49839f7bb42b54c632df81ddcce8b464df6610ba9002409ac59e45e0981fc49b

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_49839f7bb42b54c632df81ddcce8b464df6610ba9002409ac59e45e0981fc49b.html
Size 112KB
Sample260913-c1rncsbl8t
SHA256 49839f7bb42b54c632df81ddcce8b464df6610ba9002409ac59e45e0981fc49b
MD5 ebd90ba0eaba766b717e319728afd163
SHA1 56686ed001bb0151188fbd4874a74dcd2af5088a
SHA512 14f66c2885bb5956c80d00c4da4e550b23172ec02a98e3ecd281269bff1e0dbc3230a173af1596f9d3c0e080d4288c9f548a9799702ed4a523cfe026fdeef22c
SSDEEP 3072:YAFLKkMQtNQhzSek9ba9Av9Xdo0dooPYd9JuL6FS3:VWQtNLbdo0doVJo66
TLSH
T159B3C48701204CFAEFA45DB3459B486B3D2C1437AC4791B9E3FD8F972B52D6E034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338201632285811"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{EA8AE5A6-7DFB-4FE9-985E-8D580EC318C6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4752	4184	msedge.exe	86
PID 4184 wrote to memory of 1716	4184	msedge.exe	87
PID 4184 wrote to memory of 3232	4184	msedge.exe	89
PID 4184 wrote to memory of 3232	4184	msedge.exe	89
PID 4184 wrote to memory of 5104	4184	msedge.exe	90
PID 4184 wrote to memory of 5104	4184	msedge.exe	90
PID 4184 wrote to memory of 5104	4184	msedge.exe	90
PID 4184 wrote to memory of 1884	4184	msedge.exe	91
PID 4184 wrote to memory of 3044	4184	msedge.exe	92
PID 4184 wrote to memory of 1884	4184	msedge.exe	91
PID 4184 wrote to memory of 1884	4184	msedge.exe	91
PID 4184 wrote to memory of 3044	4184	msedge.exe	92
PID 4184 wrote to memory of 3044	4184	msedge.exe	92
PID 4184 wrote to memory of 3792	4184	msedge.exe	93
PID 4184 wrote to memory of 2684	4184	msedge.exe	94
PID 4184 wrote to memory of 3792	4184	msedge.exe	93
PID 4184 wrote to memory of 3792	4184	msedge.exe	93
PID 4184 wrote to memory of 2684	4184	msedge.exe	94
PID 4184 wrote to memory of 2684	4184	msedge.exe	94
PID 4184 wrote to memory of 3844	4184	msedge.exe	98
PID 4184 wrote to memory of 3820	4184	msedge.exe	99
PID 4184 wrote to memory of 3844	4184	msedge.exe	98
PID 4184 wrote to memory of 3820	4184	msedge.exe	99
PID 4184 wrote to memory of 4832	4184	msedge.exe	101
PID 4184 wrote to memory of 440	4184	msedge.exe	106
PID 4184 wrote to memory of 1164	4184	msedge.exe	107
PID 4184 wrote to memory of 1556	4184	msedge.exe	108
PID 4184 wrote to memory of 1872	4184	msedge.exe	109
PID 4184 wrote to memory of 1872	4184	msedge.exe	109
PID 4184 wrote to memory of 664	4184	msedge.exe	110
PID 4184 wrote to memory of 664	4184	msedge.exe	110
PID 4184 wrote to memory of 4264	4184	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_49839f7bb42b54c632df81ddcce8b464df6610ba9002409ac59e45e0981fc49b.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x28c,0x7ff85e7fc188,0x7ff85e7fc194,0x7ff85e7fc1a0
