711adca0721cd66df35eb2a0d2cd362f5d91519a2f284c2046c9adbee4d17be9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_711adca0721cd66df35eb2a0d2cd362f5d91519a2f284c2046c9adbee4d17be9.html
Size 45KB
Sample260912-xyg2csshpc
SHA256 711adca0721cd66df35eb2a0d2cd362f5d91519a2f284c2046c9adbee4d17be9
MD5 408e90a38f1b4e35658f8cd6269ef21e
SHA1 268c9a9285bbdff3c9c534a835cd5d3601367648
SHA512 00ea830b8d982e3e48834ff5b414af66510136397c7e80a8751b2066544e907f27520c30ae1a18ddb6b26b24da18bfd12c7432764a44785f7ecdc422bcb37540
SSDEEP 768:xfttRXq2d8aEe+v3LcjdAARgcK/LE0MQzuWcmP8cfl/VZAYgT:qaEe+SdAAC00MQzXTfl0
TLSH
T1122327218496483601BB85D6B5F1DE09FEA5C207CA06DC007AFC57DE3FF7E4A9A87095
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338258729504182"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{73052EEC-A9CC-4CB0-9C8C-DF7C079B7455}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 5072	3908	msedge.exe	85
PID 3908 wrote to memory of 3288	3908	msedge.exe	86
PID 3908 wrote to memory of 2196	3908	msedge.exe	87
PID 3908 wrote to memory of 2196	3908	msedge.exe	87
PID 3908 wrote to memory of 2196	3908	msedge.exe	87
PID 3908 wrote to memory of 3268	3908	msedge.exe	88
PID 3908 wrote to memory of 3268	3908	msedge.exe	88
PID 3908 wrote to memory of 916	3908	msedge.exe	89
PID 3908 wrote to memory of 4120	3908	msedge.exe	90
PID 3908 wrote to memory of 916	3908	msedge.exe	89
PID 3908 wrote to memory of 916	3908	msedge.exe	89
PID 3908 wrote to memory of 4120	3908	msedge.exe	90
PID 3908 wrote to memory of 4120	3908	msedge.exe	90
PID 3908 wrote to memory of 1112	3908	msedge.exe	91
PID 3908 wrote to memory of 1112	3908	msedge.exe	91
PID 3908 wrote to memory of 1112	3908	msedge.exe	91
PID 3908 wrote to memory of 2080	3908	msedge.exe	92
PID 3908 wrote to memory of 2080	3908	msedge.exe	92
PID 3908 wrote to memory of 2080	3908	msedge.exe	92
PID 3908 wrote to memory of 736	3908	msedge.exe	97
PID 3908 wrote to memory of 3220	3908	msedge.exe	98
PID 3908 wrote to memory of 736	3908	msedge.exe	97
PID 3908 wrote to memory of 3220	3908	msedge.exe	98
PID 3908 wrote to memory of 3916	3908	msedge.exe	100
PID 3908 wrote to memory of 872	3908	msedge.exe	110
PID 3908 wrote to memory of 3292	3908	msedge.exe	111
PID 3908 wrote to memory of 2760	3908	msedge.exe	112
PID 3908 wrote to memory of 3580	3908	msedge.exe	113
PID 3908 wrote to memory of 3580	3908	msedge.exe	113
PID 3908 wrote to memory of 1920	3908	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_711adca0721cd66df35eb2a0d2cd362f5d91519a2f284c2046c9adbee4d17be9.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff97891c188,0x7ff97891c194,0x7ff97891c1a0
