e2870c02ab581b25eb32bc64c4ecba1403129377eebbaa66683078a8979a3317

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_e2870c02ab581b25eb32bc64c4ecba1403129377eebbaa66683078a8979a3317.html
Size 113KB
Sample260913-cgr5sadf76
SHA256 e2870c02ab581b25eb32bc64c4ecba1403129377eebbaa66683078a8979a3317
MD5 6eb99b6cbb85f631ae9ffe7dfd3b9af3
SHA1 e5972cc4d9947d4506d15d5dfbd801916cd190e6
SHA512 d94a8bef1a3c8d81f510fa141d461e2c21262aa7851d9899b05e1dd0dd17110094d70864db16d72eabdf87a837b4575489d94554c630c510368d240c96e9e58f
SSDEEP 1536:pPxaYn+hqB+gRvjQBeYlAajlZQITtHNoExotN2bEaoxbEaoCMsME5PX44:BEFQwN232doxdoCMsME5PI4
TLSH
T11DB3C78712204CF9EFA54DB3459B086B3D2C1437AC4791B9E3FD8F972B52D6E034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3864	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338386899157047"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{AE01BF44-1592-42D6-82A3-A7A0CC29686C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 2184	3372	msedge.exe	85
PID 3372 wrote to memory of 3864	3372	msedge.exe	86
PID 3372 wrote to memory of 2140	3372	msedge.exe	87
PID 3372 wrote to memory of 4952	3372	msedge.exe	88
PID 3372 wrote to memory of 2140	3372	msedge.exe	87
PID 3372 wrote to memory of 4952	3372	msedge.exe	88
PID 3372 wrote to memory of 4952	3372	msedge.exe	88
PID 3372 wrote to memory of 396	3372	msedge.exe	89
PID 3372 wrote to memory of 396	3372	msedge.exe	89
PID 3372 wrote to memory of 396	3372	msedge.exe	89
PID 3372 wrote to memory of 3468	3372	msedge.exe	90
PID 3372 wrote to memory of 3468	3372	msedge.exe	90
PID 3372 wrote to memory of 3468	3372	msedge.exe	90
PID 3372 wrote to memory of 3084	3372	msedge.exe	91
PID 3372 wrote to memory of 4188	3372	msedge.exe	92
PID 3372 wrote to memory of 3084	3372	msedge.exe	91
PID 3372 wrote to memory of 3084	3372	msedge.exe	91
PID 3372 wrote to memory of 4188	3372	msedge.exe	92
PID 3372 wrote to memory of 4188	3372	msedge.exe	92
PID 3372 wrote to memory of 2296	3372	msedge.exe	97
PID 3372 wrote to memory of 2444	3372	msedge.exe	98
PID 3372 wrote to memory of 2296	3372	msedge.exe	97
PID 3372 wrote to memory of 2444	3372	msedge.exe	98
PID 3372 wrote to memory of 2908	3372	msedge.exe	100
PID 3372 wrote to memory of 2560	3372	msedge.exe	106
PID 3372 wrote to memory of 4980	3372	msedge.exe	107
PID 3372 wrote to memory of 4536	3372	msedge.exe	108
PID 3372 wrote to memory of 1292	3372	msedge.exe	109
PID 3372 wrote to memory of 1292	3372	msedge.exe	109
PID 3372 wrote to memory of 396	3372	msedge.exe	110
PID 3372 wrote to memory of 396	3372	msedge.exe	110
PID 3372 wrote to memory of 5036	3372	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e2870c02ab581b25eb32bc64c4ecba1403129377eebbaa66683078a8979a3317.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff91e7dc188,0x7ff91e7dc194,0x7ff91e7dc1a0