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,4605734167642198253,4610909429628453790,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,14212602936835099655,15307239609901833301,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,18297490069852744962,6948247728769988495,262144 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,2656755687780761227,3479128508256447901,2097152 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,13730831088135322958,4579216489522002689,2097152 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,15863060403655247684,18099247849162246221,2097152 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,988307384143134222,8884853986215070104,2097152 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9265698506707133259,8160396867343034314,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10215420294294226942,1309401918568284261,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,13559734336265858942,17022046365646784603,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,13559734336265858942,17022046365646784603,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,12398835591307760961,14766389321237268651,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,6765354330609297881,9636700240825890932,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,11933635724497125310,6768645754065358134,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3206576189550220502,1937487384061118490,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12068446155103774669,10163497815001124763,524288 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,16312165543084445843,17366129474984103951,262144 --field-trial-handle=2192,i,12807712745307342651,782580073898271241,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 486fe0820df55043be9b809958f1c941d576a5aaeb979a2f56f103d5ef887ce2
MD5 9d6f92790b5ec420d45a7b465f2489f8
SHA1 074bf4ae6cd203d7361cea435d741ac1fb6ba59b
SHA512 67495f6547e13c890d75e69889404d1a5d475c9222ffc6b0d48dcde0e06c457962a19982c85544175b1e9bde8724a2f638321725bcbca0da9748925e6c2ab266
TLSH
T15F51E8849AA4E0B0F7A4797992E0128F3E36A9CC86DF2DD50168D4B8FC4E39D83C007C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5905a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5905a3.TMP
Size 2KB
SHA256 d29f654f325cd5f2730d345330b2d6e04f9bed79ea96ae399fc37800d4f213c7
MD5 275595b38ed6adc0c256c31c224e594d
SHA1 f446321cbdff85254e98772103c82b79bd63cee5
SHA512 d2f5e3a6f142c5fc143b440046ec57bfe7f5d7a99b16978f49cf95a0a200464997a6a62b0f7b55e12a02e4858caebefa72df305245e179ea630dad768e2d8348
TLSH
T16951B7849A95E0B0F7A4797992E0128F3E36A9CC86DF2DD51168C4B9FC4E39D93C007C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dd98f7db5a2d6492c2c7e03e146a667b55c3ce69dcd3c91f0d23d4199d9dd5fa
MD5 4fd1ff81695098834965a62e68154327
SHA1 ea32ed74da3c048e4358a7c0184bad215a2c9a3e
SHA512 d02baafabca384229b8e12b5006fcc11d4c54b9b73fe857409ca7b2ee3e46f313c36373b71b2660654496c9f88fec95656ea2665324d71338dc8b2dafedd62d3
TLSH
T199414DB7C3D8876E891156F05B246E2BDE1D0A56422C3C16C9E5AF1FA3F28B4E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 633e76aec0c47811d3b5c8559947c99a15bc59a9c3aaf3d79b04c91baf53a83d
MD5 3fe1006bd0a703e78082c4f99f8e2520
SHA1 128759d3d4b051a61849b9fcd453193e9cec1518
SHA512 46f4da08735825b621242d0340fecc8cc14141643c1f07d8f4e4c1246ebaa20c20d011feb3427e3cc049e91a82b8f3890e6f2f4c7cfc3f0a2ae978d8677ef170
