516ee0a2ab63209a4fb111d04edaf159e042e9b6a8a079dc7a1da2628b3f1e19

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_516ee0a2ab63209a4fb111d04edaf159e042e9b6a8a079dc7a1da2628b3f1e19.html
Size 186KB
Sample260912-lezxaael2s
SHA256 516ee0a2ab63209a4fb111d04edaf159e042e9b6a8a079dc7a1da2628b3f1e19
MD5 4fd5015521a6e01d5c917df468477de0
SHA1 b62eb651ee4fbcd744de8f0019a9e9adb2c57265
SHA512 be4dc37d2f9b39a12d1df8665c6b1b545d332a2c051ca8377263566f99ff4f6c70777dce9118659863321df877f4b52dd239bed2fa0dbaf981b71aceb946350f
SSDEEP 3072:4CnK11H9HHA+Xq94leeGBESlW6R54zZ8nJL2:Fnwle/mzZ8nJL2
TLSH
T1A0144304819E5417BD92C8E923493C57E054F092DCE9BC54EA4CA3A816AEF967FCE7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5524	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338182217862886"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{46E6C4D7-E910-41D2-B4D4-BDBEACAB7E20}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe
6132	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 6132 wrote to memory of 4496	6132	msedge.exe	83
PID 6132 wrote to memory of 5524	6132	msedge.exe	84
PID 6132 wrote to memory of 1724	6132	msedge.exe	85
PID 6132 wrote to memory of 1724	6132	msedge.exe	85
PID 6132 wrote to memory of 1724	6132	msedge.exe	85
PID 6132 wrote to memory of 6068	6132	msedge.exe	86
PID 6132 wrote to memory of 6068	6132	msedge.exe	86
PID 6132 wrote to memory of 684	6132	msedge.exe	87
PID 6132 wrote to memory of 1252	6132	msedge.exe	89
PID 6132 wrote to memory of 684	6132	msedge.exe	87
PID 6132 wrote to memory of 684	6132	msedge.exe	87
PID 6132 wrote to memory of 1252	6132	msedge.exe	89
PID 6132 wrote to memory of 1252	6132	msedge.exe	89
PID 6132 wrote to memory of 1076	6132	msedge.exe	92
PID 6132 wrote to memory of 732	6132	msedge.exe	93
PID 6132 wrote to memory of 1076	6132	msedge.exe	92
PID 6132 wrote to memory of 732	6132	msedge.exe	93
PID 6132 wrote to memory of 2288	6132	msedge.exe	95
PID 6132 wrote to memory of 2024	6132	msedge.exe	105
PID 6132 wrote to memory of 2368	6132	msedge.exe	106
PID 6132 wrote to memory of 3896	6132	msedge.exe	107
PID 6132 wrote to memory of 4428	6132	msedge.exe	108
PID 6132 wrote to memory of 4428	6132	msedge.exe	108
PID 6132 wrote to memory of 5712	6132	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_516ee0a2ab63209a4fb111d04edaf159e042e9b6a8a079dc7a1da2628b3f1e19.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffdcc05c188,0x7ffdcc05c194,0x7ffdcc05c1a0
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,3300230286739179341,10264451358850241121,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,17961566633503532271,396739346757565312,262144 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,9324962253649932556,286506141760900960,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16347289793172683408,16403103661771001114,2097152 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,18113472888401490732,11859849913042265725,2097152 