baacc0c23e4f4d18eb8ea1059b44f10706c41d6c1809cf27a83bd40164bf9e5e

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_baacc0c23e4f4d18eb8ea1059b44f10706c41d6c1809cf27a83bd40164bf9e5e.html
Size 170KB
Sample260913-bqc7jsdc55
SHA256 baacc0c23e4f4d18eb8ea1059b44f10706c41d6c1809cf27a83bd40164bf9e5e
MD5 755dd97fb2a34a3f06ff140ca8a6c90a
SHA1 85c4be90628819b9aa1a376ea3a89a9297f0f050
SHA512 21e85bef4f8f52cf9f3c196e26c6a464d59393eb305f22329686972db73082ec57e50c1610cc3468c555a0fe9bea7d47b6a3350427aaafbe9a3a58434a84d194
SSDEEP 1536:w0PxFYn+hXe+URFcsssP6HlgQ7JTtM4omxJYd0GHsvevajN9KVId/aXN1/yuERBO:waxqQ7A4RDveKYKdRuF4y
TLSH
T11A0407D781600CF6FEF345F2D1865A86385C1037E88704B9D3FD8EAE2765DBE11869A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338303751529008"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{1D7DE7D3-0259-4702-A9CA-F5A27367AA20}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 1964	4948	msedge.exe	86
PID 4948 wrote to memory of 3400	4948	msedge.exe	87
PID 4948 wrote to memory of 4512	4948	msedge.exe	88
PID 4948 wrote to memory of 4512	4948	msedge.exe	88
PID 4948 wrote to memory of 4512	4948	msedge.exe	88
PID 4948 wrote to memory of 2828	4948	msedge.exe	90
PID 4948 wrote to memory of 2828	4948	msedge.exe	90
PID 4948 wrote to memory of 4932	4948	msedge.exe	92
PID 4948 wrote to memory of 4932	4948	msedge.exe	92
PID 4948 wrote to memory of 4932	4948	msedge.exe	92
PID 4948 wrote to memory of 4784	4948	msedge.exe	91
PID 4948 wrote to memory of 4784	4948	msedge.exe	91
PID 4948 wrote to memory of 4784	4948	msedge.exe	91
PID 4948 wrote to memory of 5080	4948	msedge.exe	93
PID 4948 wrote to memory of 5080	4948	msedge.exe	93
PID 4948 wrote to memory of 5080	4948	msedge.exe	93
PID 4948 wrote to memory of 4752	4948	msedge.exe	94
PID 4948 wrote to memory of 4752	4948	msedge.exe	94
PID 4948 wrote to memory of 4752	4948	msedge.exe	94
PID 4948 wrote to memory of 4228	4948	msedge.exe	98
PID 4948 wrote to memory of 4228	4948	msedge.exe	98
PID 4948 wrote to memory of 624	4948	msedge.exe	99
PID 4948 wrote to memory of 624	4948	msedge.exe	99
PID 4948 wrote to memory of 3420	4948	msedge.exe	101
PID 4948 wrote to memory of 4344	4948	msedge.exe	106
PID 4948 wrote to memory of 2560	4948	msedge.exe	107
PID 4948 wrote to memory of 1812	4948	msedge.exe	108
PID 4948 wrote to memory of 308	4948	msedge.exe	109
PID 4948 wrote to memory of 308	4948	msedge.exe	109
PID 4948 wrote to memory of 3240	4948	msedge.exe	110
PID 4948 wrote to memory of 3240	4948	msedge.exe	110
PID 4948 wrote to memory of 2244	4948	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_baacc0c23e4f4d18eb8ea1059b44f10706c41d6c1809cf27a83bd40164bf9e5e.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffda245c188,0x7ffda245c194,0x7ffda245c1a0
