2e0a27f46e8e129128bbaa19f9db2f1fb8b78d153d16b9363a77bd1d10daf2e0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2e0a27f46e8e129128bbaa19f9db2f1fb8b78d153d16b9363a77bd1d10daf2e0.html
Size 109KB
Sample260912-pvestsbh97
SHA256 2e0a27f46e8e129128bbaa19f9db2f1fb8b78d153d16b9363a77bd1d10daf2e0
MD5 50ef8f14f0e1549c486b4a4ba0886ed1
SHA1 a6711fd295903aa3039affe3c4cff4778046916e
SHA512 a14a28d17ec986f77c07445dda7d892dac3464c12b3ac9c60c9ad4ea00ba9e74b4d0e89ba7b3e900b0bac2e0e8cb4f5b3eb8b66620c87d0c5237a089b8b6bfa0
SSDEEP 1536:uPx4Yn+hEaRdRYTEpVj7V78hQksPlLQwTt8NoQxdxupbEaocbEaoFfe:cS7QlNXcpdocdoFfe
TLSH
T11AB3B58711204CFAEFA44DB3455B586B3D2C1437BC4791B9E3FD8FA72B5286E034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6060	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338335821053242"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{2EFDDC0D-EDEE-4C1D-BC81-433AF1EF580E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
616	msedge.exe
616	msedge.exe
616	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe
616	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 4244	616	msedge.exe	86
PID 616 wrote to memory of 4396	616	msedge.exe	87
PID 616 wrote to memory of 6060	616	msedge.exe	88
PID 616 wrote to memory of 4396	616	msedge.exe	87
PID 616 wrote to memory of 4396	616	msedge.exe	87
PID 616 wrote to memory of 2756	616	msedge.exe	89
PID 616 wrote to memory of 2756	616	msedge.exe	89
PID 616 wrote to memory of 5164	616	msedge.exe	90
PID 616 wrote to memory of 5164	616	msedge.exe	90
PID 616 wrote to memory of 5164	616	msedge.exe	90
PID 616 wrote to memory of 2656	616	msedge.exe	91
PID 616 wrote to memory of 2656	616	msedge.exe	91
PID 616 wrote to memory of 2656	616	msedge.exe	91
PID 616 wrote to memory of 1592	616	msedge.exe	95
PID 616 wrote to memory of 1592	616	msedge.exe	95
PID 616 wrote to memory of 2156	616	msedge.exe	96
PID 616 wrote to memory of 2156	616	msedge.exe	96
PID 616 wrote to memory of 5860	616	msedge.exe	98
PID 616 wrote to memory of 4536	616	msedge.exe	104
PID 616 wrote to memory of 3396	616	msedge.exe	105
PID 616 wrote to memory of 4556	616	msedge.exe	106
PID 616 wrote to memory of 4700	616	msedge.exe	107
PID 616 wrote to memory of 4700	616	msedge.exe	107
PID 616 wrote to memory of 2768	616	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2e0a27f46e8e129128bbaa19f9db2f1fb8b78d153d16b9363a77bd1d10daf2e0.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff91c7ac188,0x7ff91c7ac194,0x7ff91c7ac1a0
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,5394766216566165082,13401972762508245617,262144 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,7500807016900060257,5942563661917638002,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,3650199946757511646,12041998493068309307,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12350399514504171301,15058842556474262922,2097152 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11638137694221059109,17828500791954896425,2097152 