b0d16289c0e49e7af1d9f2150c888d1ce2786a1ff3c41a1aacfaf0f38acf416d

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_b0d16289c0e49e7af1d9f2150c888d1ce2786a1ff3c41a1aacfaf0f38acf416d.html
Size 38KB
Sample260912-xml6yavwey
SHA256 b0d16289c0e49e7af1d9f2150c888d1ce2786a1ff3c41a1aacfaf0f38acf416d
MD5 68f0d76d047dc805a18c5017561db9c0
SHA1 a2f553b60a6305bec42ae3b6844e34cc3d5aae53
SHA512 48ca94c6b3ef37ecacc51c6aa86dc12c75c45da346036e5757c34bb03e4336ecab37cedeb1fa67f12c681bce1f9cc2454c89527228af2bb7f3f856ce4b0cc13d
SSDEEP 384:SE9NrnfLrS8RlnOPaw++x7EP+J1h7+dM02tRvax5yvCl7tMUONCx:h9hnHfTOPj+4qqRQLyalRMUsCx
TLSH
T140030E24A4C56037827782995936AB9FFDD68047E22BA500B3FD279B9FFBE0DD813441
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{1AF9F31E-3A3A-4149-9B30-1FB877042D8C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 4260	5324	msedge.exe	88
PID 5324 wrote to memory of 2492	5324	msedge.exe	89
PID 5324 wrote to memory of 1244	5324	msedge.exe	90
PID 5324 wrote to memory of 2492	5324	msedge.exe	89
PID 5324 wrote to memory of 2492	5324	msedge.exe	89
PID 5324 wrote to memory of 4620	5324	msedge.exe	91
PID 5324 wrote to memory of 4620	5324	msedge.exe	91
PID 5324 wrote to memory of 5164	5324	msedge.exe	93
PID 5324 wrote to memory of 4752	5324	msedge.exe	94
PID 5324 wrote to memory of 5164	5324	msedge.exe	93
PID 5324 wrote to memory of 5164	5324	msedge.exe	93
PID 5324 wrote to memory of 4752	5324	msedge.exe	94
PID 5324 wrote to memory of 4752	5324	msedge.exe	94
PID 5324 wrote to memory of 4952	5324	msedge.exe	95
PID 5324 wrote to memory of 552	5324	msedge.exe	96
PID 5324 wrote to memory of 4952	5324	msedge.exe	95
PID 5324 wrote to memory of 4952	5324	msedge.exe	95
PID 5324 wrote to memory of 552	5324	msedge.exe	96
PID 5324 wrote to memory of 552	5324	msedge.exe	96
PID 5324 wrote to memory of 2972	5324	msedge.exe	98
PID 5324 wrote to memory of 2972	5324	msedge.exe	98
PID 5324 wrote to memory of 432	5324	msedge.exe	99
PID 5324 wrote to memory of 432	5324	msedge.exe	99
PID 5324 wrote to memory of 1036	5324	msedge.exe	101
PID 5324 wrote to memory of 5304	5324	msedge.exe	104
PID 5324 wrote to memory of 5308	5324	msedge.exe	105
PID 5324 wrote to memory of 5344	5324	msedge.exe	106
PID 5324 wrote to memory of 1532	5324	msedge.exe	107
PID 5324 wrote to memory of 1532	5324	msedge.exe	107
PID 5324 wrote to memory of 1652	5324	msedge.exe	109
PID 5324 wrote to memory of 1652	5324	msedge.exe	109
PID 5324 wrote to memory of 2212	5324	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b0d16289c0e49e7af1d9f2150c888d1ce2786a1ff3c41a1aacfaf0f38acf416d.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff4fa8c188,0x7fff4fa8c194,0x7fff4fa8c1a0
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,16530041843961808474,8803435676810307414,262144 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,5581393633027256581,8006749233316843710,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,6446992137315722424,7283399697801695562,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,3024090686841479524,7652468150457387304,2097152 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,7614436286561979271,4577878138512388765,2097152 