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,17660365322578569033,557079853305361361,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,12818582076407824567,18191865827299309225,262144 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,14650529205289095730,4669297758223858633,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,2706147992132503404,260930376376569573,2097152 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,10131733823572208908,16767151114520481246,2097152 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,17136563504979892770,4989971212018953187,2097152 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,16560754941865975615,4938466415141375576,2097152 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,10491489138404132666,6503229312909275633,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,12098410622796230094,5668809185294891022,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15905943175338412204,10368953276056423784,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15905943175338412204,10368953276056423784,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,540373356388954286,8026035147043345071,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,8628421939001244159,14366513078108878007,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,12485753530460430916,504594343354148362,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4045200222214108088,8349057295075541188,524288 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,10174237469962787773,17167151984072813589,262144 --field-trial-handle=2984,i,12784652708955582407,867006392756633794,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9d7dba13f15c0dfe65723a5fe5c2922627a2a3b27c9b9fd5781cdc7a0573748b
MD5 b141571b926819d2a0534109307c1681
SHA1 c9ebb379c31096b04f1ac3aab4a0705df7c9373b
SHA512 a696fadfe8a882dd893733a3caf89d2d94e97f37cadadeb6dee2a42934cb57b5e7ca2f09487eec87fda343d63f210d2ebb8332c917a4db1aea6514f1d76fd6a4
TLSH
T1045193440EAB71A0CB884634D2DF35C3B6F069BC31A3AE651797D8782BCEB47ACC4050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d4ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d4ef.TMP
Size 3KB
SHA256 2c0b7d0cd79d932928905c1b9ad010dc37e7fe00c4533840fde7c50ee0e1adca
MD5 e66e15343c2d3cec07928ae6dd5e6c65
SHA1 0253d38e75f9f0e5be0968576efc19504ab022e5
SHA512 d1385c0e09a5dca566e472f8c0e3bbdec51dd5697896af5631344c43f1b00ddf1ac0fc82acd38dd1dd3237b5dc36a9e81d5cd13d8585bc3e2e9ab53ba71f0054
TLSH
T15B5182440E9B71A0CB884630D2EF3187B6F069BC31A3AE651797C8786BCEB47ACC4050
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 514f82da3f4df997cbb568e31cbad67c35a188284fb9a9aeca90cfc0e9a896c4
MD5 34f4039ee754d46a5f97cf9f32fb8c07
SHA1 4c42d72fb5baceea8bcbb6831d40d53bfe5cf3ff
SHA512 d4651990e726d5209c1717f87c3c133048834490401d576855bc0dcf6a7b4494177088e0bfb47c7b0529a63d3ec61fa03325b7279d6bcd8722e724a49536489d
TLSH
T1F5117AF3C3D595AE890516F05B24AE2BCE2D0A06821C7C5A89D4EF2BD3E3075E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 914600298bcc99051771f74c94458a7193ce4cf318759afffd944aad7911bd0e
MD5 ddb751afeab01cb2d6aa16e2f60ea4fa
SHA1 f10aa4e5f3b108f9d424c72c4481b651e08c83dc
