7cd62f07b6054fc6f077a778d665f34e2ff5c1d1ba82a17ea9ee467a61f5b804

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7cd62f07b6054fc6f077a778d665f34e2ff5c1d1ba82a17ea9ee467a61f5b804.html
Size 1.2MB
Sample260912-wt6ngssbld
SHA256 7cd62f07b6054fc6f077a778d665f34e2ff5c1d1ba82a17ea9ee467a61f5b804
MD5 50ec3deb3135b81e730e90219a6aa493
SHA1 c1d4a77b4931cef3975c2dfe2d74d80d9d61d2bf
SHA512 1ddc49252392d051979e22d122b786e4d7ad68d6e20000c4c76c45a2580e93c120ce46b6ee3141198b4d1e9ac9566293dde6897f495204fbb2e47a2cd4481d9e
SSDEEP 12288:TCeSXyMTNrjTEY0+kC6bhxs7jGyQhHgtvXWT:TCRyyjT3kC6bhxs7QhHgtvXWT
TLSH
T1D745C7DB9230717FF833A8B596C8A949F3988CC1E5164AB5BC70A61383DBBE61351331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3260	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{86B79F77-6EC6-4E2B-B43F-FDD1CFEAD040}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 5624	1356	msedge.exe	87
PID 1356 wrote to memory of 5108	1356	msedge.exe	89
PID 1356 wrote to memory of 3260	1356	msedge.exe	88
PID 1356 wrote to memory of 5108	1356	msedge.exe	89
PID 1356 wrote to memory of 5108	1356	msedge.exe	89
PID 1356 wrote to memory of 3772	1356	msedge.exe	90
PID 1356 wrote to memory of 3772	1356	msedge.exe	90
PID 1356 wrote to memory of 4372	1356	msedge.exe	93
PID 1356 wrote to memory of 4372	1356	msedge.exe	93
PID 1356 wrote to memory of 5812	1356	msedge.exe	92
PID 1356 wrote to memory of 4372	1356	msedge.exe	93
PID 1356 wrote to memory of 5812	1356	msedge.exe	92
PID 1356 wrote to memory of 5812	1356	msedge.exe	92
PID 1356 wrote to memory of 3240	1356	msedge.exe	94
PID 1356 wrote to memory of 1824	1356	msedge.exe	95
PID 1356 wrote to memory of 3240	1356	msedge.exe	94
PID 1356 wrote to memory of 3240	1356	msedge.exe	94
PID 1356 wrote to memory of 1824	1356	msedge.exe	95
PID 1356 wrote to memory of 1824	1356	msedge.exe	95
PID 1356 wrote to memory of 2876	1356	msedge.exe	96
PID 1356 wrote to memory of 2876	1356	msedge.exe	96
PID 1356 wrote to memory of 2876	1356	msedge.exe	96
PID 1356 wrote to memory of 1908	1356	msedge.exe	99
PID 1356 wrote to memory of 1052	1356	msedge.exe	98
PID 1356 wrote to memory of 1908	1356	msedge.exe	99
PID 1356 wrote to memory of 1052	1356	msedge.exe	98
PID 1356 wrote to memory of 5640	1356	msedge.exe	101
PID 1356 wrote to memory of 3512	1356	msedge.exe	104
PID 1356 wrote to memory of 6072	1356	msedge.exe	105
PID 1356 wrote to memory of 1120	1356	msedge.exe	106
PID 1356 wrote to memory of 6056	1356	msedge.exe	107
PID 1356 wrote to memory of 6056	1356	msedge.exe	107
PID 1356 wrote to memory of 1084	1356	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7cd62f07b6054fc6f077a778d665f34e2ff5c1d1ba82a17ea9ee467a61f5b804.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffccc2ec188,0x7ffccc2ec194,0x7ffccc2ec1a0
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,2595976850605416083,11115321347906672154,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,7080728554167509939,15611880861206589276,262144 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,1817765998431982977,3485129530396283888,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,6417795234550600666,10704028725620987962,2097152 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,915026531798776434,15179968748139654714,2097152 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,7557643792127861511,3151947418644685094,2097152 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,14415150060903542748,12866343795279177206,2097152 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5220,i,9322937471455072587,11375759599674346457,2097152 