61cdfacc0f61acb1179b0997fbb1a4187c1201e437aa6ae4b2a7ad95b3342999

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_61cdfacc0f61acb1179b0997fbb1a4187c1201e437aa6ae4b2a7ad95b3342999.html
Size 718B
Sample260913-bta7csdc87
SHA256 61cdfacc0f61acb1179b0997fbb1a4187c1201e437aa6ae4b2a7ad95b3342999
MD5 7b7a51edff9b20fb8343fa7152d2539a
SHA1 1afab991c29e6fe7f2915cfac03896a7bc011d85
SHA512 d671c810cc92bfb72bd433bdd50fd8f956595755fea667d489ea217728a0396183cdbd9dca2f4ef2390dd5608b50fd6aa78041825daf5d7af7641f8505cad2d6
TLSH
T12301CBA7AC51893343A25064B5E2B1FDBA73F11B1A44C079B9CA40318F607EF84879DF
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338306194554917"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{8E01412A-F61B-4A0D-A7FF-58C7CEBBFD5B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3588	1264	msedge.exe	84
PID 1264 wrote to memory of 4204	1264	msedge.exe	85
PID 1264 wrote to memory of 4788	1264	msedge.exe	86
PID 1264 wrote to memory of 4788	1264	msedge.exe	86
PID 1264 wrote to memory of 4788	1264	msedge.exe	86
PID 1264 wrote to memory of 2480	1264	msedge.exe	88
PID 1264 wrote to memory of 2480	1264	msedge.exe	88
PID 1264 wrote to memory of 8	1264	msedge.exe	89
PID 1264 wrote to memory of 4564	1264	msedge.exe	90
PID 1264 wrote to memory of 8	1264	msedge.exe	89
PID 1264 wrote to memory of 8	1264	msedge.exe	89
PID 1264 wrote to memory of 4564	1264	msedge.exe	90
PID 1264 wrote to memory of 4564	1264	msedge.exe	90
PID 1264 wrote to memory of 4124	1264	msedge.exe	91
PID 1264 wrote to memory of 4468	1264	msedge.exe	92
PID 1264 wrote to memory of 4124	1264	msedge.exe	91
PID 1264 wrote to memory of 4124	1264	msedge.exe	91
PID 1264 wrote to memory of 4468	1264	msedge.exe	92
PID 1264 wrote to memory of 4468	1264	msedge.exe	92
PID 1264 wrote to memory of 4344	1264	msedge.exe	93
PID 1264 wrote to memory of 4344	1264	msedge.exe	93
PID 1264 wrote to memory of 4344	1264	msedge.exe	93
PID 1264 wrote to memory of 3172	1264	msedge.exe	97
PID 1264 wrote to memory of 3540	1264	msedge.exe	98
PID 1264 wrote to memory of 3172	1264	msedge.exe	97
PID 1264 wrote to memory of 3540	1264	msedge.exe	98
PID 1264 wrote to memory of 760	1264	msedge.exe	101
PID 1264 wrote to memory of 4708	1264	msedge.exe	106
PID 1264 wrote to memory of 5020	1264	msedge.exe	107
PID 1264 wrote to memory of 3364	1264	msedge.exe	108
PID 1264 wrote to memory of 1204	1264	msedge.exe	109
PID 1264 wrote to memory of 1204	1264	msedge.exe	109
PID 1264 wrote to memory of 4684	1264	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_61cdfacc0f61acb1179b0997fbb1a4187c1201e437aa6ae4b2a7ad95b3342999.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffbacf6c188,0x7ffbacf6c194,0x7ffbacf6c1a0
