3dcd04ac4e90de910e36c147724565578a63fedb6a40cbac3c97e29f71853276

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3dcd04ac4e90de910e36c147724565578a63fedb6a40cbac3c97e29f71853276.html
Size 1.2MB
Sample260912-yl4v2atdkd
SHA256 3dcd04ac4e90de910e36c147724565578a63fedb6a40cbac3c97e29f71853276
MD5 9bcca5abd29f385a4b001b0605ba8f78
SHA1 e2126b11f7f14db0364089371371f8f0c24adada
SHA512 3d7823f457d730ff6acb74c50a603d37cf6b1389af0765f736f3fa09872dacdf25478bde52a7efc7dde664aa4915da88c80b82664e354789ba3304650af92279
SSDEEP 12288:xCeSXyMTNrjTEY0+kC6bhxs7jGtLlHz84W3:xCRyyjT3kC6bhxsWL9z84W3
TLSH
T19F45C7DB9231717FF833A8B596C8A949F3988CC1E5164AB5BC70A61343EBBE61351331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4112	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338261948450584"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{C292E73F-CF5B-4740-8DCF-24FA83A85A7F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1612	3884	msedge.exe	86
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 2012	3884	msedge.exe	88
PID 3884 wrote to memory of 2012	3884	msedge.exe	88
PID 3884 wrote to memory of 2012	3884	msedge.exe	88
PID 3884 wrote to memory of 1576	3884	msedge.exe	89
PID 3884 wrote to memory of 1576	3884	msedge.exe	89
PID 3884 wrote to memory of 4244	3884	msedge.exe	91
PID 3884 wrote to memory of 4244	3884	msedge.exe	91
PID 3884 wrote to memory of 4244	3884	msedge.exe	91
PID 3884 wrote to memory of 1884	3884	msedge.exe	92
PID 3884 wrote to memory of 1884	3884	msedge.exe	92
PID 3884 wrote to memory of 1884	3884	msedge.exe	92
PID 3884 wrote to memory of 1872	3884	msedge.exe	93
PID 3884 wrote to memory of 5004	3884	msedge.exe	94
PID 3884 wrote to memory of 1872	3884	msedge.exe	93
PID 3884 wrote to memory of 1872	3884	msedge.exe	93
PID 3884 wrote to memory of 5004	3884	msedge.exe	94
PID 3884 wrote to memory of 5004	3884	msedge.exe	94
PID 3884 wrote to memory of 3532	3884	msedge.exe	95
PID 3884 wrote to memory of 3532	3884	msedge.exe	95
PID 3884 wrote to memory of 3532	3884	msedge.exe	95
PID 3884 wrote to memory of 1112	3884	msedge.exe	99
PID 3884 wrote to memory of 1112	3884	msedge.exe	99
PID 3884 wrote to memory of 4316	3884	msedge.exe	100
PID 3884 wrote to memory of 4316	3884	msedge.exe	100
PID 3884 wrote to memory of 772	3884	msedge.exe	102
PID 3884 wrote to memory of 1824	3884	msedge.exe	107
PID 3884 wrote to memory of 864	3884	msedge.exe	108
PID 3884 wrote to memory of 1572	3884	msedge.exe	109
PID 3884 wrote to memory of 4048	3884	msedge.exe	110
PID 3884 wrote to memory of 4048	3884	msedge.exe	110
PID 3884 wrote to memory of 5004	3884	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3dcd04ac4e90de910e36c147724565578a63fedb6a40cbac3c97e29f71853276.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8f63ec188,0x7ff8f63ec194,0x7ff8f63ec1a0