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,11812687496767804597,10012606999852325484,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,4090464367909532988,15020240617161231239,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10969326792714498465,15994660886244864060,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10969326792714498465,15994660886244864060,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,8332511078792376678,8728435942912846659,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9565349669851363392,11757962015812067384,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,6860118664179621282,8772774459405629708,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,3668377213240871073,3205885005396914622,524288 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4596,i,5048565569712845911,7084251817846042744,262144 --field-trial-handle=2152,i,11832968126478338060,13269205239686931587,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0fbc070a5c84bf13721452b635812fb8676e7b355aa3e7b921fe3b890470c673
MD5 d95e92e7bc18f7f33b0cf5d5c7a96572
SHA1 b91a594973022cb214b6afe1cb4c262840913f04
SHA512 4f4207550671e5cefbe20448add29179b3209a044537efb22a2b770feee641578e53037c2f345dbef7bda147808b1eb27c943d2b0066f1f1c8736a47553f96df
TLSH
T190516349D97A42F6F7688171C1D04EFB36BE89A02183DE085DE8C5B6D87F73B8124484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599a81.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599a81.TMP
Size 2KB
SHA256 38b7b544f56e6e5bdb16dee414dfe4c276d1259c643aebcfbc9efdb2dd4948ac
MD5 36f55d94cdde83e0696583dace03d630
SHA1 3f01916282b4b8f21cf7fa175fa88dfe7b644c1c
SHA512 fe4301c33ab2ffd7dcaf5019982ac01e79a627810e43b235bf6e127d1e1ca838eaf1b18a49ec73c0e4f1978d93303415d6043cc7f855036defe13b27882bb70a
TLSH
T148516249DAAA42F2F7788171C1D04EFB36BE89A02183DE085DE8C5B6D97F73B8164484
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0eb4c086-988a-4693-b4b8-1c16aa24fc73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0eb4c086-988a-4693-b4b8-1c16aa24fc73.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fb095707f22fac91361a4936099210e0f1c1bf50075a1312edc683f79719b89d
MD5 cfdf451ae7b1a5157f63fb4e09faf309
SHA1 f1a069b457e607a35e89dc3097cb4d751ede82de
SHA512 24b01af88efc844a14f619880522c2344347588ead75beece52a0f928b6c7c6edd3ebd6202968617d860b5bcda6aa7e4bb38d82f079d0ee792e0dc17f55355df
TLSH
T104519DF7C3E8867E890156F4AB146E2BCE1D0955432C3C5A89E4EF1BA3F2471D24169F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 219fed6d922101ac1b8e2f0f797fbde13bb2de7dd96a906e846f72cedd4438cf
MD5 18f9d0aa17902bb95bcc067e0afc7a00
SHA1 92bf6d4847d8f8438e4050c5bd77f3e79057bddb
SHA512 89eff7ecb0b3ef3e6bf901e952257b8d8378d3f2308f2ede03717918ff917ed8ca109aa75d1bb4893612468958514f7f26fa94913bd47cc4733e92b4532805cf
SSDEEP 192:sxR+R2bs/fos1K0zoA8p4U/g6+WNIYuei5GcIgIJ:sxR+as/fos1KVd/5Its
TLSH
T114229515AE68A93B8CCBD20DBB557F53D2F95032A1911E48F6FC961C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3180e4e92e4eb2241b555377d984a61402cb1c29018094943bebb1330ffc332d
MD5 fae362c9cf56be7449253af10bf50247
SHA1 f225aee8697411a5b89d4ff6549cb04c79468fca
SHA512 a99a82fd2c27a78c700d0d9957b857fb036f2a9e9f279e35c17a995ab6489fbcbbcdb18233fb64c3e1e21187db2fc195654d52dbf9488c63a7b5649f37a265ab
SSDEEP 192:sxRlR2bs/foshK0zoA8p4U/g6+WNIYuei5GcIgDSJ:sxRlas/foshKVd/5ItC
TLSH
T1E432A716AE68A93B8CCBD20DFB55BF53D2F91032A1911F48B6FC961C14EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b4c824d4949abf1ca6cd2396b12d5d23269bcf9b0134d3dbffe86db888c25d92