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,14120308394279970405,5515501488547622907,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,11666795006120471924,16790279902081218100,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17889741776767099043,10042349550534547452,262144 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6240310112172629661,4106953923304862649,2097152 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5262502147361800450,16457606739271991426,2097152 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,4378682671411804918,2763703566966341897,2097152 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,924702410095432577,8811379314681538838,2097152 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,16310971320279791157,17522210195489183040,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,5354167811538150673,11910726735426264260,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10319355979541107933,6457344683006254133,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10319355979541107933,6457344683006254133,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,14026227184098962097,3762643766456633461,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,1764636630558136148,10670009521368476508,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,14739110115054300544,14344060631431455935,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,12158795161418837321,15625689446583296829,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13790945486739963795,11989853500415133598,524288 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,3381407011510492223,4813201137801629182,262144 --field-trial-handle=2552,i,9390498348807328070,1022180930600531071,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8189ce7443dd90b2e307d2e7c9d95c0691f309a4a12e9ebb765878b822b8438f
MD5 314829f42b354aada6b39bfb62fea1c9
SHA1 f26749ad4157dc3ef8811c695d566b98ee16ad2a
SHA512 e1095d70436444d01dbe6155dbf5d6d80335ccbfb4279a0401b905ba63b32ea481a769f505761351266636fa7a7b6cfa32eec903a8bda84e84b43c8e60e3ae13
TLSH
T122513CA13592C0D7F7F841B082DD214B3FF8D5A1458BCEE32FA4C8BA9846771C194258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59166c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59166c.TMP
Size 2KB
SHA256 4c1879059695fed911fa3c133d9ec52741ef183bf2d0a49fe571dbd5cf91939a
MD5 9001aa475da0434e085504b0f26297d2
SHA1 5b1402f0c6e6cbb3133a695d03a255fee3490ae5
SHA512 a9c4d2e65043db0912a90208fda107a5cdda8f2d72f8a3e41401c6310e107cf6d8a539cc46f6a933a00780d6f3fc3ba2f83cb8bb12d012cc0a2cbbd0a52cd9b5
TLSH
T1B4512CA13692D0D7F7F8417086DD614B3FF8D5A1458BCEE32FA8C8BA9846771C194258
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6da64ad1f77efe9016f93d5929122cb4226ac9fed9087a52b4777c212a44c85f
MD5 136f0125953ee59320d12608e8e52e1a
SHA1 331e4a7402d491aed4ebb16628ad10562ebd2413
SHA512 b828a81f648a27e42242a0a44f1face59087f83fb3a220243e3669bd0018b2b96a0b4d28a5c546159e8752f649da59489bb579c6812cd59b669fe9ae255b23c1
TLSH
T1D6418DF3C3D5967E8A1156F49B246E2ADD1C0A1A422C3C16C9F4EF1FA7E24B4D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b79bbba7a040cab3365f8ed7dd1e535e109ecbe6498325f16d1ac3bffa3ce069
