49f3c5cbb7e204c98218e3e8e034a13ed2e2e3babbccd1e5c2e3336d67d481a6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_49f3c5cbb7e204c98218e3e8e034a13ed2e2e3babbccd1e5c2e3336d67d481a6.html
Size 504KB
Sample260912-y9a8mathng
SHA256 49f3c5cbb7e204c98218e3e8e034a13ed2e2e3babbccd1e5c2e3336d67d481a6
MD5 9994774d4ad4b37498e4948873296e02
SHA1 e19ed4b87f7939566fde952778b0dfa647e9cbaa
SHA512 05a3540a953cee5183d0906a4b3c4c6685aeb2ec2dc11a988c2cf023dded93ca6e6dcabf8b149768048a742ff4801223824d30400eead6b37d00a05aee65dff7
SSDEEP 3072:HFhrt9aatAUGn9QSJNl5L+m1Q1mJQL52vRdVNLseUYGuJuG9FP8kPrTm0i+hISTx:HFYUGn9Q/uky8kZhI7cH1hiuq7lJu
TLSH
T150B4D6B1B0D06B7F419786CAAEB0BFAAA2D9500AD6C90941F3FC53D843C7CD4E697458
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4924	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338264123647237"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{F279C2AE-74CD-4F4F-9312-E14E7F5DCA56}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 1104	4440	msedge.exe	86
PID 4440 wrote to memory of 4924	4440	msedge.exe	87
PID 4440 wrote to memory of 1196	4440	msedge.exe	88
PID 4440 wrote to memory of 1196	4440	msedge.exe	88
PID 4440 wrote to memory of 1196	4440	msedge.exe	88
PID 4440 wrote to memory of 2672	4440	msedge.exe	89
PID 4440 wrote to memory of 2672	4440	msedge.exe	89
PID 4440 wrote to memory of 2148	4440	msedge.exe	90
PID 4440 wrote to memory of 836	4440	msedge.exe	91
PID 4440 wrote to memory of 2148	4440	msedge.exe	90
PID 4440 wrote to memory of 2148	4440	msedge.exe	90
PID 4440 wrote to memory of 836	4440	msedge.exe	91
PID 4440 wrote to memory of 836	4440	msedge.exe	91
PID 4440 wrote to memory of 116	4440	msedge.exe	93
PID 4440 wrote to memory of 2348	4440	msedge.exe	94
PID 4440 wrote to memory of 116	4440	msedge.exe	93
PID 4440 wrote to memory of 116	4440	msedge.exe	93
PID 4440 wrote to memory of 2348	4440	msedge.exe	94
PID 4440 wrote to memory of 2348	4440	msedge.exe	94
PID 4440 wrote to memory of 1412	4440	msedge.exe	95
PID 4440 wrote to memory of 1412	4440	msedge.exe	95
PID 4440 wrote to memory of 1412	4440	msedge.exe	95
PID 4440 wrote to memory of 3748	4440	msedge.exe	98
PID 4440 wrote to memory of 3168	4440	msedge.exe	99
PID 4440 wrote to memory of 3748	4440	msedge.exe	98
PID 4440 wrote to memory of 3168	4440	msedge.exe	99
PID 4440 wrote to memory of 4852	4440	msedge.exe	101
PID 4440 wrote to memory of 2364	4440	msedge.exe	107
PID 4440 wrote to memory of 4216	4440	msedge.exe	108
PID 4440 wrote to memory of 4532	4440	msedge.exe	109
PID 4440 wrote to memory of 452	4440	msedge.exe	110
PID 4440 wrote to memory of 452	4440	msedge.exe	110
PID 4440 wrote to memory of 840	4440	msedge.exe	111
PID 4440 wrote to memory of 840	4440	msedge.exe	111
PID 4440 wrote to memory of 1608	4440	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_49f3c5cbb7e204c98218e3e8e034a13ed2e2e3babbccd1e5c2e3336d67d481a6.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffb8403c188,0x7ffb8403c194,0x7ffb8403c1a0