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,12730795847105186733,14428262203823757499,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,7079714181689041053,13221710802481527330,262144 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,11368408999393431523,7184560700485564193,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8163335520820645305,7972813150893056018,2097152 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,15943251665218643563,12352536746969847660,2097152 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,5668940521762243151,15556787544806968558,2097152 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,2657519183671052125,14682614430987867646,2097152 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,3299036450172141055,16998888541082310828,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,5932976130609437219,2722418242507784630,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,2284563743119627521,16244067657536469450,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,2284563743119627521,16244067657536469450,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2117451348253072328,1083884461348869286,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,14161343348371287750,9459802124806289781,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,3747171769506959221,9044462178311740734,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,9283673855526360631,7233440225092093120,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,1874443240239410421,18319313509558199556,524288 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,10821114683611744988,16155422145880022821,262144 --field-trial-handle=2364,i,6183261787847777377,2926008713060464766,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba0535ebd81cdaca935965b75b8c1307095575962d160df1ba0c53f2d6b57a38
MD5 f79fb624cf8f24c9f0ab830b4f78bae3
SHA1 cf3777c91fd4c0a9182ed881f5c8f1dc34d893f1
SHA512 0556a2d9287397330aa1091bad31dec40f3bdfae104240714f5fa08cddc5bc2112065be6c9b2484fb3f301c5b78eb8c96eca8e7e10ab292d71b00ea9e403122b
TLSH
T10161808C9B1DC3F1F7F9837E80E523473A76C58185834D420A9BD478989A3E7923B010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dc61.TMP
Size 3KB
SHA256 cd82f04649e2b60e585ba9f3b08138a668dec6e954f4d3c56e7b6359359767d3
MD5 ac3a44c9af064d9697f4eb8dc11d6979
SHA1 76851cd1208c758bc5343075b26b54845229dcd4
SHA512 08dbd645159e48e91a477516de953cf63335a46142c4d70751db86ead30639b327230bff9519992f0d1f02d4593a7a7801d0a8ed5de50166d848e7d67654e22e
TLSH
T1C161808CAB1DC3F1F7F9877E80E423473A72C58184834D420A9FD478889A3E7927B010
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 005dc48dd7e3d8c1773e3580f855ec4066103af8675fc2b17358b1ad9cee5115
MD5 19a3fa78b6cd2ad4b182b67f8b670f30
SHA1 c298d05ff776e32dc9a0322729ac85640d8cb480
SHA512 6add7d502ee1c6ea1f78be6fe60c0eecd9eef254b6999884cb3b93089b39cb2d5c5db852dfb3b0cd8367d73d2ca331cdd552f3fd009c4cea90f921143d0381c5
TLSH
T16F415CB7C3D4877E8D0156F09B256E2ACD2E0A56422C3C16C9E4EF5FA7E24B1D20159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d6dfdc15aa038c73d5d6479f30190a8d065998e8ad8133a7cac207494cfa813b
MD5 0ad2e3d20e5ec7c973a3fe4bfb910830
SHA1 ba006554886e901dfc6edc8b8dde7847c0c89d6e