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,15587351641233883854,9957168110990205691,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,17636456335604365984,15221290400514100546,262144 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,10877714148684078600,7344849746580959061,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,7502555748168282573,8952734657149725060,2097152 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11530322602279282400,11286155554508075639,2097152 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,18251848436095249783,10897758129166807141,2097152 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,17905548270719580047,172083729003282767,2097152 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3656,i,5555582905644886715,1274249456304925586,2097152 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,18252270635562786721,12357051480215312087,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,15559979697502559673,12787197719955783492,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,4261089018038235691,14213214468143231348,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,4261089018038235691,14213214468143231348,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,1948747607237906410,17741004671974134481,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,566595439733594459,787114947320815925,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,12138915907593778746,17761038667175063651,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,10787268447625094769,15124858200522677059,524288 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6304,i,452091728175653432,1851437772359717743,262144 --field-trial-handle=2256,i,8609296933786619254,5936422786694519264,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d995fb0e1f4f28f130812cd37e83c0d7221babc3b059537e4a5febc33830ea12
MD5 e7c7a245879ac53a5bb88cab5bc8ed38
SHA1 281e522b9c2ee0a7fe9d08a2335f5850740558cf
SHA512 e1d428e82cddd7d4de0a26dd5a11f6010727f536d7d0e151b57cf7d624b5c134e4723266d42afa7eae7ca2700542271c05c7de1b1f3026555fae4a41919bb14f
TLSH
T122615D4BC6B34263FBD89BF285E42187BA3B7E821A931D1E11A8E475840F7370C151E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5945f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5945f8.TMP
Size 3KB
SHA256 80e84979b9a6dd74c1facd38747188218089db990e6e48c42b28c1cf28f69a12
MD5 ca2c907812434c73e782fdd66f13a2ed
SHA1 6bfdc89a68d2f619601368ac9d41278365e6e9a8
SHA512 cd90a46ba9e8cc37e87399f306cfe98a3df36b4832f00cfbeee6d3b4ac588463e5a3542304205c8065d1d8ce9fc72dc6db3e4abbdb1be21dc2e285afe2a32fb1
TLSH
T1AA615D4BC6B34263FB9887F2C5E42187BA3B7E8216930D1E11A8E479840F7370C151E0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b5f2f6697ab4ec3cc66d8c40efc293f18476ce5df3558e2e4dbac0e336469fec
MD5 244df58197c9b61b8c032fdc7eb2d63c
SHA1 542f9ef553f53c67ea9c24fcb5c04b26fd1c51da
SHA512 48b2f42f9b1595e0569261a78380d023ee3aa72c53911bebbdf725e9969ba590cd0898de4ada127ecc43897a4834a4d4b195d3723fe621edc329c4cd5dbae8bb
TLSH