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,1662818801146144805,12249109266695566704,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,13182731006803034833,5660908872172724773,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,17416664902418951498,372258668513470971,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,17416664902418951498,372258668513470971,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17785736355622425942,11669253061334678866,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,10678448056678850897,15872868596249032674,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2179374028281006360,8587399316490183527,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,1071464725003832282,7660831411736807265,524288 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6032,i,861275556204328895,583398495110819075,262144 --field-trial-handle=2208,i,14365604506297879449,12533168116346556802,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a1f6d21eedcb046b4ce58234b76bc598cbc9a92078b97d24636b03f6a18abe9b
MD5 d7d2f65351166953998676990082a8f6
SHA1 866651d1685bd0314e78be62ddbca11a47a9fc53
SHA512 cc25f5cc37d00ee87c873948bb831513eb2306c78118b2e18e662c1d29f4444bafd36cc52f87271fd9195fa36c67510424b53ea1f061a8f9291b3b0bd3e8c2bf
TLSH
T113518FF7C3E8867E890196F0AB146E1BCE2D0A55532C3C5AC8E4AF1F97E24B1D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 742e65ae04dbad12cec46b35e6d52cbeda531f734513c4653e3dfde5b4cbc5f0
MD5 6b9363523b41d6dc2c11e8b0dbc6c723
SHA1 cffdb506a8ce3db6ac8223788f426ef02584b1d5
SHA512 1999addbdf3ae070200d66a4f952abf715258f708c35976c24d607fe37ef2894ae90b20d48c66ba6fc33df61a2a9a130ce2ce07cc4eb02d856732534053f765c
SSDEEP 192:sxZxRzkv/fSsaQZL68tzodpHYHW6+WNGYo+2SZrIg5ptFJ:sxZxSv/fSsaOFm4HbGpSlXtv
TLSH
T17132C7156D28A93B8CCBE219FB557F53D6FD5032A1910F48AAFC8A1C04E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 34f496ea657820ee915a2af2a0078b08c8e41a11ca1b81f7000ae8c08e6d7c1a
MD5 9996cfa4ed0513a903e546d95ebe0079
SHA1 2a502eeea79b95b4a80a33799414227467caeb66
SHA512 e0e798cbc0830eac66af383556b3a2a388d879f3ea1d00fdac2558ab9f4c5a2a8984b0d5a16fd4529957e229463ac49cd60d90b51a8c35999fab16765ec60982
SSDEEP 192:sxZxRzkv/fSs6aQZL68tzodpHYHW6+WNGYoW2SZrIg5ptFJ:sxZxSv/fSsjOFm4HbGJSlXtv
TLSH
T1D832C7156D28A93B8CCBE219FB557F53D6FD5032A1910F48AAFC8A1C04E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4cd205078d56272713deb1a65a9243d82a041e9fa14e72e63e958ca28bc17216
MD5 88629d3290af564a2a8eda8b47517cb3
SHA1 e545d8e15d4cbf0853ec5cb0a2456ba550e7d422
SHA512 a2eb362d57d9381446a098c37ae4da88d0a3dd2f1cf56e5ac609fa1b335d841d974fc4ba8aacd1d65e2f1bccf48ee7f6878cb44c4fe0501c25c287bc128b9e19
SSDEEP 192:sxZxRzkv/fSskaQZL68tzodpHYHW6+WNGYoW2SZrIgjtFJ:sxZxSv/fSsdOFm4HbGJSljtv
TLSH
T17D32C7156D28A93B8CCBE219FB557F53D6FD5032A1D10E48AAFC8A2C14E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c680afe7d208e4629f295bbb2dcc9d532d1d5fa15ef4a515c3922d454b2b6301