SHA512 69a0ebfd1254ddf352f3a6755da9996b931abdf3c1df4ded25571eddb26594f4f33e64e51de9bd6aef34f6cea2659e46cf9ff32ff48e03f01b5b41790ad579b5
SSDEEP 192:sxZbRSaWQ/fNstDEIdpdLHW6+WNGYapY4+YIgrJ:sxZbcQ/fNsthpHbGp39
TLSH
T12512C8566E28A53B8CCBE20DBB25BF53D6F9503265901E48FAFC961C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0b5568a6948b3ecd745a2e76509b394f7f61909cab446ff212125cf3e8ea1b31
MD5 40348cd5f98cdcb31c16ec63ef9791c3
SHA1 fc1aea4b9e33fb6e03e1dc18d8920254772932a2
SHA512 c4f19bc31a03bca082b0b6d91ddabf6ea5a303ce21998c172dccccb01d08891bd7653c54e3c253d811434ba957a25c9c76dfcc2eb8b63afe28278c3561a7ae80
SSDEEP 192:sxZbRSaWQ/fNscDEIdpdLHW6+WNGYapY4+YIg5/J:sxZbcQ/fNschpHbGp3j
TLSH
T15C22D8566E28A47B8CCBE20DBB15BF53D6F9503265A01E48FAFC961C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 689b3ffdaa5adc4c583fc914f5a23d2a9c83a0713a2f9a260283821366ec540a
MD5 5e36bdabf4c4f83fdb63c684a361e149
SHA1 1ca5015beac6be619f1a23c7debe635fdf419b4c
SHA512 74fa22149d77993c3daa1915de11588f8683a0c5be752b2491912adce59d82b7a6824cd87f1c9993dd4060f21269b57f80953bcae309bf39691dd4a7feee18ca
SSDEEP 192:sxZbRSaWQ/fNs7DEIdpdLHW6+WNGYapN4+YIg5dJ:sxZbcQ/fNs7hpHbGc3V
TLSH
T16F22C8566E28657B8CCBE20DBB15BF53E6F9543264901E48B6FCD61C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1b3578efa2fb41d18e501005aa54ec608c7eecede8d2ed2880a8b46520a5f4a8
MD5 9f810a43eca7587fd2985ef151b8d32b
SHA1 0b416ecfaf9ba42bac047c55d40d66fc351fcc2d
SHA512 58c2b452991df2f610660f5339a19f866a95a53d44922266c3f647206ea494dd84e3a1c855b3386c04b84ecabf7e86ada6a905439672da5ab736e53e37e98df0
SSDEEP 192:sxZbRSaWQ/fNs7DEIdpHLHW6+WNGYapb4+YIg5dJ:sxZbcQ/fNs7hrHbGe3V
TLSH
T13622D9566E2868378CCBE20DBB15BF53D6F9543264A01E48BAFCD61C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 11ba849c5c24295ac66888b95eb190c994335750a9b7447273ee0fcf938015aa
MD5 7427e4434a96e6d47a90f4af8ad1c1da
SHA1 9ad70c88590063b969eca82b0e041aa12b55398a
SHA512 9743b3a7c5483431148fdb1aff8e3c79416b88d3e9089a2da1464c9d125accbbcbf0929fbec6fe226f678816fd0b7b668fa18b197d94608bf4b3dca01c8cc8db
SSDEEP 768:eCWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy75ro49fe8mRF:eCWPcLKWvKeEeu1jaClLiF7y49W8mRF
TLSH
T112C2FB3B644CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a2d8b45b4fcbaab2eb8a98849bb0c5c230f94f1ffb77eec1d505b036fc110c2b
MD5 fed04630338685706927d157a3d1963f
SHA1 1072d526558c41ad4b1a8a75680ca0a73dfeea25
SHA512 1fe14865988a6b7a945600d363ca203af60e1f31f2b386a80432659a1248a55d05bdee93bf24e6b79a59447ee4881484f66ebdffc11fa73e5cc2f13d4d06df40
SSDEEP 96:KgZKK6Aimd6Kmk0uFyeMIsoAgL7eGoK2teUo6mm7UelXFo/rdbPrA/qaeTrK2Se0:YJZZuFyeMIsvgLiGqteUXmm7UelXFo/c
TLSH
T1CDB1151130B61716387E6948C4A2877E424172B3345EE77BFFAA50A29D2BE091CFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fac177a-b03e-4d4a-99de-878a258d3854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8fac177a-b03e-4d4a-99de-878a258d3854.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e3344651005b37ca6c8e705f2fb817f81adea8cf819a1e753e6909024927503a