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,3179415268748091981,14076678765861335559,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13017077348168580041,11153664501215463505,262144 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,7038574425188489901,4372482604979062940,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,17681490294619255826,7998402833860384297,2097152 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17961328363838369960,17383693047761784425,2097152 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,12716636064217950626,6371091501055770189,2097152 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,11803117684689836892,16905228353359193108,2097152 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3656,i,12686583192060680413,11500542663322975856,2097152 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,42434420862648422,17328024465494160482,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,13984421229475704425,9253495623123199953,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,3815943684819926740,944843338707030477,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,3815943684819926740,944843338707030477,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,16692189917933825695,4489354941699148743,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,16783470372629255155,5152247866985115116,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,8978494945551393080,7520683594339850920,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,12763525853113807864,1880571755993269693,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,10908015986427549720,6158357317653865542,524288 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5360,i,12667763959288616151,15953937329025901768,262144 --field-trial-handle=2244,i,14370750193317922485,16933952662318016204,262144 --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

66dfef70-c4bd-4d7e-b665-7c6d27fa385a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\66dfef70-c4bd-4d7e-b665-7c6d27fa385a.tmp
Size 8KB
SHA256 c1aac4de68afa830c6382fa320b1ce7c1d23869ab9960ebe482c2d771e9ab89d
MD5 9bb060374781d702324a3d5f81f8218a
SHA1 f563ed98839a691573158ba37337605a37164f07
SHA512 b2a52a66e3da69ba28a4072fbb68adfffe786ee274d277549fe650305b2fcc728cd54a781b00794793d9529a7730e00241ff2e1c86c1c79b9ab6aacdf925cf2a
SSDEEP 96:3qONkMQsjpfe/tyng7X5ih/cIPURHl8h4otop5vYDaNBnP9ZvEI0IG2jb90ymtIr:aONg6IE7QmiUyWaTPuIGmeh+IC7sDAU6
TLSH
T15002F935AC787C7B9EF3AE05F4877A239EA5112BA5952F84D9E81F1D00DB24C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

37153afc-d7b3-4402-b7de-54d902fdf0a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37153afc-d7b3-4402-b7de-54d902fdf0a0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a911015dce0982c2eff91067b81c8df21102d14fe949622f79bf419d3c6a3a9a
MD5 4de3752b58e0d348c5b1a8e5cd7898b0
SHA1 f67d0af0db396caf8c78c42d79d398f7c778af0f