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,10717761406142594451,8082417847138616161,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,16935712474463873025,6438067338815870438,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,3499117835192550852,12200941244521991107,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,3499117835192550852,12200941244521991107,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,5584579649668971804,7084752748282964022,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,2995443156209122419,7659851130576682879,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,8978865135915477694,3613869580688089208,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,4591204387813836567,14464563160652010695,524288 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5976,i,14012694542480616150,14040478871179506613,262144 --field-trial-handle=2320,i,13933532974500215972,8743260035828064234,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4fafcfd9b6f3a663ba1b0d83e4211921b27cf4d1da1dc5a9d084fad1a5eadf0b
MD5 d0a65599431d43ce2e19236ff0e149f0
SHA1 6d04bb2e30936aa9e13e57edbcabf07f3f5a4dbc
SHA512 45dbb02a73ec418519d47893fe122dff2308155b9d02c52febac09bb985b47d606d959817e83223e8fc22fc9718d3510768d71c7187467514d8f2438af2f1244
TLSH
T12541E2F7C2E8866E890156F0A718BE2BCE2D0955432C3D5AC8E4EF1B93E2471D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fb5b5e03d526f2a272ff24dd7b285c94b268658a0b14532b9d72dcb7d53592de
MD5 17024d7607b88b52a8643cc2bd06bab6
SHA1 8092a608fc124543770df3cab98391bfa429d48c
SHA512 3244f6575cf5a1b71f455ad904743aba8ccc5d536d534b20142f1f57710a80c3b5b038b2197637f47b1b78c65396e76762804c76aa91095b00ca097b00aa6f2a
SSDEEP 192:sxZFR4kq/fFsk6aQZLb8wzodpHXHW6+WNGYoW2SrqsIgjtV1J:sxZFVq/fFskjO8z3HbGJS7jtR
TLSH
T19B32B615AD28A93B8CC7D219FA567F53E7F9103291D11E88AAFC8A1C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8dab71d919721f3342d0f755ad578dc03142a019d38ce14ffc0558d21b9fdbf6
MD5 22e6d93d7703548717a0dc87728e1e28
SHA1 0b14e70a6db735d3a2546a5e4553e63934bb8eef
SHA512 d4e2bf4482092742d938a55916d86464b1ea78e2ce4c994d4743880526bacc145104a9c10661a608e6ac42f1fd4ab9707243a73ec71643343bc7c21a0ee6a041
SSDEEP 192:sxZFR4kq/fFsVoQZLb8wzodpHXHW6+WNGYoD2SrqsIg5AtV1J:sxZFVq/fFsVoO8z3HbGwS7GtR
TLSH
T15332C715AD28A93B8CC7D219EB567F53E6FD103291D11E84AAFC8A1C15E76DD120341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 73f3ae81cdf5104bb67f10ee450a68cb3db024a8011d75964d97b0f47c6ebb11
MD5 f40c8a35fd6b0450315a7545150be0fe
SHA1 16f6d94bf61fa2ac9fea297a57982e2cfe654194
SHA512 d308b18559606d3bc2966fd97ceb6d4a1d421369ed9bb62cb0689f4ecb3ebbe2fd3938cd23b45d774613c878a204ada6fcc31520f7d492dde979aaa7ac73af76
SSDEEP 192:sxZFR4kq/fFsV6aQZLb8wzodpHXHW6+WNGYoW2SrqsIg5AtV1J:sxZFVq/fFsVjO8z3HbGJS7GtR
TLSH
T10432C715AD28A93B8CC7D219EB567F53E7FD103291D11E84AAFC8A1C15E76DD120340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 509b0c3d2f1994c32bd2da20da142d2e3bc5ef7ab60bae2db7fd49a7f36aefc2