MD5 fdc335f68fcd435be8b3570a02d92026
SHA1 2fd67a8bc21e5c21fcc235d856f185c96c88da99
SHA512 029dce57b00cda52dec91209a57659254d4f80b717b92284320f902685240a818f30e02256d6ed40a5d70c07fa7eb056d1b1958c631ed672fab07c1f4791b913
SSDEEP 192:sxZiRyWOb/fVs+iryIdpdVHW6+WNGYapYdCIgrJ:sxZirOb/fVs+inTHbG39
TLSH
T14C1296166E28A97B8CC7D21DBB29BF53E6F9503261D41E88A6FCC51C04F66DD124780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c4ddbfaaf6991ed5d92d87d5d68aed3fbff7829ecb54a2fbe67488cc7f3fe771
MD5 9f53a29f970e502881e24fc1c415d0bb
SHA1 e27696d10dfd14637e43ac767854d1cc490ed086
SHA512 bebaa5a7e88577fa4912b2365f80b38313d861afeb92c6f1ca3921d55a07a0728c4edd8959e9ddb29bc6a4a2e025806a0c66d6a9adc7f50bac874db836e37851
SSDEEP 192:sxZiRyWOb/fVskiryIdpdVHW6+WNGYapYdCIg5yJ:sxZirOb/fVskinTHbG3s
TLSH
T1C322A6166E38A97B8CCAD21DBB29BF53E6F9503261D41E88A6FC851C04F66DD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 46ddb45b12181c895310359cfb2cf5cc9c7ecd85fa3f12b28dfdf2e6f4668e02
MD5 6b944f97b33216478ab2d529fd9c7f74
SHA1 7616358e6560407ab0ce534e0bb24f9955d784ae
SHA512 4a3fcf8e1d59515634578102c910dedc57380c4dc67839151a3614582e2f56aad5a5400edfac2f9314b8323a7bd373be6f0e5915340d65c3f3ded297ec3c4251
SSDEEP 192:sxZiRyWOb/fVs0iryIdpdVHW6+WNGYapgdCIg5YJ:sxZirOb/fVs0inTHbGjm
TLSH
T10822B7166E28A97B8CCBE20DBB197F53E6F9503251D41E88A6FCC61C05F76DD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3d17a2372ff510736205d9b2310e28c4a860fab11632bcf947d9b879376d9c91
MD5 868ddcc726b17a6ae3e1186717179c8a
SHA1 8fb575c743c5192e97cf15d013ef719e66108d64
SHA512 dca2a7c9da7ce33a2f918f7d1f1a1be32772e77fc37129adafdc228f792da3259cde4d7beea4c6b33d5edbcc320b10268403f1b5e2a8f5b7b58a6ca6a659e72b
SSDEEP 192:sxZiRyWOb/fVs0iryIdpHVHW6+WNGYaphdCIg5YJ:sxZirOb/fVs0in1HbGYm
TLSH
T17522B7166E28697B8CCBE20DBB19BF53E6F9503251D41E88A6FCC61C05F76DD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e4871e1806779aa1337c9e4d0ef80b04b248586fd97b2de61b1ad0aed0c39117
MD5 5a012c333865c71c818b3b06ce4d41dd
SHA1 c768513a51cc63303ba31b6c6c1fec27cd08d702
SHA512 74bb06cbee0dcd565d63d86dbb5d018d231379e5c4dfbca914e171a2ce9a1883477f01fbcb47f6cd220d5dd776a68cfb4f09fdccfad6bb8675412d5dcba90249
SSDEEP 768:XFWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy74ro4hfetmR7:XFWPcLKWvKeEeu1jaClLiF7D4hWtmR7
TLSH
T18AC2EB3F640CCB7E5FC01A9DDC5A6FA76E9802C79A644D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 943B
SHA256 80980b1c5223a604614705d83c955919b7ac8287ce1a05aad149dc546f5c1427
MD5 8dde65f785d713e6d0f4b06983ef6196
SHA1 f8b56735c3dee08f0c23073246d91129a197bcc2
SHA512 d2ab4f68a10180b15378657375bdbbc54f57781b78d2352b17d6a599fe2a2ebcfb138191a992b33c1ba3621f983d014d4cc17356b818af2851b2ab856d605bd1
TLSH
T1C9113380B6F400646E49EA45C309670360B17B5F220D593213DE44F09F84C190AAE954
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b3a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b3a6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d913c4c4fcb18c1d6ecc83253a970791fcc5f63550ad763368611dc624b18d0c