T1122199F7C3D4967E8D0112F06A286E1BCD2D0A4B422C3C5689E9EF1B97F24B1D101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 139db6d650d14d48764a6b24f5f3363fb678961890dee4ffd03b92587f5be7e0
MD5 eae8b7c7e746bf45ae980cf3faa6a9c1
SHA1 e3685f715d6fea94f2354169140df8a64aa32f34
SHA512 bc9bec69d8539c905721fbc417d3f11bfc28d53db620e098a891ea65602edcc836d14b21339f3e01a0ee9d93511596b9087800e558bb0ffd1df595cd4d75a86c
SSDEEP 192:sxZGRMWn/f0sAlHEIdpdaHW6+WNGY3RnvIgrJ:sxZGFn/f0s0Hd8HbGy9
TLSH
T12912A7116E38A57B8CCBE21DBB257F53E6F9503251D51E58AAFCCA1C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9992c5e141a490b6339a41e7a551d451bae81b7891a202ad7ffca3a705eb5c86
MD5 e82c669de033ff3e93e368091c268ae5
SHA1 4c45789cf77981beffafc13638a3a5ed12b283c4
SHA512 5b0a2c49aa2fbc4d9df8f9cc58f529c9040a28d490b8576903c4d869976ce2264c54f85519a3ff5f97fd0ad940bc283d8fef8c0d6dd40a16a08a47d549bd9087
SSDEEP 192:sxZGRMWn/f0spRHEIdpHaHW6+WNGY3QnvIg58J:sxZGFn/f0srHd6HbGBK
TLSH
T1A322B8126E38697B8CCBE61DBA157F53E6F9503251D11E48AAFCCA1C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7cbecc6a1484d4b30fa1b59ee45e88fbf3c8d7c940390218ed1f91763c2e62b8
MD5 f6ec920f814c6e7b97fb10fd0e49b6e1
SHA1 e5e18b6d10a380a1461abd3a0ae086a8ab07ffc5
SHA512 87748278e9894263618abd8b04bf3aeec0cc50e488c8205f53c9403f64f306cf836d7af8e87d34ee3c4d77f7e3a9906b8d3bac97fddde19430b3c5958f31356a
SSDEEP 192:sxZGRMWn/f0spRHEIdpdaHW6+WNGY3+nvIg58J:sxZGFn/f0srHd8HbGbK
TLSH
T13922B7116E38697B8CCAE61DBB157F53E6F9503251D11E48AAFCCA1C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7742242e98e0e151c0b97a4d06f4606dff6094a4d239986579fc6982fe82c758
MD5 74071ce46f02c7b25d512327fce6cb8e
SHA1 29e14b44931f29c85f04cefd46ab6fb9d1fe56f2
SHA512 224a2b80f849f88aaf79357c0e4ae8c7441c8220d0792639ab78d9f73e7991deb2198259c47bdb602bf299c5da59755adcdb147f9dd3d498f4e34e07c8378002
SSDEEP 192:sxZGRMWn/f0splHEIdpdaHW6+WNGY3RnvIg5WJ:sxZGFn/f0svHd8HbGyw
TLSH
T1B022A6116E38A57B8CCAE21DBB257F53E6F9503251D51E58AAFCCA1C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1439b831af6f6467807a685832887eb74a4281a4651e5d65977e381e123dcf0c
MD5 bb45554b402ce2f5e517e54d54712f09
SHA1 1b87b03a787e8451ea699039abc9dd401df04fb7
SHA512 c59ac6841e88ecc037be259cb75d8d5d2c899f160ac47ec1c9fb8ac2b64eeda49f73608c7ff65221976d66ade48d4a2d796e0f4ce2f6bb253d7ca814d0056ea2
SSDEEP 768:7x30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72orolZMM:7x30AbSWvS2l9u1jaLmLZ12TL
TLSH
T1EFC2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4047FA984C02D77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bda535a91de1e41e1aeeb8c9e294f95be504f18b5be14d94426c5e146020ef89
MD5 7f835421d1b289808c2eddf786c57d39
SHA1 e785ed460638f812c6dcbeb323934655ba80c71b
SHA512 752b22c17a1e0dfb49fa3cab1047fecccf98efb35d463d38bf475e2e7da2c4a240392de60d1c45a9cac549c0f31cc50cb2ea354cf1d4ab6aed24931a5b044db5
SSDEEP 24:Kc+5u8MIdKihU1eS70pyXNmq4L7roU5dkt5o3PIG3kKDHhr9k1xP0SPaJrZwNOB/:KgHIdK0UInyxQIfK9+8hKI/KP6Qjyhf
TLSH