SSDEEP 192:sxZoRGW//fssbGmqbIdpdpHW6+WNGYapYjDgIgrJ:sxZoT//fssimJ/HbGIA9
TLSH
T14812B852AE28A97B8CCBD21DBF65BF13D6F9503251D41E48EAFC861C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dcb215a405e1de268a52166fc13b2d6e0e7dfc932102d75240003baaa05c885a
MD5 0e6fd2d754a95d6b2f5c25965443dc9b
SHA1 bfb801b71b024d54797ed05be889c0603901a38f
SHA512 47d5e147f67038505bd70266263f8fb391fe06eb670ce7c618c375c779bde3c0d6973993179c40e941dd9d113ce1824998eba695f5d24ddfedf9458b13b4f7e8
SSDEEP 192:sxZoRGW//fssKGEqbIdpHpHW6+WNGYapRfjDgIg5hJ:sxZoT//fss9EJJHbGjLAB
TLSH
T1A322C852AE28A97B8CCBD21DBF55BF53D6F9503251A01E48EAFC8A1C05E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7ae571ce10c668eda7c6aca72c7796e8ea9c7a7fc9719c8c4dc51825f2038857
MD5 9f42fd62421464c67175ac3a55306653
SHA1 abcb6b3115f5edabb936665ddfc99800b30080f7
SHA512 83035b35a21cf9ba2a9b4e97e5c901a51639c6a32376cab3ed4c99e7f5d81c602a1291f212669ad448597c8366e35a2b7c0edd14326e08bcba36e227a82b768c
SSDEEP 192:sxZoRGW//fssKGmqbIdpdpHW6+WNGYapYjDgIg5TJ:sxZoT//fss9mJ/HbGIA/
TLSH
T18C22B752AE28A97B8CCBD21DBF55BF13D6F9503251E41E48EAFC861C05E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5720b8c131f098d9db19872056802b39bcbc3c20bb9b3672848009da3a3ba2e5
MD5 298941ffd744e3b3dec4c81c288b650b
SHA1 b7a3610254d7d8cac774ae3f228001ca29ce0d0a
SHA512 4dfd2fe6e5290649cb4fbb3bc242c42b5d698398335e46623cd9bf12ebb7875a99e1e7adf49a129f97244db1146536f59697c4fd21e5c274487ec0fe4e981226
SSDEEP 192:sxZoRGW//fssKGEqbIdpdpHW6+WNGYapSjDgIg5hJ:sxZoT//fss9EJ/HbGuAB
TLSH
T1C422C851AE28A97B8CCBE21DBB55BF13D6F9503251941E48EAFCCA1C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 03d6878d4c682c8e10b70c05f4fc54c0c2fa722371d180bd80cb2164dc8d6430
MD5 aa006c3907a035dddeac4c8e93cb4f85
SHA1 4a89c7298ecadf8036a9dfd0c0cb11034af92ddf
SHA512 64ee79958d6918d88291e791dffbbc784ad81122c7032b11cd11f9589a21c5d7df06d335805ed49c73f805bf36a6bd153b8a21af2cb0805f74990fdb62dd5210
SSDEEP 768:tnWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7aro4VfeDmRC:tnWPcLKWvKeEeu1jaClLiF7R4VWDmRC
TLSH
T179C2FB3F640CCB7E5FC01A9DDC5A6FA76E9802C79A644D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 826af197191fae1065ee44f81d470e4aa00cd931ad1c11c52fddacfef8df97d3
MD5 f9df8495f764d6967b3107ad5d75f3e5
SHA1 778e21834705e5dce11dbe0af2ff845b461fff67
SHA512 85b132cec5a08d62c4213fd10668bbd5476436d703b2f002b79856727e7092a7e84c5f4066a75ebb8bc15da76f2d2b643e03ad5b01693e3c2dac6f8ee5c32ebf
SSDEEP 48:K036j3Z5JibhMRISHiK9H1tixnyYkV3LyLRAthrvzMb/KXIS5MK9Z1zMxxcYKbRd:Kc0AKla+CaQKTSMr6KIIS6EwKRyXz
TLSH
T1F8B1F41571BB535038BD294880B6971E528232B3365CE62BBFBD10F64D6EE484DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 d00dd0302124d54ac7e4293e3dbe3e5e2f37d2d8741cf5e0ca221565de2ba4be
MD5 423f0f8d53a68d5859aef65ae9fbc94e
SHA1 4f91cf93ac2c78aed54c80a6f0da94c3787959e7
SHA512 223a1448ac977d0aa5f457631b86f9d76be7852e301f3b94f63d9855383f1a45ff7605468cb4a82a16fffa291fb14f50228e63fc1ef000cd746e50c73bc2746a
SSDEEP 384:EsNWInV716PcuzIGmAs8PDX/iRsa+VYRd7Ul:EIV7KZLlL/iRhgQ0
TLSH