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,2036632549369991718,747851968684168946,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,12294813244242980942,14727767470779373136,262144 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,6062404550237818604,3110390484422423372,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,15302957606032571783,2921528363950752813,2097152 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17544341934162351244,8706386717907083704,2097152 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,7842345540424573547,1668105725631141153,2097152 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,4384241422330017372,12086769580610969641,2097152 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3644,i,12934357851329178301,8733648845311377090,2097152 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,12829234273753538826,9015149479141345786,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,12379382077889525626,9380992821665953116,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2177267381489943992,10655393860145429551,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2177267381489943992,10655393860145429551,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3575236392776869749,11852143238093356544,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,3126928618619003977,15042352581611664434,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,1898722959562720791,14517031275416386192,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17615259443841567452,13100252880585623905,524288 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,15081916018517896122,17732247090380895389,262144 --field-trial-handle=2304,i,6776280369914387106,9469987397768100298,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

869e7523-4e77-44cf-afc8-83ed687184cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\869e7523-4e77-44cf-afc8-83ed687184cb.tmp
Size 23KB
SHA256 453194378a59c945bf2a16d2eb62d8e34de69fd1ed372f8888d858a8641adabe
MD5 d65b69841bf74e8a7487cdfb2cd70f11
SHA1 34936f9b6005a02b35e0dcf84cb69dea6a04c3d5
SHA512 490574879734a1f58ebf87e081a220d14f8c7b3e45bd1f5720881a53ff79233452e0de68bc2cf99a52435e3d009e4126d14fd2b262e0db7c3955d623f0d234d7
SSDEEP 384:TZcIUZsNXU/5xukNpuSVy9iX5FbzSY7O6R2Feof/h7UooQ:LeD/1Nx2aGY7TRuxp/
TLSH
T1C2B217F158E7683AC9AE9347A73E2D035EBCC053B6841A40B7D86B2DCD955BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 106KB
SHA256 60ddd8fb82d1bb191614d3f7b069a86941ff6e36e96ba2c31da51f29663aa00a
MD5 0f24771de95424d604dbb8f68525c130
SHA1 3baff01bf030b9140ed0ac65eaeded3dc413083b
SHA512 adf8524baf31e6b8cd6c79e1109044060c444811d21f9ef2debb929aad6b55aa46f9c827cee56777fcdb172bf7e0f685872499fd672a955eda325e8030e851b2
SSDEEP 3072:eeJ1qvhsloUohsloUohsx4ErkQN3j5FBVuW:RWvlplpTTSjBoW
TLSH
T14CB3E173656CC44D504B76FA752707E38FA220C44CF599379A64FAC28BB323C52D8BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ca3cfd794213ef9df2431a344d6ea9e4bb9ed15d81804c7987412efa75a4c9f9
MD5 181aaaad5c1a6bacade7bd81dc92161d
SHA1 328b40f954924e48c264afd6f6ac82efcd36254e
SHA512 4dd70667ac264a2cca64caacc2ad6de1e4a9e15f57add78edf38c1d0a84e36906c03268da1dcfc00acdc3832ce3e1e4e6af9cb33ef8421f81cd493ccf77836fa
TLSH
