA6E2F2-8654-44E9-BA08-71AD60F2EE57}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3936	4772	msedge.exe	84
PID 4772 wrote to memory of 4696	4772	msedge.exe	85
PID 4772 wrote to memory of 4604	4772	msedge.exe	86
PID 4772 wrote to memory of 4604	4772	msedge.exe	86
PID 4772 wrote to memory of 4604	4772	msedge.exe	86
PID 4772 wrote to memory of 4804	4772	msedge.exe	87
PID 4772 wrote to memory of 4804	4772	msedge.exe	87
PID 4772 wrote to memory of 4560	4772	msedge.exe	88
PID 4772 wrote to memory of 3744	4772	msedge.exe	89
PID 4772 wrote to memory of 4560	4772	msedge.exe	88
PID 4772 wrote to memory of 4560	4772	msedge.exe	88
PID 4772 wrote to memory of 3744	4772	msedge.exe	89
PID 4772 wrote to memory of 3744	4772	msedge.exe	89
PID 4772 wrote to memory of 3148	4772	msedge.exe	91
PID 4772 wrote to memory of 3148	4772	msedge.exe	91
PID 4772 wrote to memory of 4392	4772	msedge.exe	92
PID 4772 wrote to memory of 3148	4772	msedge.exe	91
PID 4772 wrote to memory of 4392	4772	msedge.exe	92
PID 4772 wrote to memory of 4392	4772	msedge.exe	92
PID 4772 wrote to memory of 4828	4772	msedge.exe	97
PID 4772 wrote to memory of 5072	4772	msedge.exe	98
PID 4772 wrote to memory of 4828	4772	msedge.exe	97
PID 4772 wrote to memory of 5072	4772	msedge.exe	98
PID 4772 wrote to memory of 4600	4772	msedge.exe	100
PID 4772 wrote to memory of 2528	4772	msedge.exe	105
PID 4772 wrote to memory of 4416	4772	msedge.exe	106
PID 4772 wrote to memory of 4228	4772	msedge.exe	107
PID 4772 wrote to memory of 3684	4772	msedge.exe	108
PID 4772 wrote to memory of 3684	4772	msedge.exe	108
PID 4772 wrote to memory of 652	4772	msedge.exe	109
PID 4772 wrote to memory of 652	4772	msedge.exe	109
PID 4772 wrote to memory of 4644	4772	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c52de382a80ba4ef5b3966f3fc6015d2ecd01743830f4333555ce6033c4dd673.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7fff16cec188,0x7fff16cec194,0x7fff16cec1a0
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,564511316995031868,2258304779631137791,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,971607417234329178,411178486932241524,262144 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,16315121648005093398,10386336813751361490,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,18393009765578480997,2926263061493206742,2097152 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10405717597189311607,3611600825409843464,2097152 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,17330513173741187117,4233710082190043761,2097152 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,321488802049452303,3517234575369250215,2097152 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14133807444255895889,2881564179977026197,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7866254011623302049,18091045780825889317,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10323331414151848137,16172401904928129044,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10323331414151848137,16172401904928129044,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,3873870752999179589,11876256873743826033,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10791355242842418590,4092908855162334259,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3297602872612854402,2516239311672020526,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,8619188240334174965,13502311471889436625,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,5860497357323631580,7493100498305494717,524288 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5232,i,12681902365558252667,7567953200211237520,262144 --field-trial-handle=2288,i,4690161335144497807,14123854596710502693,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