SHA512 9541da4cad5513c5ce32d36048af9e17a5638274dd91d06dc691a1609c874e45d4a1184c795582bfa8ff0a5e05738c7184fc625fe2b9de04fab9ef623acbd9bb
SSDEEP 192:sxZMR7We/fjstD2TnIdpdZHW6+WNGY36ajpzIgrJ:sxZMUe/fjst8onHbGXy9
TLSH
T1B212B8516E38A93B4CCBE20DBA257F53D6F9503251D51E58E6FC861C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7ffc2aedcfcfd309a376bd6ca82f685319d8154d730b5810bec52667c26fc621
MD5 82428a2ee6e88093ddca3d65eb0b4ef9
SHA1 0fb3050d6b3e68941c4fae5ad27cc1cf2538ebd8
SHA512 eaffd5963ac2f9fbc420d494add5739942e3d49939e7725274e6899aac2ce5ec6047d8c5217c2c518092fe7060471f9acfe72c61a2115906b653a17bf5f8a063
SSDEEP 192:sxZMR7We/fjsirD2TnIdpdZHW6+WNGY36ajpzIg5zJ:sxZMUe/fjsir8onHbGXyL
TLSH
T1A522B8526E38A97B8CCBE20DBB25BF53D6F9503251D51E58A6FC8A1C05E6ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 018cf8c8d8fde2f53269e1ae3875321e14bd5fa931fe3a43dd6258eeb97f9744
MD5 2733842e6d0e53e28d32c1018d63c427
SHA1 978d1dc69cf7d06d02049102eb5508e48a26f048
SHA512 7592dce00425d875dbc3591905862f6c68d5f85bf36936e3ace310425736c97d67af60472461bbb1c78e5ef7ac30d4881c0451336cd04980bf7243c7cadc51f1
SSDEEP 192:sxZMR7We/fjsirDMTLIdpdZHW6+WNGY36+jpzIg5BJ:sxZMUe/fjsirWUnHbGXuN
TLSH
T16122B8516E38A97B8CCBE20DBA15BF53E6F9503251D51E58AAFC8A1C05E7ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 749339c14ddd70a388b17899addc31e4a61045f4bbf3423f69d9805dc5518b79
MD5 b1008be8c15e19546151d457e2fb1b6d
SHA1 0eddc1b4879bcbe602cbc56331ec5dab927a2ac1
SHA512 c4cbfc73b957a94baf0175caca5d3ac5c7188ac1ffac3230b9fc6239e748556ef6ed16b77a1fd45cd8efbd747ab69b3a8a5ed198f0bc9c2f60f4d5c27fb3bec7
SSDEEP 192:sxZMR7We/fjsirDMTLIdpHZHW6+WNGY36ZjpzIg5BJ:sxZMUe/fjsirWU5HbGXzN
TLSH
T13022C9526E38A93B8CCBE20DBA15BF53E6F9503251D51E48AAFC8A1C05E7ACD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c46a0584a48e630516b48d2c6683cde4bfa7f804a04a09ad71a81da093ba4af3
MD5 05b2bd5debc863f5e689bf71766d6141
SHA1 d81f8ed1df6fd0e7d3b89faf6ff34b57d9be3530
SHA512 3725811261f1de4eac881debf614681996b287fa5a0009c0fe50f61e796e4fb5319f06fd7eca400fc9e910f6c2c2b4f748112363a7bcda66a70fb000ccf162ba
SSDEEP 768:o+Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/rroEL:o+Klm7QWvUYe0u1ja8/L/E/YEL
TLSH
T192C2FB3B640CCB7E4FC04A9DDC5A6F9B6EA802C7A6588D4047FA994C02C77EE51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 99d19af0b6a875139e771361fe2762fcfe3346cb4fcba8075615543b9e335cd9
MD5 2b4f91f155866baf0b866db294f27f7d
SHA1 2abcec030ad3c8b77bffc9a6ef4214fdf2b5a10c
SHA512 8ab65203001873d4ca8992e8bffa0c37ccce7e6f44dfaceaa7fd0156944086a260cbe6d701186d1b5c26213523988d798faf8c5b783528d28e1c50fc60e863bb
SSDEEP 96:KkOoKvaqBKD+6YkQkgkZPeykKmBewkia65Ya5ulSK+Y9z:uHJVlM
TLSH
T11B91901075BB064438BE39AC9574872E564171B33016E62BBFBC1065AE2BE085FFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5970c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5970c1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0512db5f57e365fddb464e39ba8c895d201a9a1f705302b3e5191de9cf250292
MD5 fc1633444cd2a8097c33f3f43e9420c4