T17D719BCA645A4AB4FF4F9278A9D1108F3AB057E1BF435D223DBBCC3871567858338258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d1e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d1e1.TMP
Size 3KB
SHA256 3b7cf21a2b99d8d29eb75caa3e58c804e9e7d36dfd0519592499c502fa26d761
MD5 5c6df10924d19693ad87a10882b9700b
SHA1 a039bd2e830d3a70ba0aff7880a1def274b219a2
SHA512 074fe05164d364bd4b79c74ab8038e4525dc34692def4c304d74b9d33c16efc7952fcf28cc7c1d60bcb7ae11543b15c0116ac6dc1ee16e7a6f8a71932c074eb2
TLSH
T1F261858E556A4AB5FF9F9278A9E120CF3A7056E07F436D223D7ACC7970263818338354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e2205e5f124410ce44f46420b96190c112e523e51fd8ced8da3941b4dc3cee34
MD5 1fd24486f7f43fd20aef94c93a7808bf
SHA1 661431a4dc2749d0fe0299c9fe517e96415d7a36
SHA512 282bbdad85f0519bd077dd1baeca8cf2b06e6676850a38ed94e8f12b561ec2c5b1fd3aa031dad6e0f679c97933662df7ca6a5244f70d259428ff58a453fb4fc5
SSDEEP 48:YALlNxO6S16u6L6Uy6C60m6usBzBrQs5ArF3wszsLsJR0sGf7WgtBRwskEsvCKsx:DXOTRW0Fy0zBrxArFLscRC7xtBmzkNwQ
TLSH
T1599170B2C3F48A3ECF2151F15A1CAE2ACD1D0924C6183D2AC9E9BF5B93E2475E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ee2362749f45bc28667b83f359c002fb92a3a071d3a929a8311cb157cc5373de
MD5 4b95cb7565a8a8e9ee595aa8c861ab57
SHA1 3d9fd5721d0e29a83718909f20525d444067088c
SHA512 32d299fd6161af93743469272a011ba54a534fad4a1497ac35d4448a6237ee6369d9be69d39db0b561bfa0e07f09989fd80e730bc47a9b39fc48db34d339330a
SSDEEP 192:sxZbR1Wk/fxsYOIdpdeTHW6+WNGY3RU8IgrJ:sxZbSk/fxsYfiHbGE9
TLSH
T1D122C8516E28657B8CCBE20DBB25BF53E6F95032A1941E88EAFCD52C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 78e1a6c254e32e6cd36abb097eff7aaef79eb8ceb873e8fc19f5891ba7c61000
MD5 efad3e105fbe7ce5fe08b88a8f94d5fb
SHA1 eae924a6f3055210a9c7c48f1f71b58491bf5121
SHA512 0a9fe736f4b3d29bd2c7d8d95b89d9226fce3cfa9e71a27f11cf5eb4600cd34849cb2c58d76e08e586e0b3603dfe6f5d7577bd7c77e2da97b67deff0d36634e7
SSDEEP 192:sxZbR1Wk/fxsdOIdpdeTHW6+WNGY3RU8Ig5WJ:sxZbSk/fxsdfiHbGEQ
TLSH
T1B222C7556E38657B8CCBD20DBB15BF53E6F95032A1901E88EAFC962C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1ea5382253625db2eb58e6e524e2114cbbadb7ff2341369db2f493d16c05dfae
MD5 5865022ccc1fa99e4707d9c84d08db45
SHA1 2362307fc57ce34a34346d7af6e6ae3185210c46
SHA512 1036ca066d94c6471064ea36d52082ec8078d88551a22a7e55319c328a0026c95555283781e5e710779182539cfddeeaff22b828e67c5fd2dcefab5fa9b020ee
SSDEEP 192:sxZbR1Wk/fxslOIdpHeTHW6+WNGY3eU8Ig58J:sxZbSk/fxslf0HbGnq
TLSH
T13422B8566E28697B8CCBE21DBB157F53E6F9503261901E88AAFCD62C05F7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6704050ea1c6acdf64a483040b95095975c2437c72aa8ea7b32d8c554702f0d0
MD5 263d3348ad69dc4b30faf6bb79a38a1a
SHA1 bd50c3b23533ef8d635fef20fb1b2da4d25df37a
SHA512 03f851cfe0bbfadbecf03ae5ec57318b4a4f857b9ae7455c05bc91d56c9c9bb7ebd4acc7f002ceaa6da1acb5700db86ca34ab96c41d12e3bc823c128a8c340bc
SSDEEP 192:sxZbR1Wk/fxslOIdpdeTHW6+WNGY3cU8Ig58J:sxZbSk/fxslfiHbG1q
TLSH
T10122B7556E28697B8CCBE20DBB157F53E6F9503261941E88AAFCD62C05F7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 eb6424a79430d2ef3829feb2ab3df859c5682c6c2ab8fb429f46e90e590d8e4b