MD5 f173fecbceba0e72fbefecfd3c1f1533
SHA1 74e4f2e3178dc466258bf85da5d3c3ea1bc4a1e6
SHA512 b7283ab634f9c358ee372f460ce01bdac028b06bcc37822986db10efe739f99e836edb351d275f4878d5658b1a7f18df8bf9f6c77ffa856f2c6d488b676d286d
SSDEEP 384:HZcIusNwoI9nCJ1dwOzIGmDP8ouXVPiJkN7O6R2Feo0to5:vu9QJgYsh+VPiJs7TRPi
TLSH
T12C828D729C78AC7B5EE7A045F54A36139EB8806797C85F40D5ECAF1E00EE658030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6e54bace276539a2b3165ea7a9e192db391a393187168a16e7f257afe5f34265
MD5 f11bfc793ca7ce82f46b39062db5e29b
SHA1 adcea2d4c4cd55479c8af8f0b72a8d85ae108505
SHA512 b30ea5913f542c6c1972589f03242a3a4817dda6b0fcbeda2a3cf8799344529a814201008716b50ab4dbbbfbaf5e388ae0b5763ab58eb11e514d82e9c646381b
SSDEEP 384:oiFiZcIn8sNw8TUNTUlIldI9nCJ1cwOzIGmDP8ouXVBliJkN7O6R2Feo0to5:zFQ8Bwg8QJHYsh+VBliJs7TRPi
TLSH
T19EA25C739CA8DC7BAEF79A45F54936139DF84067C6C5AB90E6DC9F1E00EA198030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 51a30dbcf70b39a871a377a85a303dce4fc6bc64e8ac039ff1705b18fd252fea
MD5 63838c8eb3d8a674ff7e235090bddffb
SHA1 3de35c5a919b1e82efe2bf72d2fcf1a095dc9c47
SHA512 2f49b5b7d34a0959dac2e8a42429dd6a8c4f3066a1480f0a0796635156f9b3e9b184ccc8b0fd87a629ccf9793ddb703153bd19d0c27aa4e77513b03e9addf058
SSDEEP 384:gZcIusNwdI9nCJ1cwOzIGmDP8ouXVPiJkN7O6R2Feo0to5:euSQJHYsh+VPiJs7TRPi
TLSH
T1F9828E729C78AC7B5EE7A045F54A36139DB8806797C85F80D5ECAF1E00EE658130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 76dda192d9b74ef9ee76db5cd8b0dab3f1a7a1f94535084a62f5d010d5c5c0e7
MD5 0231197ae41e16fe03922177990a10b4
SHA1 5e521904813b248cb5f3c0746b4e2a30bf844150
SHA512 19e5bccd850caff4aae35a662e308ed294a6aa9516dacab2b87c05900a609fcf39ad0c804929c8452c60392e62fa1f33add4d6571471cbd82f8d96f6eab71585
SSDEEP 192:aONA6IE7QmiUy+rTPuIGmDnjzorbhRUmC7s0PU6:aONA6DtnPuIGmDP8ysiU6
TLSH
T18202FA35AC78BC6B9EF3AD09F4873A23AEA4112BE6D51F44DAD41E1D00DB25C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6041594f555f4c12f8a84744237e22552aaf7dc0ac0aa9bfe67005c1a2b55492
MD5 718b33318293c1c84467d837a1fb6501
SHA1 4ff4b974bc14d7e376a9546a815c20c2a720c35f
SHA512 0afb052e495ad25bac936758ad424697676758b3771da40de923174bae76bb34a26294fa7c7c6f0c0a1d06b19522951b33f109af3e0bbaf448067d3431999285
SSDEEP 192:aONp6IErQmiUyerTquIGmDnjzorbhRUpuX8W127HP/pkNU6:aONp6Dd9quIGmDP8ouXVyHJkNU6
TLSH
T1B0120936ACB8BC6B5ED3A904F48735239DA44127DB896F50E6D82E1C01EF25C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12f21db0-cdb2-4404-ba69-162a776576de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\12f21db0-cdb2-4404-ba69-162a776576de.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 28dbd1ff4d490495d2a491c916d473b89b4eb668670fe813f37b549d066dd94b
MD5 38972af8e17d1a991daffa8f82b3f211
SHA1 c9a870d2157c49e2220f01f963b6333a656f86ba
SHA512 388e96795d18cc4d1e9dd4676d2d87188d0e2cb7af8dd51bd2e2475063eef8d61c8d3967c390e3210dcb7a155ae6f787038a3f9cd85df720093290773a3262d9
TLSH
T161410758B6E91148B3B76F1A9BF6A96E847EB9372F07D45E00010E4F0A62A44C971B37
MD5 SHA1 SHA512 TLSH

Submit Download