4396cfb4-2caf-43ac-8116-de49dbf962df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4396cfb4-2caf-43ac-8116-de49dbf962df.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8436f767469d4beacd11cd051231189cdd996dd555f552661e7e6bee67371a4e
MD5 d9b4afe0b390f58a6f9df89a4feab319
SHA1 4b4a10c834fe01dacb0b9b4522aee0be1c99e638
SHA512 c97d5f7bd73758a74b68973650b85a5ed0004832c58993c19dfe618c84e02faf014cd6d48b44dc9dceac20c5cf69ad2fb15ebb56f32921d542c9bc387e226d23
TLSH
T194513F46ED5082BBFFAC6EF18EE4A687363AE9F815431D3A04E4D7FA97563B0050C094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f1ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f1ae.TMP
Size 2KB
SHA256 a46929258fc23a2584ed676b53ec9905a4d78ec3bd236d4fd125064482f0fe41
MD5 71989cae78ae5aa6bae9924cd4f79daa
SHA1 bc1a08f22cdbab190958962d1a8319b7f5a09827
SHA512 ba9246700840f7a5b719803f5229e8d5c580c44c56b2d2e5cf76f387630b636665d78271d10ce3a9ce8485bf488ef7a462c7096acec7ce4d2277c66f9a5e466f
TLSH
T1C7514242ED5082BBFFAC6EF18EE4A687363AE5F814431D3A04E4D7FA97563B0050C054
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b6639100b9d351b0b94f7c78134ab36deeb432f12eb240c68221d5d9d13ece12
MD5 6572317cdaab9635e829237b641d0fb1
SHA1 ec4b64141e528edc9bb0cdaef01d26a8dd708cae
SHA512 1e01e24f42730fd9141b2289b5d60e7c88fa54d92efe82e9b66b64e431fbb5517e17df25ac47a28e0e6bf67f6f2f467bdc01fdb8aa6590c450178d295b78c4e7
TLSH
T1ED517EB7C3D4877E891156F06B246D6ADE2D0A5782283C1AC9E5EF1F93F24B0D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1ced7c30533c745a2d94ba6f123a910df06316a81bc98c1846f9685ff87c4088
MD5 170c6db0c727083ae44d9b69622139c7
SHA1 da186ce031f692a869a845d509bb7d0e592b1d97
SHA512 98950ee0b4e4c938b95a2a0fd34ce57b6b98db163b9994161a0ec611937abfe5896d83cbf35cd8c0f11fb4b9ccce9324996e5224bcd15dacb6ea531005584fb6
SSDEEP 192:sxZ0R8WE/fmsobEIdpd3HW6+WNGYYBadTIgrJ:sxZ01E/fmssdJHbGfy9
TLSH
T1E312A7116E38A57B8CCBE219BB25BF53E6FD503261941E58EAFCC61C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8f47979a1d9aeee04d3c48d979a48362229a5ab5c2cd1f6ce561b1c27968f161
MD5 2b27bd0e6f390debc91f38ef2978672f
SHA1 f2e80d4f1fe43f8384ed3401bea7fc9c97462ee0
SHA512 8c8b7d92bdb23bb985fb97da1fa7c3492ca33c7ce43564f629e0c1fcd3c81b7747d3c0a7dbdcfb9dfef2463b9f630d7a4667ef038bd5f13d5087ea334c93a535
SSDEEP 192:sxZ0R8WE/fmsF2EIdpH3HW6+WNGYYBnwdTIg5jJ:sxZ01E/fmssdXHbGfn4z
TLSH
T1C322A7526E38697B8CCBE61DBB55BF53E6FD503251901E48AAFCCA1C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5ce9c63a0a5d95e6cb39829b0b2abe15c9c3d7f31e2decb6dd185108892f7f20
MD5 62a11182a5607fd6de4c4bd9d130cf79
SHA1 0ceabe80bf10b15ec0a0fb0758b7f6d2e16cc19b
SHA512 7a892269d6664e3eed0726d5dbabe8e2e3255502ae0bdb8c1f07a4ac145af7067d1dea4939b7a1855ba98e4b7ba20bc20a83c515a9adddeae142b4d128b485a1
SSDEEP 192:sxZ0R8WE/fmsF2EIdpd3HW6+WNGYYB2dTIg5jJ:sxZ01E/fmssdJHbGfuz
TLSH
T10622A6516E38697B8CCBE619BB15BF53E6FD503251941E48A6FCCA1C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b46399ba073016b5f463405242cf73ca735baea6f6160f838cca47952a38f230
MD5 cc7324ca45709765b67258373c221f06
SHA1 2c1bc5f2f3928f1ee0140427ff2fa567505b0e98
SHA512 243da2a29ad34596ecf159274fb77d30a19dac99e80f09a0b0edf60c71956b2452be72c9e4380ce54021f180c965fdc07c949bba8f15dfe5f6bdab2d86fdd313
SSDEEP 192:sxZ0R8WE/fmsFbEIdpd3HW6+WNGYYBadTIg55J:sxZ01E/fmsVdJHbGfy9
TLSH
T1E422B7116E38697B8CCBD21DBB15BF53E6FD503251941E58EAFC8A1C05E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 873234afaa606fdd3384f8426aac1715d29cb24880c772aa04012e6ab278d1e7
MD5 fa453e231f9924d738d786802f81ec76
SHA1 21ccf02d17a366242d7beb6025bff5e76f62b782
SHA512 504faf50adc255d5856fd59c55bf29da28834ece64e80e05a92eb9ecc1c2d3d3e3ff3e967464c8b8b0fe902e82208d1734e22f98af5211e52b027e4aa9e25b5b