SHA512 2434cffa3c6c0f5480e891f457eaee5975e37c09d0dcf2e1c0fe41f6a2aff15d5125eaaef997a0ff5921d03221f9674ec6f582eac410d1c03f391de020d95145
TLSH
T1AC51B88BD768C2AAFB68417441F6D3873330EAA1EDDB1F1A25ECC5BD9F067549108314
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 816e99b96ad3a0972aa9ba49b028e1a67ac87949af995587ade15f9c37515f69
MD5 dc4df9a97701153e08bcfbab025b13ce
SHA1 508dc7accef2c6db3b3e75921fb2527c617b44ba
SHA512 9488e831f4399c010c408d926b90ea6f9fb70c4feebb42ab859c7c51bdf6d7e20bfd3dcab0117a9f86e066fa07f59d36290156abfe3ef0410aabbb1df8193eb5
TLSH
T1E5218FF783E186BE8A1156F05A24AE1BCE5D0517432C7C5589E4BF1793F34B1D00269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5e76a6dedab4e168cc81b099238489313a2b551b877ef1b9de5f1c94cd59f8f6
MD5 6c389988b59dd494bf158674cc33347e
SHA1 c1a6d9a2730f8cf15738e3ad37d452f8ecf7f167
SHA512 94a0dc4a981395e10bdde1e20380fb4feed28a1327bce257bf135b3a3d86adc1821f0ed17027a309a550ab7690ef590078ad82d907f4c53794123981b7785d0d
SSDEEP 192:sxZrR6Wu/fis5GKIdpdRHW6+WNGYapYh9IgrJ:sxZrru/fis5S7HbG89
TLSH
T15322A7126E28A57B8CCBE21DFB65BF53D6F9503251941E58EAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c4cd72f75e3bb552dde2d5cdf9c183dd8b5ea708d3d874a13de1102c203e33f8
MD5 6c5d8763e69094c711abafd2cf5b19d8
SHA1 460db4db4fc38119b0e946b3a179d76f8fcc92b4
SHA512 ff1ae05fe648685a431c16e30141f5f65dcc9bfb61a50583419cf3a928aec115da8c2b601feeced04bd8e3fbdf3ac6f453ec698583112ccf6ade365dfdb540a1
SSDEEP 192:sxZrR6Wu/fisiGKIdpdRHW6+WNGYapZh9Ig5rJ:sxZrru/fisiS7HbGX3
TLSH
T1F122B8116E28697B8CCBE60DFB55BF53EAF9503251911E48A6FC8A1C05E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e2e4a6f5aa3c0dc6a391f0a154d211ac3a7dee3717a8fac050edcdfe58c6dc6d
MD5 841713353f34580fb5649589443f29ae
SHA1 a3b7a8ec4e853db2259054955a4b2d0c8a7cfd9c
SHA512 ad84d6db6caf9e1ef84e064545f6d6dde07a0d082f77b3bc435132d1c08613eee14a1a89774c3bb93dfae77d72f2552b8641e1ce45dacd0e9f44bdc37c490b36
SSDEEP 192:sxZrR6Wu/fisiGKIdpHRHW6+WNGYaplh9Ig5rJ:sxZrru/fisiSxHbGv3
TLSH
T11C22B9126E28697B8CCBE61DFB55BF53E6F9503251911E48A6FC8A1C05E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d6b6f39f15ee0cb6378b972da3e5cbeb75e4b1ed52c45e470a0f55e0f892a942
MD5 f26b2ce8970b871a53748072a6dcebf2
SHA1 276ce73f585d09455d4be2852a487266e3db8822
SHA512 f375ca6705a3764536a3dcdb2d0a7842e75d858613c894624370525ed3e8608717348291909146b183c1a0bf7586413f27025a7f649aad8f22269c270fbf565e
SSDEEP 192:sxZrR6Wu/fisqGKIdpdRHW6+WNGYapYh9Ig5xJ:sxZrru/fisqS7HbG8R
TLSH
T16022A8126E28A57B8CCBD21DFB55BF53DAF9503251911E58EAFC8A1C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d1b16cd6b8a434c10e342f57bb6b67d798c742aaff3e9a3a38e24d1e6ac141db
MD5 4a82c10f507b0f111f0e1d45a3c23494
SHA1 96ea9597fb687257f74abfd18e97c6b06f25bc9b
SHA512 83c59adff32c09beed6e2496eef6c9d63c9638385c5a39e6cb02536c13a63ec429e5a4614ea954e0c100f5635174c8700a3b8924afc5a19b50b944a478634129
SSDEEP 768:JzWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Gro4gfexmR1v:JzWPcLKWvKeEeu1jaClLiF794gWxmRJ