MD5 32fd86d7a54e3d300ca3b8660c2ee559
SHA1 86fa074c9d7468d2425e727f1c0f24e29429e447
SHA512 80b1e90cc24d6cd56672cad8dba2bb8841b9bd7ede5cce5989023dd1bb14912335c2ad95c86cadea3d0c65842083c0a4a640290e76d8d29658393288416b26fb
SSDEEP 96:KpgV0Q6WSkiW/PUIkKcBUyk4wQf6w5ONuKGMSqeEKDqG3:EZBNHj3
TLSH
T10891D42070370A1039BE3608A5E59B9E66C271B33464EA2B37EF51A5896FE444DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f7d68a14-db5e-499c-bcf4-33dd449f59b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f7d68a14-db5e-499c-bcf4-33dd449f59b2.tmp
Size 23KB
SHA256 884673bd1c56752797ee6d853c144a5db76b8749f2482a8eef0f1dc4e0ec6222
MD5 47b17b0bd6ddd365eb1141ed1f8207c9
SHA1 4d3633e60bd0d170ac242f0f980964a452180ce9
SHA512 b81ac6e60a1ebaf717242fcdb4551d604fb0f5c54491da8d3fe49183a45a62dc1ce5d30eb259e2c97be6b9fce364fb2ff213534d5037f23dba785cee6994b294
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6Crocb9:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0VW
TLSH
T1D9B2DA2B644CCB7E9FC00AAD9C196F976D9C02C796988D4047FE994C03C77EA911A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ee00093-fe36-4eea-8671-445edc30c87d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7ee00093-fe36-4eea-8671-445edc30c87d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9acec71c8b4d5b43bd0b3e99d02148bb9e4424b0b01dac0ae1b984c75b4281a2
MD5 e58da85f6d1311713c0fa7dbdbac71b6
SHA1 0799c9b71d992b5847813bdbe1a9fb8b9d126080
SHA512 1525efde98d5fa330ceb95c99d85ebfd6b7bd26c27b1de939e26205e1f721c031926608be618276f6417c1828a1501765615828385058a05e11c78b7feee8e6b
SSDEEP 768:5m/UxvxjgC+J3jRf1SO5yb2MIYNa8S5oYklnA+0cTRDP:ZZj3+J3lJzTWRdAzcTRDP
TLSH
T1EA13C036A8A4AD339CF693C5B20A6787AEF11163D1C55DF889ED1F0E0AC77AE5303851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c7afac3fa1683e13cf716cb9f1aa3736126227b802f76f538c0e9aa6ae67363d
MD5 35cffcf2e480c61a85c12618eb00b5bf
SHA1 08fbe505f9282a70c2f99b47171677de9416df2a
SHA512 ab9e01375177e63788943d0af6336a782792073925e1637a45942b0e05e559c98d432e8e15ad979a619cbd25f8a0277e46913f098903e34037bcd3f19e6428d1
SSDEEP 768:5+o3jNf1SO5ybxMIYNa8S5oYklnA+0cTR2b:Uo3pJ6TWRdAzcTR2b
TLSH
T155F2BF32ADA499739CEA93C5F1067687AEF05223D2895ED4C9DD2F4E09C77AF1303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e7b70b7613d0f16b99bdbdf2a56c60621df23b78fb0c8b9538d9fff0d01c272e
MD5 9e4fc3965863da9338e8dafa9fb589e3
SHA1 3df1d7e2222cdeaac76800363c39e633e40e6b13
SHA512 e3553824d8a571feee12ded55065b600480db8125e4e1d3638800d738781b79f5ba823d65ac377ca1cc1f9b7bcfbd6b8d0bf838d928c85eb4a1e3ff32dc8bd71
SSDEEP 768:RjFQo3WwgnNf1SO5yb8MIYNa8S5oYklnA+0cTR2b:so36JbTWRdAzcTR2b
TLSH
T14603AD339DA4CA77ACFA9BC5F2067246AEF10263C5859EE4D6DC1E0E15876EE0307C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2f6a3f71c1baca844fa99750cf7eca15ae2351fed20a8b42f7b4e699ec2e0d78
MD5 f84ab12e32ad604d31f8fa61fdfcce06
SHA1 ddea4ec5c95e1a99a42650a2e519d3ff23d3b5f1
SHA512 74c5556ce849e967f1297491a1655c1168512bb29427c4f3c6ef0bfb9427f2d04707c07aec856da6e514556d0ffa08d8750a6a5a720b539fd2a5d17fd3faf93e
SSDEEP 768:do/UxvxjgC+23MfvSO5yJJMIYNa8S5oYklnAaSCSH8L4:nZj3+23OXIHTWRdAjCS04
TLSH
T11C03C03AAC9459738CF663C4B20AA797AEE55263D1C06DF889EC1F0E16C77BD5303452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae54ed39-65c7-4284-8db6-052ae5189fb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ae54ed39-65c7-4284-8db6-052ae5189fb8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5640-174-0x000001664A210000-0x000001664A36F000-memory.dmp

Download

memory/5640-165-0x000001664A210000-0x000001664A36F000-memory.dmp

Download