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,14595297664110777389,8853667361492425810,2097152 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,2076876610720936755,10916508871641079865,2097152 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,5503468818912025008,8210093917257655763,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,63481207943493255,16267980230952989218,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,17249442645944644358,4589360409908168693,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,17249442645944644358,4589360409908168693,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,11025879045029587035,12847547872109818871,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,16796955708476215268,3351856974253987127,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,17441157292991444378,16734219358156311747,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,1572656436093835855,15688467438833007627,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,15498852630440999428,16400747063105653483,524288 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5472,i,14214974492331110609,8247070825453026962,262144 --field-trial-handle=2960,i,13617315829822565351,8001142268679820441,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5d4a6b690060ceccb06e1d48e4f5b2cb7f94b8934477a01aba1c6f840d946932
MD5 c450979ae4c1fdcb08406946c0d819d5
SHA1 c7cc2aa8168b40a353824256a3a95837d4c824f0
SHA512 e08e61d3112dd6602d3574cf96bda8efc537d957e96ecdc08fd8b4b02a00f6a50759dd8938e3bca2d537efe2eda17decd27bc04c53db8477a003c431735bec5b
TLSH
T1F86162809D828DE5FF6C263D90D17CCF3B386691994F3F52059CE6F655E2331A854834
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f5e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f5e4.TMP
Size 3KB
SHA256 e121c8c47a084dc8c2a65dde4204fa092ec830f8dfa54c4f292284c3c4285fd2
MD5 8e62c76099c9a91d412102af1c7c6b3a
SHA1 4aec7152e9475faee047f0a902bbe4a1be17b7cc
SHA512 428d53f95eaabf823ed147124a015882a4ca4e54bdb29fcaac7ab37015cd2d16ccb35b6bd713475a42a4a85fdb760aaa2dc76fb1bdf517fafaeee556b5a32097
TLSH
T16C6160809D828DE5FF6C263990D17CCF3B386691994F3F52059CE6F659E2331A894834
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 639954bc97554ed12f923a75610e832d9c81ed9f9d09e048ac51a422809beb84
MD5 1e187b7e40d55dcd9abd635ef4b9261b
SHA1 2eff7a00fe67dbdd6443972766091fad83789323
SHA512 fac9794787ab2a7af6a01769abe24a25eaaa99ea5f881d4d5b8c4abc55c1bbde90e9ac069c880b4bf3632178eb228a1d2920987cfab027de6bb3bc1b7f15a978
TLSH
T1EC5169F7C3E4867E891156F4AB146E2BCE2D0915422C3C6A89E4AF1BA3F24B1D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 700f0aa65997f20644b10172c539b6cea5c4f5c3f399e4b98210cb96b14f526f
MD5 12f7550fc1d654616f633ac90d1b4dc1
SHA1 544adde4d03cb03e265c9ad1c3402cf5e33cd93c
SHA512 f9130422338a17c60531d3ae8ce7ef78ec93ca329521d0bdbf87c167841a6bad7482d00fab17b5586416b37f8a0113e074c9aa2b888d679fd488d49616d5ad15
SSDEEP 192:sxR2R1bG/fjsErxzoA8p48/g6+WNIYtf6+GnIgIJ:sxR2XG/fjsGsh/5I15s
TLSH
T18432A616AD28A93B9CCBD21DFB55BF53D2F91032A0952E58F6FC861C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 535f94b1bdf20aea8b46a312944100fe02713d6cd3ec2010169e0e9cdbfe52ce
MD5 207b2d74416b0517fe3d3db2787092bd