MD5 5a45c734c8a9c116834fec053f1c6c1a
SHA1 b3165e1a1288f99ae1e5df5ee2a886a75a16a3a7
SHA512 9eeff380ac8a067f4172df213a2df3d8f935447225e7ae1b17c56db832051a0e1d16b339dc74f4f82dc4ecabd82db4ad8709e245248106a6f98baf4d6505838d
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgr:ST/2dXOJhJlpfnpp3tNXVrN3S9DO
TLSH
T134B2225571BB021039FE391891B5972E164231B33119E62B7FBD04B69E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 be9623e6b20e109199f2a06be78e334dfa386292268afea3e758595fe1ebb30a
MD5 5cdb55f7db09f3e55a676dab87abe876
SHA1 1eee2ab1fe4d6d2c7b408044e16cd95464931ab5
SHA512 0e1f7d00d233721fe902cc473282943f4b7e50de7e21cf1bbc7a929683c0877a2041bfa78027c2b7385095d5db6fe6645d110021e2bf68f22679135067d2b047
SSDEEP 384:ndiFiZcI0mR3sNL8TUNTUlI4raKM45lwzWfLBCW/Cv5wJuOEiVMsa+VYUvgL/7Il:UFQz3CwghEYEBC2ChIuiVMhgiE
TLSH
T106C23A32E898D9BBECEA4BE5A64A7643DEF4426386CC9AD4D5C85D1C00DB1DD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8f1efc36e163073c70ffcf3645a5424e62a2e43c55b155ed5ad5c757fccfc852
MD5 0d6af832b72a21154aea3645f157ca3c
SHA1 22b3bc1fdfa482853beac7b8c87273382e3c4583
SHA512 e4527acce7ffb4b2dd6c90d74ea4e211236e70dcb01a1be33268ca310885de540c56a2e14b3dcb3259e13cbb0dcbbf919dc1e56e7d0af6a81beec41b844623a1
SSDEEP 384:nuiFiZcI63sNu8TUNTUlImqljaKMiS4wzWfLBCW/Cv5wXFVly7O6R2Feo2bgL/79:FFQ63rwghlWbHEBC2ChqFVA7TRDsJ
TLSH
T1DCC23A32EC98CDBBE9FB4F9AA74A7A07DEF00163959C89D4D9D81D1C008759E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e66802c8613960c3841871f69825b4c7eda441a8f8b5892576c933b948740a4b
MD5 ea7650fd133a081979568a96d96305f7
SHA1 2f041f135106ac20acaf42bb83cfe64c8d89b98f
SHA512 465d36fea7125171a5725b7e1fa7c5610d7609343a06eaefcfad66ff510cdb9ec457580f2381a2c5bd1b32762615f5fc9e522d0600c381b2c05e6b3d6e1902d5
SSDEEP 384:nQiFiZcInOmR3sNL8TUNTUlI4raKM45lwzWfLBCW/Cv5wJuO/mVMsa+VYUvgL/7O:rFQN3CwghEYEBC2ChIZmVMhgiE
TLSH
T178C23A32E898D9BBECEB4BE5A64A7643DEF4426386CC9AD4D5C85D1C00DB1DD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7a85b85b6b6e6bb1f0d99eea7683fad8304dd5c42913716de0d018e362d0ce71
MD5 0b99f2c98b8b97329eaac1f77535947e
SHA1 c96a7054b9eaa8a5e6a6fc9f47c8c7d848c9ee85
SHA512 fa37ad36e718258ede2d95d70fe00bb7e62db7ea90a87fdfcd5cb3c04aa2e91b9e3724ecf54564749e8c1083eac2d886a9cdb0edfc2b640881b5a06a474e5287
SSDEEP 384:n1iFiZcI0mR3sNL8TUNTUlI4raKMK5lwzWfLBCW/Cv5wJuO6iVMKT7agL/7Iz1oU:8FQz3CwghCYEBC2ChI4iVM5z
TLSH
T1A1C23A32E894C9BBECEA5FD5E64A3643DEE44163CA8C9AC4D5D85D1C00DB5DD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 74e4032d35a510006a9fff7ff778cf3565e16ebeb235905b001c301c1f282cfc
MD5 7cf3ae6679ae2ee73bba699799ea6d3e
SHA1 87c5a3d89a7ec83b3bc10e36f3ab957ca4f6d5db
SHA512 f7c5295c065e43f899351d0c4797fdbdc7acdce369fb25103b968e7ed555df0a269e15c4a60036ca4bd1d13b4f1545f43db0728753ad4f59544a6e606290fc71
TLSH
T105412A6CB6E91148B3B7BE5A9BF2A46D487FB8772F06D05D10110E8F0637A41C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2288-189-0x000001A3AD7B0000-0x000001A3AE7B0000-memory.dmp

Download