SSDEEP 768:kpyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXLropMUc:kpyYR7jWv3NpBu1ja/CL8OX4+
TLSH
T16AC2E93B640DCB7E4FC01E9DDC5AAF9B2E9802C796548D4047FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c71c9bd9d93fc29c3d336ea425acf994df19ca0be76f67e9eb9b013cd2c24918
MD5 333b46b1e083815ec683c74e14e47920
SHA1 09a048018a9bfabe38bae3c792f05008266162ad
SHA512 a445809d4870709a4e97ac94c90121f7ea408ef3bdd1ac246b1c03cb1c956883b393dcd8b0fa480aafa3595b8b4551243fc427e79c1cf61fb9359cf9474295a1
SSDEEP 48:KglEZVnTHIbbebIStIK9N1/IxNYYO/VFyLeZ04WcMFbwX4ISQFK901GFx+VYvwss:KIygK3KmWNKKuIFD6KIAKOhKKKwy
TLSH
T1A0C1E25431BB064539BE399494B0871A55813277306AF52BBFBD08A28D6FE1C4DFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d3e7ce32a69898cba081ee1390d7f365f0ba4a61d08a0c515120b5d1742a1675
MD5 71f19b2bcace46b16ef83ef250a2e67b
SHA1 7a2a033b958fbcacc297898f065ebb1493b0471c
SHA512 9d0fb2ee509e6a3bdbb62f074cc3d8f3668a283e1a390251949fca9f130c3c895facfa60a59a94cf91c1afdb1a18c4082a2ab2e8eb18186d985ebab697bb4c2d
SSDEEP 384:GZcIuysNZ4GiIIaKQX5+DtQODEBkTn7O6R2Feo2h7UBoY:UXygukDeOQSTn7TRJkr
TLSH
T175927D71ACB8AC375DFBD255B44632179EFC5067D6C86E80E5DDAF2D01C96A8130A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1cb03ab7f9ac38f9cfcda42fc55537762c629bc102f032373587b906ddc470fe
MD5 de2d01d8c0c765dd1d8fdbb0a453c69f
SHA1 51a0c2980ee85f5bf9afa59cc3802d850549aee8
SHA512 b999fbb6a2b087997b8397e5da43b8d9c996061d571fa99ccb95d88ea6c1e3fcea230c78ad76e4d9c2d406e1ecdc31201218d8613e3e5930d93a357343e16cc3
SSDEEP 192:EONT6nnHGQmiUyqaQYcX5hQDP1QOD1MctUmU6:EONT6nCEQNX5+DtQOD1ymU6
TLSH
T1A202EB34BCA97C778EF76D59B48633139FA4213BE5946B80DAE85E1C01D765C2306C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a253bdc3eca61571cdf2155a014d8388a0ead023585f4e56a78976379d5d3633
MD5 06c47b6bdb8eee8a4b7f3f3d59e274b4
SHA1 38f91beb0ba713037416a629cb5ca75c853da0b3
SHA512 b93c3a90fbf9138e33f350d51325564e312dc627eb81255cd7134ee07f221f096c52eb74598af25646612834d61525bc5b329e6dda74f31a0a496b5d1bb4c6ed
SSDEEP 384:QZcIcsNZ4GiIIaKQX5+DtQODEBdTn7O6R2Feo2h7UBoY:ucygukDeOQnTn7TRJkr
TLSH
T1AD828D316CB8AC375DFBD295B44632179EFC5167D6C86E80E5EDAF2D01C9AA8130AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3867ad94ebf978f4bee174feba54a941e27826bc8b4ef56c45b33a4b1c27b961
MD5 198fa484d935a4e160e7351451aef93e
SHA1 f50f95a59b483a96813224d48cd549de13b752a3
SHA512 81caae7f937fbf768cc0038792581d9ccd0fc76ec490624379617238f677aaf5cec11348c8a5273c87a17ac8f9a4cbdfda32603b69a451c38c122ea76180dfd0
SSDEEP 384:9ZcIcsNZNGiZIaKQX5+DtQODEBdTn7O6R2Feo2h7UBoY:lcpVukDeOQnTn7TRJkr
TLSH
T102827D316CB8AC375DFBD255B44632179EFC5167D6C86E80E5EDAF2D01C96A8130AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c035219ab2680d6372f46e3f39315716f5d9a249f9e420af1fc999cb8f47358
MD5 21277c8e0048b4559b3e9c9484c80c6e
SHA1 5cec0bbd84e3528b69c70af0dc1c1d318aae3d1f
SHA512 bf2baca8a16e8ce3a90a77d7cd046abe9392a19178e07a8f2e0828a998ab7eb14059513cb77dda2a48a95d60bc58b8ab1a6206cb4ca05f4d39bc39837850008a
SSDEEP 192:EONk6nnHrQmiUyCaaWYcX5hQDP1QODEzNKVg3Z/5nU6:EONk6n9SaWNX5+DtQODEBnTnU6
TLSH
T1B7120A35ACA8AC774EE66694F08732139EA81127DA887FC0D5EC6E2C01DE66C130AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52e6ecd5-7a5a-45c1-a2bd-16a0f13faada.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\52e6ecd5-7a5a-45c1-a2bd-16a0f13faada.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 be543836ee23ce08300b575d3702a92797fe6e1ee02a853ac659cd2a3a77a0ef
MD5 ad0f8357a2e8d90ba13b16b3fd23e75a
SHA1 f94d4fac6d286899bc5e6b87c0247998ac053a83
SHA512 2ca6a35a4c05049d37b987a39f3aeaa84df3887eb48694084936703594cc72e6ce51cd76687f541fb02d605e98fedfba1078ce37d09da3ebae15a328aac1c7fa
TLSH
T11F41165CA6FD1148B3B76E56ABF7A96D487BB9772E0BD45D10000E4E0A27F448CA1733
MD5 SHA1 SHA512 TLSH

Submit Download