SHA1 2633607b214c0b76084998e976040aa65e7bae27
SHA512 a65afbfde9aa6227955e5ac3996c115c376b4646b7e058f8e3cedaa80f2b26ec6c167405b3bbfe24b17e8d5643adae3ec52bdc95b7028088b89913fa895564d8
SSDEEP 192:sxR5R1bG/fjsdrxzoA8p48/g6+WNIYtI6+GnIgDCJ:sxR5XG/fjsZsh/5IA5a
TLSH
T1B632A616AE28A93B9CCBD21DFB55BF53E2FD1032A0951E48B6FD861C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 59a23cdc332f51197be4f3dec1a28e475148e5d47351f3fb9995377469bef079
MD5 d23724090515352862b55f35106afb62
SHA1 55a57ee050ce301a3575d891dd729960e1544085
SHA512 581ee9a9181e16b3859871a8df42c2179d71cdbead9e5acdd6b199a5929e715a0ac57630002c1f58281217fe5893dd3aaaf625b6c6da6dc70ce4124fd3b3191e
SSDEEP 384:dFIGx9efCtgmkFfk6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV6W9G+RhUromLG:dmGx9sWgmMfk68F1+UoAYDCx9Tuqh0V2
TLSH
T140B2DA3B640CCB7E9FC00A9DAD196F976D9802C79A588D4047FE984C03C77EB912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598d13.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598d13.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 917c71ba0f49c5707725d388c21dce191ee579f215ae3294c05f14e8518c8365
MD5 784bb32e80fd842eff54a19eb6c44666
SHA1 c812bb7c74ab58bae797c8d1287a850251304680
SHA512 dc1900043b2504985d3c3462da0c42f2460ef538b3e1e4037985bf0ec69a8c8859042b7bda43e5925c3094224992242085d90bbf9cdc8362a4498d85f40a9eab
SSDEEP 768:q/UxvxjgC+u3KfKnJn0xDc9bsMSJz/Fn/PEZvI:vZj3+u3zZ0VQbs7JT9E1I
TLSH
T16F03D07AECA05C639DE6A780768B7653BFF44953C5CA2D9849DEAE0D06C73AC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a92990a67acc78b0a0fcc4934187c82fc2da2712c31729883a9b9e80c608d882
MD5 0e3bd5fed87cef8b190ca0b12e8c607e
SHA1 401e034cca04b3c96a4b25204b97966402e14972
SHA512 01137e8a760277e366079a359497f70881540ac9040cae36d2948092d1657e709b25137ee75164f095ed5434b7fdaad0062f353b83b4b0f7fc3528838a99bfda
SSDEEP 768:OVFu73MwgafKnJnhxDc9bsMSJz/Fn/PcTRSD:Oy736ZhVQbs7JT9cTRSD
TLSH
T10603B0B3DC90C9B7DDEA9B80B94A7513AFF54593CACA5984E6CDAD0D01872DC1347C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5d759fe4d4b24f8e937affcb837cadae100c819b7e77ecb648fb9838a0ae9bf2
MD5 82d829889c88844f9951e02c65724c72
SHA1 9d459d31d4726a17084b8db84c02935f4592c6db
SHA512 9abd950f7ce9ec002ec8e989427cdd0ef81f8a71d5768e92b2e71aa8da0af761c304726262aba516593edbc8eab3340ea1263c6638149e6cda8510909f43879c
SSDEEP 384:GZcI738NpkO+xOP199fw7DJnzzdvLcN9YkWwJJhoMSboCzfnFLj/1BcO6R2Feobf:U73sfKnJnzxDc9bsMSJz/Fn/PcTRSD
TLSH
T1DAF2C0B2ECA089A79DE69280758B79137FF44543CACA1D84D5DDBF0D06873AD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 068d308b87867f15fd966581b8119df81b35501b564216db0bfaf56f8c2f565f
MD5 aef29bc4f08ed7115ae5da8b5db12867
SHA1 fcc89c145bbf9365f35443623f3ca39656b39a40
SHA512 4b9a4d2e069f8ed33d141f5ed74665ead33e11d94e73a641d9dc180c669085f39af19d8bd3fb24e7b8b0dad9ad24ac520b923ae0829f5b2d1960e22cf0b89326
SSDEEP 768:z/UxvxjgC+U3O9KnJ5xDc9bsMSJz/FnnKISHXPyK/:GZj3+U3NXVQbs7JTxSb/
TLSH
T1F403D03AEC505867CDF7A7803A8AB657BFF44953C9C529A849DD6E0D07CB3AC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f082c501-cb0f-4ab6-aa15-26981cb61745.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f082c501-cb0f-4ab6-aa15-26981cb61745.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download