19eb38d43641d2cb21dc0b7597864772c8ac37831e9930def356f7c7f3c5d151

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_19eb38d43641d2cb21dc0b7597864772c8ac37831e9930def356f7c7f3c5d151.html
Size 18KB
Sample260913-htmcysdn8y
SHA256 19eb38d43641d2cb21dc0b7597864772c8ac37831e9930def356f7c7f3c5d151
MD5 bd888405e6f82e752d553cbc9a4684e6
SHA1 5a70c94e603929b9ea1333f5d7a90709c5263cc4
SHA512 b99d965a6cb912fe381de9876e6279bbafb2309439bf6a2986d3193c686bd5d59ff6b0dd2851acbee909d8c71f6f721137d3f2ecd1138e85c88411d5b4f08bb1
SSDEEP 192:FvLfWLZRTrgY9gyPxTShA/mch6I/9MX1MNQh55K0w0GLd8oz:FvLfWAMd3kzoQxw0md8o
TLSH
T17F82737294F0A477519781AA7DA17A2EBF83B107C60D8844B2EC079C1FC7ED69C9319D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	yandex.com
22	yandex.com
26	yandex.com
30	yandex.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337921440569161"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{89BA4206-053E-4C34-9FED-C75E75822D43}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4348	3760	msedge.exe	83
PID 3760 wrote to memory of 2040	3760	msedge.exe	84
PID 3760 wrote to memory of 3764	3760	msedge.exe	85
PID 3760 wrote to memory of 3764	3760	msedge.exe	85
PID 3760 wrote to memory of 3764	3760	msedge.exe	85
PID 3760 wrote to memory of 3972	3760	msedge.exe	86
PID 3760 wrote to memory of 3972	3760	msedge.exe	86
PID 3760 wrote to memory of 5036	3760	msedge.exe	87
PID 3760 wrote to memory of 5036	3760	msedge.exe	87
PID 3760 wrote to memory of 5036	3760	msedge.exe	87
PID 3760 wrote to memory of 3984	3760	msedge.exe	88
PID 3760 wrote to memory of 3984	3760	msedge.exe	88
PID 3760 wrote to memory of 3984	3760	msedge.exe	88
PID 3760 wrote to memory of 4748	3760	msedge.exe	90
PID 3760 wrote to memory of 4748	3760	msedge.exe	90
PID 3760 wrote to memory of 4748	3760	msedge.exe	90
PID 3760 wrote to memory of 684	3760	msedge.exe	91
PID 3760 wrote to memory of 684	3760	msedge.exe	91
PID 3760 wrote to memory of 684	3760	msedge.exe	91
PID 3760 wrote to memory of 1064	3760	msedge.exe	94
PID 3760 wrote to memory of 1064	3760	msedge.exe	94
PID 3760 wrote to memory of 1064	3760	msedge.exe	94
PID 3760 wrote to memory of 1308	3760	msedge.exe	96
PID 3760 wrote to memory of 4144	3760	msedge.exe	97
PID 3760 wrote to memory of 1308	3760	msedge.exe	96
PID 3760 wrote to memory of 4144	3760	msedge.exe	97
PID 3760 wrote to memory of 3720	3760	msedge.exe	99
PID 3760 wrote to memory of 1960	3760	msedge.exe	102
PID 3760 wrote to memory of 1960	3760	msedge.exe	102
PID 3760 wrote to memory of 1960	3760	msedge.exe	102
PID 3760 wrote to memory of 4812	3760	msedge.exe	105
PID 3760 wrote to memory of 4500	3760	msedge.exe	106
PID 3760 wrote to memory of 892	3760	msedge.exe	107
PID 3760 wrote to memory of 2144	3760	msedge.exe	108
PID 3760 wrote to memory of 2144	3760	msedge.exe	108
PID 3760 wrote to memory of 4648	3760	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_19eb38d43641d2cb21dc0b7597864772c8ac37831e9930def356f7c7f3c5d151.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92f11c188,0x7ff92f11c194,0x7ff92f11c1a0