TLSH
T128C2EA3B640CCB7E5FC01E9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6b250804db21f5a85e58355718cd7fbb6a5fea38d5f54e33222b693a6ee35504
MD5 db0c4eda6e572d5fbf3f90f8dc5a1c5d
SHA1 ad74bca1d6d5f761df936db787f0163c9baada73
SHA512 3bb9e73912c3151449f78e542b9b8019fdcf967cfa36daa9b7a16b8e31a01f7a5f6f0b67f2eaaa906755f98b5be4e8e64bcca158820fa83bd74a430851dff520
SSDEEP 48:KsuInKTq03yNRIZKa8kWSIPKbiU7ypmIHKraQF:KsuwKTqO2RyKa8hSgKbi6amcKraG
TLSH
T19DB1402432BA1200387D691C8564872E568271B3301DF66F7FFC10BADE66E198DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 72e0b4638c89ce85aa6655f520a65b014cd2738e2ce377aaa5115aaa0474f573
MD5 9b1f50ef1a5941771da16780b40f3581
SHA1 3ab5f1cf68b0ae81a97b5a2e4fbe66438bdb3601
SHA512 21c32de22e627766bb0c4f4c538bd8419b35d7c1e83c30666fd82b4b3403eea542e36dccd9c49c18e4cbffea85c6d645a01bd6aa47d4276ec6a490298f5bd94d
SSDEEP 384:2qZcIzcsNUITwky1qmZzIGmeh+bQOni07O6R2FeoOh7U3oU:hgH/lVhQbni07TRhuf
TLSH
T127928D729878BC3B9DEBE541F9463A139EB8916387C86F80E5DC5F1E04DB658130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 76378848986d2898791ce81f26474e2608f1b47bc542195ea51f8c3d117aa5f4
MD5 da8288913b1931cec58054cbfd7a368d
SHA1 68936cefdb9e18341225f564cda18927df96c288
SHA512 62d28013a7bcfe34084715d11467a2e64064d1c632db946a7f3452a98b10332b4a4682e374c0569b771050b8d534e0cf26645bcaf901123825bc5e790f4ab28b
SSDEEP 384:yZcIesNUITwky1qmZzIGmeh+bQCi07O6R2FeoOh7U3oU:AeH/lVhQTi07TRhuf
TLSH
T15F828C329878BC3B9DEBE541F9863A139EB9916397C82B80E5DC5F1E04DB658030B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5cc08b9193fbb4c4111b92277e5b9108d07b22f98da7d77be46db9b5b29b8ef8
MD5 6a6808847f110c145d23703b8d7b652c
SHA1 2e574602f72ac81f3121642b0bcd7a8d81715641
SHA512 e245e75397a31bc073e544cab8619e83f799d5a1de6f1ba95135717eab9ddcae8417565d2dc50e1f3c43ad33613d0d185edf28a12bc6a8c655d123241ba6d1e2
SSDEEP 384:1ZcIesNUFTwky1LmZzIGmeh+bQCi07O6R2FeoOh7U3oU:NekclVhQTi07TRhuf
TLSH
T1D0828C329C78BC7B9EEBD541F8863A139EB9916397C82B80E5DC5F1E04DB658030B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83f403ee86334ab5d162586be33bfc268f8da1cfee5d2237fc1f6adead9a1138
MD5 d77b3345e5dbe2cab94ba4a8f140ecc8
SHA1 0ba56b8745ba0d938c407577000c4e142c1e6e6f
SHA512 706a9646df63f569239cbda68946be7c7ae798e7db10822d6686fe4befd4a737a923f1c945e830cbf0c9dc32d0c5588f713272cc68e667c681f8155e7912627a
SSDEEP 192:aONV6IElQmiUypaTbuIGmeh+bQK27H1/OU6:aONV6DDdbuIGmeh+bQzH0U6
TLSH
T10E120936A878BC7B9EE3A940F48739239EA55227DB897F90D5DC1E1C01EF25C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2c1548790fde25b48d5505b22422007fec12450bb8d3df447591fc336d3c8a86
MD5 3b4e4a2898761edebbc6af2fd16ff97d
SHA1 399f16898626f6e2ff73525e578209650674d131
SHA512 55e387c022742300b76a23166b651b77494a49e4159309d893b7c0ae6748a9513f05578b896b6ca332ad7464706a8c2e71dba810eeb80ee1ded86b616912ab76
TLSH
T1E9412A58B6E91158B3B76E1AABF2A85E487EBD772F07D14D00110E4F0A62B41CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download