SHA1 0f469e59aabf61cab2bd562a502e2abcd3af381a
SHA512 22e444455600c75a57bea52fd558821c782c3405337cb684bcfea452102904fc7d5490f636ec3c4f2208aca3d13ce028645a436bbba7f96833ef210f3af6d6dc
SSDEEP 384:sZcIwsNCzyMJbS7Ch//0ZbQwmcr7O6R2Feozou:6woMGq/sZzmcr7TR4l
TLSH
T14F827B326C789C765EABE195F44736239EB880A796C84F80D5DDAB2E05CA5A4130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 69179df253847f34b1cdbfae321d2f1a22d57efe26d7a79f742cecc8f3e5a1e5
MD5 910fcc3de2210fcc408e874cf80b5867
SHA1 5933d25861215fb0ba5d19304e9350d70f97f869
SHA512 b403a7a5d5b26c8b714c2c358ed2d27217005fa3cf94e0e04dbae8dc680bcd10a8178409dc18ae0421489baee4759bc9fdd35e3e326518e2af431e0bce718591
SSDEEP 384:LZcIwsNCuyMJb27Ch//0ZbQwmcr7O6R2Feozou:TwBMeq/sZzmcr7TR4l
TLSH
T1E3827C726C78DC725EEBE195F44336239EB880A796C84F80D5DDAF2E05CA5A4130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 4de084f8e5353d5a943a24f38e4186761e20b37640b67a9993dbd9d2498367e3
MD5 0f5b5a881e8e15d3f0329c640acbda5f
SHA1 a489d76b52b748dfc4ea9bad510b595872f30650
SHA512 4908f3a887de8bb228a62a39defc9a94abbdb8acdda983be9ab4388393467f5e255ea07cc4a634311d94841e8f393bd5e8e6d973bb9163cbab0c992a18ebd0f3
SSDEEP 384:riFiZcINWsNa8TUNTUlIluyMJb27Ch//0ZbQwdcr7O6R2Feozou:GFQ03wg5Meq/sZzdcr7TR4l
TLSH
T1A0A26C735CB4C87BAEFAD695F9463113CEB440A7C6C59E90E6CDAF1D01DA198130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b31a0d1ecbee1fa23e20c2659d00223c20854c9df2e69d97b13cfb5b783918b
MD5 1cf89443ea7112eec3cb64207ad8ec84
SHA1 2b918bfd1cab034dfda01b12ea8c9761977c32f3
SHA512 f28b5b52ac7b084db8fd69b4448d14fb1796eb2adead5cce26f965284d390f73dc8e9c2de3d4e971d91923af279bdb71e23dec696680bb71db18b8353a3dfa30
SSDEEP 192:BON76JUKQmiUybgeo//0ZbQLc3Nxcg/GjU6:BON76+Gfeo//0ZbQw7crU6
TLSH
T166120935B874EC775EA2A594F08376239E644067DB895F90D6CC6F1C06DF16C930BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cf299b33612002b474093a4a2a83e985cebfe318c239dfb1e5b6d9ea3fe9c431
MD5 e6d49d2cc5b98d9800e00d13bad8bfb6
SHA1 bd12ebd31008a4f0fcf4095543073a51aceb337f
SHA512 ba13ef4615f88bcb3cb243622def1a42e69f2fc42b30e1412980160d5f1bd903e1ac53db38dfbdcf44a1be7ccf0a9754bb204a4ed8c9ee72ae8e2f7e776b2eba
SSDEEP 96:KqONk4QsjpfbUmjH5ih/cIPURHl8h4otop5eaDsBKP4v+Y1xf//ojd6xlYtYqsoH:BON86JUm0QmiUyTgso//0ZeBCcK/U6
TLSH
T14D02D938BC78ACBB8EE3AE45F44777239FA4106B96915F84DAD86E1D01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35f8dc98-42a0-4d0b-aca7-6617e351591f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\35f8dc98-42a0-4d0b-aca7-6617e351591f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 03d84fc339a5784c5fd2d6e00cc31c271f60eb8a3306c6894290de5290e9fdcd
MD5 4decf22930e9fd1aecf51b844adb5a73
SHA1 ade1c50d51fca6db8d19ea0f435a8101024fb34b
SHA512 98b5bdfa257081c305f62c918bebe1204b61ca0dd273b47bc8fa8997112120b70f2ffc375042603fbd6025863b14c96dc46f493cd82f327196958c18035ccce3
TLSH
T13941075CB6E91148B3B76F16ABF7A96D847BB9772E06D45E10110E4F0633A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download