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,4050663747699490032,12689220993502733627,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,11800593422394573788,7982049466134172800,262144 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,11804202971662618823,3336240141004741707,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7475595889786433457,11549000732052314562,2097152 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3255908486302855817,13873513881012423883,2097152 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4175027356317587936,14189869663441119260,2097152 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,4914908623836980105,3203842751860944286,2097152 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5028,i,9451286130313609632,11255533550848229882,2097152 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,1005208272827846137,3687429445538992636,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,8639367538783884824,16185204514911851148,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,4734126360241828486,1454446090015641645,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,4734126360241828486,1454446090015641645,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4272,i,3181446225664770760,3567627244956204116,2097152 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3165954213274790946,4818831077589518552,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,15550857525372645746,11188069560587096412,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,10724036582983464722,13207677709825931091,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,3304530045527789417,9904830098229184909,524288 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,123863202607346270,2154451765723680300,262144 --field-trial-handle=2148,i,3177318456021029696,4111898088852938806,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 720f20c459f288bf2c47cdc0eeebead74a9ef66676e50a77bf07f31340aacaac
MD5 61f1a049d54667e7080bda49b07b37ae
SHA1 c86a5000b9d74bbaadfa0e5d8759a424e86487ed
SHA512 de5ff9e94d36a5a9554a747a1afb96691e5e63943e6f268247c573cc85abe68e8e64250244b9e970c859570aec00ebe9b7fc53f0e1ebd5ee0dd4e6f006c7195a
TLSH
T10B618385F7C04050FB580E729EDDA69B333A628F598B2E933068D4F9D886B512D27DCC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5925ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5925ce.TMP
Size 3KB
SHA256 669ce066e4f86835e5e01f059e75f45249c0db7fd41ef16c56764cf8021958ca
MD5 b4f15c92b0e15961f39dd385a6b36c39
SHA1 605ef8373209163e6f7ca1217f9f5833680036ea
SHA512 879aa66d9c4e76ad41ee231f8e62fb45db27abe3d12d4a450b04ec5fe2cb5af00260ecaa8d4aabe298abf5b6b083bc074957460d5b2b8b6541ddab3c6369e4c2
TLSH
T119618185F7D00050FB590E729EDD969B3739628F598B2E9330A8C8F9D886B552C27DCC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 141ab9eb43d2afc7af49347022e92777de60df2f2afb80900a9856db8939e82f
MD5 37f8b606b0c31221a722981ed84b132f
SHA1 97bbbdef2c0db2abb40bcb5b10571853c92e002b
SHA512 1f9d0d32be11e20adea29f46193ea31f282310bf217446119755e1ea2e64f93bba967aab81a33c49077006d801851290507c5640628e0d2e248daf1bcf9761c2
TLSH
T1EA416EF783A0477E8A1556F0DA286E1BDE1D0117436C7C6589E4BF2B53F24B1D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d0bc14ebec84632705fdc6569c50a53474d121db1f21d667bce9c897431af6da
MD5 141bbe0eed5a16e7850ef70d8070e130
SHA1 c48db2fdfd34bf3862eb7f9dfc3c90ac5e703667
SHA512 48f017bf72266ad0598b7512b8f8a05bafbd7c783f70b208bc8abcbb317cb0efbf2c241eddba8a4e223052b1da5c32d804c37b34645502161779dbfb8301d414