MD5 973d80395d907fa5bf4726b5c6e58e6e
SHA1 3576c2e63c8ed9c961ba607ee88d7f1996bc99bf
SHA512 5d8dc22fab9f040649dd5c227d3f025c7a98b7eefd1edf32587bebefa98db62a60b84135a935f461faf93e0b0d28e1c583c9afa99898035ba8e6071a9f2236a1
SSDEEP 768:eu30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72FrolZM1b:eu30AbSWvS2l9u1jaLmLZ12+Cb
TLSH
T13DC2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796644D4047FA944C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2f9daf94d652368f8e2c5819f70eeb05fbafcd8320c54a59e02804e82b4c2595
MD5 3fb4f35d120f79f051ae7620fc4c32f9
SHA1 b82959471daae42876f7f3e5db9b8d87fcf6011c
SHA512 f3c3b1d4311edd76460eaf1621bbec3b601263a1a7cc6accb17fd14b3b6eed922854f1e4ce6194ade0a4cb8d57e1bf6729e3fd6b2a8b230d2370d208ff6ef192
SSDEEP 384:VZcIjsNXD/5xukNpuRLy9iX5FbzdY7O6R2Feof/h7UooQ:tj2/1N62apY7TRuxp/
TLSH
T14F828D72ACB8AC3A5DE6E155F40B36139EBC80A3D7D81F80D5EC7F2E05D9594030A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77b5260e78ea075384d77e0c75388aae8b43a0e2e98d53f73e939475debbe3cc
MD5 79ae3ddea1b25cb8f9cd88fbc4c97b0c
SHA1 688169667f8a53edc7aac3f2e6752c856f458c63
SHA512 972c22c9f024532cbb2618cc5022b139ade8d337ce4c969269d3979cc227398c008a638cde04d708ad5f17abbc1fba4b284c62cef4db14d7fbc5513dfa44b276
SSDEEP 96:gqONkEQsjpfuMVwptaL5ih/cIPURHl8h4otop50iCDgBIPuva6zx8X5FxbxLYvir:LONM6AmwprQmiUysE6siX5FbeJixNU6
TLSH
T12B02E935BD686C7B8EF3AE49B54737235FA5116BEA902F84C9E81B2D01D769C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0d292eb775e8c151ac1f5a0cecb28dad8281d9cb3949c94e4c76ab9208bb265c
MD5 f7989d0df484e4cc15860c7bf3772675
SHA1 f1b6868f7611a25ce34041690306b363aef18ee2
SHA512 92c1ddfbf8ed438a20da91fa3cef9ba722932bcd8c2ded3fdba101d12b32d88ab13708b89c0311d9d5a8ce7c180eb82e9648e3a0c44e51f582db774d3dc2876b
SSDEEP 384:VZcIjsNXU/5xukNpuSLy9iX5FbzdY7O6R2Feof/h7UooQ:tjD/1Nf2apY7TRuxp/
TLSH
T173828D726CB8AC3A5DE6E155F40636139EBC80A7D7D81F80D5EC7F2E05DA598130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 66c50fad262aa3087871e5ae056a8cb7bb9ee4e58c1af56423b66366c50718f8
MD5 0b6c533087e0832aa0a723f1a3bf1896
SHA1 9fca79163883c6cfaf318cc71f53a95a4ab68c42
SHA512 c3fdc30b4bc6e59f0d41281c8492ea4cf698b8257b4e31d1f561eb18fee5267d32dd35ad9a6eadbdd98cc6c5993573c7709fd2991d66130f220bee6de9abcc68
SSDEEP 192:LONS6AmwptQmiUy9EusiX5FbzQeHlRZ/uU6:LONS6iprrusiX5Fbz3YU6
TLSH
T1A0122B36A878BC3F4DD3A554F04735135EA55167DB946F80C9EC3B2C02EB19C530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59b50691-5668-4ddc-8e7d-e39e2fb20dd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\59b50691-5668-4ddc-8e7d-e39e2fb20dd0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 85578a3c3f297bbea16275abf09fd30e3ea13b3d19288e4c5422bf1c2085b315
MD5 5410e9134120b4eeb55bddbeb3eaf2bf
SHA1 22db77effb3b84fccf6a8e333649459dea3dae21
SHA512 40445fd808b19fb86f23dcc906c0af96d97e787bcf1394348a098bde9f27ed12ba6870cf6563502fc28754a0e83c06807815a26b37c0438bff305d1312ef9088
TLSH
T197412998A6E91108F3B76F1AABF6B96D487F78372E47D49D00110E4E0626A40DC71737
MD5 SHA1 SHA512 TLSH

Submit Download