T16C91551136BB124039BE260C84B59B6E4642B1B33018EA6F7BFD51E28E67F485CFC4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 19424361609bf63ecc934e711b6b2ae610f1e964e2b59537b7ea870329d398ca
MD5 3dc5958438099841966908f3d1c0a9b2
SHA1 f85b36e6b90f1ffc2a3b81dd6ce1dcfcab2e24a6
SHA512 1ab97acb78ce690417df9ce643a9e1de1c29e0bd439c786d3a3c1fc385bdad914393dcff6e160e983f40c08861a2a438abf93fbba3c2767b54f50c96b6c0f249
SSDEEP 384:aqZcIxssNsZx6pucneu9iX5FC/8TXX1i+26Kw7O6R2FeoIpoG:NWz65hauMcl6Kw7TRvJ
TLSH
T1D3928C7268789C3B59F6E555F54A36039FBC8053DBC86F80D9EC6B2D01DAA98130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7f7a6f01ba2a5a41a2f75a690e82d9c1b03c1abdefecf1fc4028fc3781bd5f92
MD5 5a16c061fe7f6fe2a4784c9ecaa26747
SHA1 8e7a1444f7af6e7ea784cf79c2e2117046e77f94
SHA512 d1e057a5f749f14318ca10cd359f048ba02b98dfe79c70a6773b5d50dbd20fdc14ec4baf486eed6b24063ca1398396809e7f8a20889c7ea342a570b69d9d4def
SSDEEP 192:LONv6AmwprQmiUy9P6siX5FC3jzor9mylJi/MU6:LONv6ipdO6siX5FC/8TikU6
TLSH
T14002FB35EC786C7F8AF2AE45B18737135F99116BEB942F84CAE81B2D01D765C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 734bcfee593f9f12cd01cdb2618d5c3bbc4f145ea5273a0e357376b5a045836e
MD5 f7b8a4197f2b8e1f46531d7c535a7944
SHA1 49f8da66bda25923fed175f949c5f36bc024d207
SHA512 5ab912cce89ea72aa74aafbf9debeeed454f690101e89af5f5a3c3fea73b9d4dfc665def0ed9f9308f45945095c9ce3593b5013a719009e576f38359c2607a2c
SSDEEP 384:oZcI2sNsZx6pucneu9iX5FC/8TXX1i+2IKw7O6R2FeoIpoG:W2z65hauMclIKw7TRvJ
TLSH
T11D828C7268789C3B59F6E155F44736039FBD8053DBC86F80D9EC6B2D01DAAA8130AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4f3ddb94b3e97187f0184ecba563c07493835eaa6b16710867250f624f8566ea
MD5 f8ebc55ae33efabb420be38c01cbdc3d
SHA1 16ee6c05ca42fe2d0965489e834685cb29f5888a
SHA512 c39de2b3c3c82826751d5eccff16f7bd0f5dce0510354cc7c36c3dd31b4850505e4d6ba8833ea2c1f8b48e767b2d4519b90e127597e1afe944d9f05409485e13
SSDEEP 384:LZcI2sNsMx6pu8neu9iX5FC/8TXX1i+2IKw7O6R2FeoIpoG:T2y6nhauMclIKw7TRvJ
TLSH
T1B2828C7268789C7B59F6E555F44736039FBD8053DBC86F80D9EC6B2D01DAAA8130AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 57f9f4dee702e080d22f468655723fa2b9ad35eb38eb02a44a25896d134adf28
MD5 b270384263962b5285e74c3edfbbefca
SHA1 35a934845eaced12b275c438f38162a2faeb475d
SHA512 297e0bd009ec6547500b832d4fcc807ca986478468d098b5c5cfeb108ac25d2e55b3676da4db126b863042868cec3f32d47190402f85c14932c4263fc46d341b
SSDEEP 192:LONd6AmwpFQmiUydPxsiX5FC3jzor9myXXXFi+2vlRS/NwU6:LONd6ipjcxsiX5FC/8TXX1i+2DKwU6
TLSH
T1A9120B36B8789C3F4DE2F555B08735139FA94217EB887F94DAEC1B2C02DB65C530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e363d370d1b3e18c0e732899344e7c7dde3aa2a9e27b85409c752d2abb2521d5
MD5 0af2d8c87d002904518dc81fa04c9415
SHA1 41af08b8848951dad0f8ac502a41423ec62deae1
SHA512 fb5e5ab1fa053b13c42ec75e68c1a762ef156676e389368e91db5fc94f055fba2a99dc1f71fd5ab028f4b6b2783b34946b0041952530f776b5afa0ccefd688a7
TLSH
T166412768A7E9014DB3B37E5AABF7A86D487BB9772E0BD45D00110D4E0A23A40D9B1733
MD5 SHA1 SHA512 TLSH

Submit Download