SSDEEP 192:sxZaRKWT/fxsX0eIdpd6HW6+WNGYaQ0neIgrJ:sxZanT/fxsX0PcHbG/W9
TLSH
T11812A6516E38A97B8CC7E20DBB15BF53E6F9503295941E58AAFC861C04E7ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9dfb513152b38750e11d2260803028503ba4ebc6d2f78129ebdc6b83f92e02bd
MD5 24b2112d6cb51478161c7eb67803cb07
SHA1 fd8ee167ace4e5e0cd4c107a2372b4701828be81
SHA512 90e87fdfada8f148838a7c74a4a8c9c2f5fc7562374c8b5b6a681462f1f21529c661a0c13105a53c3de440588e25e5f530bb52f4d755905ba60969dcf0bb60dd
SSDEEP 192:sxZaRKWT/fxsc0eIdpH6HW6+WNGYaf0neIg5OJ:sxZanT/fxsc0PaHbG6Wo
TLSH
T1F522D8526E38A97B8CC7E20DBB55BF53E6F9503255901E58AAFC861C05E7ACE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c7b3f3652d11ac102b1449d29cca83e2a20da1501193612a8ce0de5a25236504
MD5 2372c0376e94c1a1b9f7418bfa8deb6c
SHA1 fd9e6f3f03bd228e48f697883700857d106321c0
SHA512 8537bf82b01ce042f6756a4d6b7b5115ca47130605fd9225986729a93ab5849b0deac760217fdad7f3d642bb8fb26dd1208814ebf921a5b138cd8225427bc8d4
SSDEEP 192:sxZaRKWT/fxsc0eIdpd6HW6+WNGYav0neIg5OJ:sxZanT/fxsc0PcHbGKWo
TLSH
T15A22C7516E28A97B8CC7E20DBB55BF43E6F9503251911E58AAFC861C05E7ACE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5314beaee68e6f26ecf09fadcf6ff419caefb26680e7c3ce9716318898e34837
MD5 676c6740a31d473e204b0130718d22be
SHA1 aaf97d8e82a741f073734d2afa1fa9f3a9f4db28
SHA512 84843c7add5b9048909b697af300a5f22c837255dac46106912f87d7b25e42a672ad077342e11f3df2ed5052287ee2680f092819afbd09c73f3e9c5a64dbcff8
SSDEEP 192:sxZaRKWT/fxsM0eIdpd6HW6+WNGYaQ0neIg5cJ:sxZanT/fxsM0PcHbG/Wa
TLSH
T12C22B7516E38A97B8CCBE20DBB55BF53E6F9503295941E58AAFC861C04E7ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 412cdb149353188c0d03583f1f7f71823cb2f3e0c93366bb853470c68ea9bbdd
MD5 ef6ac71a56b4554d31d607030bbb60e4
SHA1 480eeea3f9ad5b8be5950f06f67dbc96135b6ddf
SHA512 468279bfb5c20ba4689b572742309018a910728109faa85eb37cc0a599dd0b88a20e5cdf92d43657b43dbd502e125038537e8a0cf3f2314a2b3728037f5e5d9a
SSDEEP 768:r8yQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3YroqZJE:r8yQRbrWvvlpZu1jaXKLf33jqZJE
TLSH
T1A0C2EA2F640CCB7E5FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eb3f3e33a48a1ead3fb25cfcb20b95c072c6479d214f61aea823c07360d50201
MD5 b7c9aa21898ecec79fd0413a1728cebf
SHA1 1771e259c6d0acdc9b1d33ccc1e7a69dcea17ecd
SHA512 2612841d04a7d5e1a5a2bdc2867ee392962a7f622f9cd96e45a669c0145132ec377f2c2f23f9a69a048a4b7bca187b6e4e460b71475a05351987eb8304c678a2
SSDEEP 48:K0kTSeMOirbShaIS2rK9S1grxk7YpKiYyLs5sIsVspszs3sLskbs3sSsPISsBskv:K4DyKI4iuRiKKIRViKGICv
TLSH
T17291F2517077020038BE298C95A1976A468235B73414FB2FBBB944E39DAFE090EFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 3bef0a13a963305c528ec340226f2bf2fc047d9d8dbeadbd462047ba56ed7fbf
MD5 6b82fdaac0371b814bbe10dc0861fd57
SHA1 f038bf540f079b50f835070852c809bd591d8cb6
SHA512 c526959290800994e3d6819d9171be74adb31da0868aca8a40eae0e48d8e26b878dcaadc04a76c9cfdb46d6faa31c09d3ff6879437d8b1fd677e7c5832771408
TLSH
T18171D2527077021038BE284C95A5976A068235B73414FF2FBBBC44E39DAEE094EFE4D9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 573c3a278e43055c23207fe90f5ae720350c85553f978219ec849e19e35dcdf6
MD5 93c73b04c078e7638ffe29207fc014f0
SHA1 475782c352e5cf2d73910b8ca49c133ae9ae3bee
SHA512 a91c0dddf0fd4da1a5a51d5dfbaac6a813f4bf00d3c8c5e39c431ad1a3b7158545980fde036b5a6c64a96541da90dac44b0db19b02f7ef7d5b1c1bdb7bd56b70