MD5 514c28d1441ba46c337426965be88991
SHA1 30815caf349b53b2d0d41687fcff71868075d3f0
SHA512 a4f0694d40b1effd2aa56191a638f058c4ca33cbaecdc7e22007233e35a54175d6bdf5003ee464798f8c656990e3516dddf67476468444f44e28a016ee8f4f6f
SSDEEP 384:0ZcI/sNXUng1Q/azIGmYMoULMXXqih7O6R2Feohh7URo/:y/MAcHMXMnqih7TRUsE
TLSH
T11E828D725C74AC7B5EE7E149F40A3A179EB98067A7C85F40E5ECBB1D05CA698030AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e7c802314d2cc4b0e34fbf2285933b66916454846a71997e87a2216c03a5e4ca
MD5 9cd5acd1c66baf08c111fd2104a3f468
SHA1 5a0ad619b43732042d039c1899f0da8c2e490c63
SHA512 d4fbac341664f8edb87e88c0cf10fc1a88d9de7317314fb63ec30bccd11aa9ed29dfa0373cf4d825a2a3865ac45a918ea721cb2b993d26a953fefed7fb012bd4
SSDEEP 384:GiFiZcIn5sNM8TUNTUlIlWg1yM/azIGmYMoULMXXZZih7O6R2Feohh7URo/:tFQ5lwgZdcHMXMnZZih7TRUsE
TLSH
T1F6A26D734CB4E87BAEB6AA45F54936139DB940A79AC9AF50F6DC6B1D009B1D8030AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 266d9d016bc327a2090d735c4bef283b5326daccb1d59fa8b2929b65ace3c2a1
MD5 1ac853d2fd6651a423561005ff52f3fd
SHA1 3420a2ca6c5941c1cbc1d39c9373210162063330
SHA512 603c19558d7ed1b312414b15c283c241a6579a615c7b5b690fcbb1ce74951b7c3f7198f3e958dd80254bb86f223dad34045b2220564b1f4626348d2269f4f9b1
SSDEEP 192:aONg6IE7QmiUyWzTPuIGmYMgjzoFGtC7sakU6:aONg6DtDPuIGmYMoUVszU6
TLSH
T15E020B35AC78BCAB9FB36D49F4462F236FA5112BE5952F84EAE81B1D00D725C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7f58dd55a61c4964fd7a0112a2c0921d5aca773cc5d34195c8ecd67443fe1fdb
MD5 0ef33d0f4c502041cfcb968a27055270
SHA1 dcc0cbaba84d0292efc45afd29cc4cfc99f815de
SHA512 3af722a9359813f89b51b7ca07543e10c42ea98eff86d829830be8e25cedc067860b91c7d92018751fc984688ff4bcd18f3785b49cec269ccdef0fca29a75a07
SSDEEP 384:yZcI/sNXUWg1yM/azIGmYMoULMXXqih7O6R2Feohh7URo/:A/XdcHMXMnqih7TRUsE
TLSH
T10A828D725C74BC7B5DE7E149F40A3A179EB98067A7C85F40E5ECAB1D01CA698030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bc0d1b3949406018247560958295d181ebfed8972dcf020f6d7d39a917f16366
MD5 ad89c25a624946e0abbaeee69e77f48f
SHA1 7b909440f654df5cfe4cde83d9f727cfccb7cd0b
SHA512 d8be9390ec8a7c289bc9bd729a2910ae8f1ca0be4ccd77019f3bd6d5b78070476c88c7b968ca3149f09bff198afe9f7503388abbb4717e64a7112c11c338df47
SSDEEP 192:aONF6IEzQmiUyfzTGuIGmYMgjzoFG8MXXxeUP27Hw/sVU6:aONF6DlEGuIGmYMoULMXX6HhU6
TLSH
T1BE120C36AC78BC6B5EA3A944F4473A239E654217EA897F50E6DC2B1C01DF25C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f49da22e-018f-4d29-ac40-46dbfa07e2a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f49da22e-018f-4d29-ac40-46dbfa07e2a4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e6c1b5af80528dc63d08500ee1a89be09c0796b1c539f5068e9e52d2b2eebd25
MD5 f23f81dce8fc17c1479b6a6afbef1ac1
SHA1 02c52394392e9a6599a05d09ecefe73109a00d38
SHA512 e5aa64a1644794b21298c5ad4e22b10d0db5cc0eb2e0ab9d1694f48874ec92099d6acda09baf72832b2b575063e672d7209cda1f1d55116ec3b8f3a1637f3c67
TLSH
T1B641E94CA6EA014873B6BF569FF2E96D587EBC762E0BD59D00110E4E4A23B41C871B37
MD5 SHA1 SHA512 TLSH

Submit Download