T157626E72AD78AC6B9EA39650F54B36239EB8416796C83F94D6DD5F0C01CE39C130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ef64ee1ab71d24618bf93ed868c5fa3177d3d10c6bbf8643f28fedc84ba098fe
MD5 f4602ba12ebddfceba1d0912799a0344
SHA1 e721d3ab91517fea44ea21e5d3545060bcc1a675
SHA512 dd9e435c8c467b5aaa20e1fc1da5a6f96fddb1bc955742d19b584bd7b43b804103e4171445b3d79b767e05ceb3040cf884e96de92e258b72e6ec7b86b25343d5
SSDEEP 384:CZcIYsNWNnV71oPcuzIGmAs8PDX/iRsa+VYRd7UpoU:wY/V7sZLlL/iRhgQ4b
TLSH
T1F7828E729DB8AC7B99E7D640F84B36139EB8816796C86F50D5DCAF0D00DE3981306C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1667d8606af953276466a947306e7daa24726c88305e9d15ff98e6555fbe0647
MD5 ee1a3d2062393e83a73a6a13f4709dc8
SHA1 a2af5b03d9f79f62b7dde991602ab6269fa28080
SHA512 b3fc9a6d444df497f6c195393f61888ee8cd541e123c88bbc05a7fc5ad56682eccf8f06f610331256bda8f115536109029932f687c118d8ec2dfc19b38e4d6b4
SSDEEP 384:IFiZcILisNW8TUNTUlIlUnV71oPcuzIGmAs8PDX73iRsa+VYRd7UpoU:IFQePwgIV7sZLlL73iRhgQ4b
TLSH
T197A26C738DA4D87F9EB79B51F94A36138EB84067D5D8AB90E6DD9F0D00DA2980307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1dadc3511e9608d529f5a95fde5bda06239d949dea19852fbac6733b7a6a494
MD5 29b25e480aa474141b291899b1bdcc16
SHA1 34fb5824b1e9d68966e68e34952718a9a86d0d58
SHA512 933e076c0bc4d20daf86edbfb7d87b61ebbe4e00576f7ef66b96f6395133ced28ba5f42ab047b452c292e1733bbaea6ff37948db897e9f5cf3f184e24a052e1c
SSDEEP 192:aONj6IE7QmiUycwTPuIGmAcjzor5RZSC7sTeeU6:aONj6Dt8PuIGmAs8Rs6eU6
TLSH
T12F02EA35AC787C6B9FF3AD09B4873A23AEA4112BE6952F54DAD81F1D00DB25C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fd2770b243cd571c6665c1cd14132b6f945236bd99e57a787a9c43fb45c0f0bb
MD5 704230ff8e6add52089cffe51d22df37
SHA1 a5f24481097a4b0dc9e316775d5b123d27a0d28a
SHA512 5b5336e2a3f44b53096902158496c3213df372404f432ce92eab4c9502366aafebc741e769670ed903d74f30854cdbfdc9a58613de279cafd44a38bef7b18ce7
SSDEEP 384:FZcIYsNWUnV71oPcuzIGmAs8PDX/iRsa+VYRd7UpoU:9Y4V7sZLlL/iRhgQ4b
TLSH
T1B7828E729D78AC7B99E7E641F84B36139EB8816796C86F50D5DCAF0D00DE398130782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 18691eb2b829a01749171ca45b512adab642cac4e96343230c5d62712e456a80
MD5 79baac88ff6348914244515e7ce26838
SHA1 cfe525d7d5e9ab4b7acf6dae4de5333faf89feef
SHA512 1bd4506724820fc66ed3eac89b46e53da875ce7d8ce96ae54c053e5c45493ed0d59a7e47146680cb04286dc2b805d34ddc695259778265fd88d3a7070f608e8e
SSDEEP 192:aONH6IEtQmiUykwTnuIGmAcjzor5RZtDXj27HC/eBU6:aONH6DrenuIGmAs8PDXQHRU6
TLSH
T1C8120936ADB8BC2B9EE3A944F44735239EA94127D7886F50D6DC2E1C01DF25C530A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

269ecee6-efc9-4ef3-b8ed-667964fb6e31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\269ecee6-efc9-4ef3-b8ed-667964fb6e31.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a48d9a7980de63d1d2b64d0b4b228ad892ba9e8d649a60608788551c9e855f40
MD5 16c1586003779f8b3140617332076205
SHA1 e194db8e599da7ebd9d4c3bf24d2c3ddf63185f7
SHA512 596d8ae92a3adc36b2b77a166968f13c1aaa2e6ad3cbe12cba402c450d118d24939fc5a70122a437b9cb19906283bffba947a10a9f656c35c889faf0867cdbb7
TLSH
T1EE410559A7E91148B3B77E6AABF6A46E487EB8372F07D05D10010E8F0762A40C872737
MD5 SHA1 SHA512 TLSH

Submit Download