MD5 6180da970e091954bd082fcb1e6ad260
SHA1 509b1ea1bf8dbaa0164bde76a105dcaec6ed3ead
SHA512 daeec3dcd8622e13330372ee958f32479253e7e2021f9229afaa0d73b2d73bbd5c47f5d2688a2b771d9811e0b7f6101e891691ef5e035454f7783764d8b0adf7
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgX:ST/2dXOJhJlpfnpp3tNXVrN3WZHC
TLSH
T11FB2115571BB421039FE291C92B6872E064231B33119E66B7FBD04B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 60ab10e1e62b7b46d2f3a5e573206aa3eedd7c7ee84cf2910580baa5bfaa259e
MD5 2ad2a9bdc334a09a516dc5bc4508ac92
SHA1 17d95e61988ad7e64b38d5fbbaafef452996523f
SHA512 81ef08e330db11fefbbfb622c869a2edea28657b8e0cccd97ec4bd2dad45a2a39aaccba4d98384137327362cfdf1ec2d27faee4178dddeb4f38e9c8e0ab3dcfe
SSDEEP 384:naXiFiZcIOR3sNG8TUNTUlI47OaKM/2owzWfLBCd/lfdJkbW7O6R2Feoah7UzgLl:aSFQa3Lwg+hwXEBC7fjkbW7TRt+u
TLSH
T1F6C25A32ECA8DEBBECEA8AD5A74A3A03DEF4416395CC9AC4E5D91D1D00C759D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 66df72afad7e3bf2cca6058cfda5f9a4eb057e93ddc16caea69e48577acadba3
MD5 9f1f5acccfb375bd674f139f4d4fa4ff
SHA1 d7774cfb38fbedd3f62661702eed36a591455cca
SHA512 c33467993832d43c7302d03098cc1446875347e5e307101a26a783b8d2bacffc7b5b7e3dbf284068e7353b630865aad2324c500b92bb4a1c810023f79d3ef095
SSDEEP 384:n+XiFiZcIOR3sNG8TUNTUlI47OaKMs2owzWfLBCd/lfdJkbW7O6R2Feoah7UzgLl:+SFQa3Lwg+h7XEBC7fjkbW7TRt+u
TLSH
T1D6C24A32ECA8DEBBEDEA8AD5A74A3A03DEF4416395CC9AC4E5D91D1D00C759D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 402a97206e0e50484b643890364eef3886d499e3fa79e988cf986733514e2d22
MD5 463912a1a4c798e242b9a2d63c4d3590
SHA1 664f3543791d361c83bf2bf7c91b5d1e30799735
SHA512 2f6b8c3f04ff9a6ba845df56b304991f2073b7bd772c61acac47c3c7a581cbbe64abe922bfd4d44418f950c0569289ec7cafcdecd6f8f148d51499ee183b6c6b
SSDEEP 384:nWiFiZcI63sNC8TUNTUlImjaKMiC64wzWfLBCd/lfMXEsa+VYegL/7IzzoG:9FQ637wgR2HEBC7fMXEhgTB
TLSH
T162C23A36EC98DDABEDEA4FD9AB4A7A07DEE40163D4DC96C8DAD41D1C008359D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4b4464f075e68e87da104087343f11f628f80775391800939af9c3a38397cf24
MD5 01e2226b772ec72a99ac6d9223706c17
SHA1 d7116a498f6664dc47c32db77aa4e569fd2f8a60
SHA512 e1b10a6122c7ef295fb227d57da7002c48b83eaae593a3b7cf7dfe127d986836471b0ef4f0764062c074bb8514eb5c73aab9afa0527a6096108848228db1d0d9
SSDEEP 384:naaiFiZcII4R3sNG8TUNTUlI47OaKM/2owzWfLBCd/lfd+sbW7O6R2Feoah7Uzgp:aRFQx3Lwg+hwXEBC7fssbW7TRt+u
TLSH
T196C25A32ECA8DEBBECEB8AD5A64A3A03DEF4416395CC9AC4E5D91D1D00C759D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d173843559a8a8bf63a9f95a905845bf2cd08017af852afc2333562b563b11a1
MD5 9e5d0ec6d9ba0c44c116e966a3ae58dc
SHA1 d583ebce0b6aeb9d4793a84dcd55b08087f09743
SHA512 70430920a141edc4032229a38f3f6bb3c2c77a56675015a9b18110ea34c9ddd8b13577a2465c8bc91e8bbc43afaa8db6f32cbea81560ba77fc8aa57280ef395c
TLSH
T14241E65CA6F91158B3F7AE56AFF6A86E487B78771E0695AD00010E4F0A27A01C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5860-185-0x0000013367BB0000-0x0000013368BB0000-memory.dmp

Download