SSDEEP 384:EqZcICDsNg158M9up5u8i7NG8eika+NpajFRfWo6:fu/ck73vka+banWZ
TLSH
T18B927D755CBC6C7A68E3A511BA4736038EBC855BEBC86F94D4DCA71D00EB2980307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4587a74c2fba5e7fd206d8909486b570fe8f270a96c4cd0a60d641f849dd035f
MD5 8e2be85fbbda11a509ab33702fb33b35
SHA1 3401e7d453ca3d2550cd61db51ca4ecdc047f58f
SHA512 2152dabedae215b45d3a393838dd57da997d14ba8a8c398a414328b5ca4f45e24a565706977af7e4fb294766807bce556de99ca06e2dc39d0d37ca83173c7b89
SSDEEP 384:NZcIxsNgE58M9up5u8i7NG5eika+NpajFRfWo6:Vx8ck7svka+banWZ
TLSH
T1D9827D355CBC6C766CE3A555B94736038EBC855BEBC86F90D4DCAB1D01EB2A80307A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 510b874622368faa1fcd6f69d89df36ab27e624f9274eaf7699cc0095270783a
MD5 8c259a7512aba4d1e1bf92de28e69e3f
SHA1 d04c2016651835d0a7d94a32741557a93adfc760
SHA512 e342eb072ebe1f296d328244f43aadc38c9c1ea1503c9f78c9eb2f7eb1271cdf48754462ead0b212ec92c45e8f21b01917d2a1d9a1572e1565a8b0d9095b3002
SSDEEP 192:SONL6iDCQmiUy8+Hq5u88P7gOwSqDWeU6:SONL6/YHq5u8i7GFU6
TLSH
T1E702E939AC783C6BAEE3AE05B58777175FA4112FE6942F84D9E81A2C01D729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a25acf3cf872e55fbaff4b4167d8a9a32e67b1371d3018413007d8fd6c6ff35f
MD5 9c2984efda21c93955fa9094920ca2bf
SHA1 27a34112cbcfface789de4a8eb54d8f452fcf15b
SHA512 cfadbae920d2270fb8b706094a2b7e1920b04efd079eca83bcbfda5e90aaf501418eebf50ec961a909c91bef14e0093bb6866608c508bca0cfe4d46b88107b42
SSDEEP 384:GZcIxsNg158M9up5u8i7NG5eika+NpajFRfWo6:Ux/ck7svka+banWZ
TLSH
T175927D755C7C6C766CE3A555B94736038EBC855BEBC82F90D4DCAB1D01EB2A80307A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 195ebe52f47f704907f7e5bf26a8edcbc811bb3f9b7df5b7cccaa8bfb8f546bb
MD5 02c2c641b09363b590aaa584f4a93e29
SHA1 ca7afdca149acac6d57de01ac1b64a861a31b981
SHA512 fe3dfa4983f5f39ceae9f2c8d0d337642136b954f76d3fb01c5615e9921ba48cde2455a2de989ceee0cc21ab9015f61c9c07a8f1b62d71c54051a0fcc1122d86
SSDEEP 192:ulLsNgquMQUyVDPSqQmiU1K6B4p5u88P7gOTzKLlAU/LiLqywZKLm:wsNgE58rrup5u8i7NGueiXwZl
TLSH
T12E425A356CB86C366DE2A905B54B36139EB8826BD7C83F98D9DC971D01EF29C1307A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6443b863b646117066ec295d04abdc5d6bc0ea0c883919b2e23645f4bb1adad3
MD5 19202ce78b4fe98b753b59627ba024b5
SHA1 3cc0902048f836ef194db8e0a6733893adc875e6
SHA512 af3443436b6e05c24035fc2a19437c9eda8367b0625669535d6a8182ed876790cd2f898ba95c882f5bca00b14b261f897a83fa62981ce8e95e37280f48d0bd29
SSDEEP 192:SONx6iDOQmiUyH+Kq5u88P7gOTzK1uZU/LiU6:SONx6vJKq5u8i7NGMeiU6
TLSH
T1DC123B3568BC7C2B6DD2AD51B58736174EA4422BEB887FD4D9DC162C01EF29C1307A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1884310-6a50-4103-92c5-dbf69a10b2e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a1884310-6a50-4103-92c5-dbf69a10b2e9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7dc088e5c00055ccab0cd2205c3754134c850daf2df3e77f7c81a5d608d9cd67
MD5 3079380471966aba3cc3afd12cffd10f
SHA1 56309f390b644eb4a9a5c9c3a8a4bc87cf7f1094
SHA512 ebbf318c8e1977678c8ee25d231aaf29387cf6884be3510fd98cb36333f1a8786c43125c23e7e4313b3a683a17cc19e48d6bd0611ee37517b963456bd00b9e33
TLSH
T1CC412C5CBAEA1048B3B7AE569BF7A86D487B78772F0A945D10010E4F4663B40DCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download