4850dc502168dfe7c974b4d44e3981f70daa2c6e3f628e2386259def01743abe

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_4850dc502168dfe7c974b4d44e3981f70daa2c6e3f628e2386259def01743abe.html
Size 112KB
Sample260912-t84fkaef92
SHA256 4850dc502168dfe7c974b4d44e3981f70daa2c6e3f628e2386259def01743abe
MD5 93cadde0f86e03992e33c0bd844e1d48
SHA1 5507437977a5539c506ec0b9f359c981da0d2d40
SHA512 2a02c50e3edc14c176b46f20d3bc03b26a50901fb9be4a29726b6efb9f631acc641f7c668b17650d70df2e6c90f45eee2abc27edbd0d16c956bb2a4339ccbf4c
SSDEEP 1536:CmxgYn+h9k7GRlXtdk1mHlwQgTt/NoGxyrcmbEao2bEaoAReqQ+NdmdU4fdzt1s:bGKQoNagmdo2doAReq9ou831s
TLSH
T144B3B59751204CF9EFA44DB3459B086B3C2C5437AC4391B9E3FD8FA72B52D6E034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6140	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338355631741302"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{F63AACB2-4DC9-4B87-84A3-B11EB645A09B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 3132	5144	msedge.exe	89
PID 5144 wrote to memory of 6140	5144	msedge.exe	90
PID 5144 wrote to memory of 4424	5144	msedge.exe	91
PID 5144 wrote to memory of 4424	5144	msedge.exe	91
PID 5144 wrote to memory of 4424	5144	msedge.exe	91
PID 5144 wrote to memory of 2268	5144	msedge.exe	92
PID 5144 wrote to memory of 2268	5144	msedge.exe	92
PID 5144 wrote to memory of 4144	5144	msedge.exe	93
PID 5144 wrote to memory of 3432	5144	msedge.exe	94
PID 5144 wrote to memory of 4144	5144	msedge.exe	93
PID 5144 wrote to memory of 4144	5144	msedge.exe	93
PID 5144 wrote to memory of 3432	5144	msedge.exe	94
PID 5144 wrote to memory of 3432	5144	msedge.exe	94
PID 5144 wrote to memory of 5212	5144	msedge.exe	98
PID 5144 wrote to memory of 5212	5144	msedge.exe	98
PID 5144 wrote to memory of 1672	5144	msedge.exe	99
PID 5144 wrote to memory of 1672	5144	msedge.exe	99
PID 5144 wrote to memory of 624	5144	msedge.exe	101
PID 5144 wrote to memory of 2364	5144	msedge.exe	107
PID 5144 wrote to memory of 4708	5144	msedge.exe	108
PID 5144 wrote to memory of 2904	5144	msedge.exe	109
PID 5144 wrote to memory of 1360	5144	msedge.exe	110
PID 5144 wrote to memory of 1360	5144	msedge.exe	110
PID 5144 wrote to memory of 5792	5144	msedge.exe	111
PID 5144 wrote to memory of 5792	5144	msedge.exe	111
PID 5144 wrote to memory of 2828	5144	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4850dc502168dfe7c974b4d44e3981f70daa2c6e3f628e2386259def01743abe.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcb164c188,0x7ffcb164c194,0x7ffcb164c1a0
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2406390406800969100,7289156847885449661,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7039678615333973553,15212386023320039251,262144 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,14104581720462659495,83529973481490276,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,4157634228129679710,6681333567054284835,2097152 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,4227799468981040517,9239656958792994796,2097152 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,15569195002103476765,472967930291888745,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,12696642703432146067,3938400307942074964,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,16830361759848268242,2087384794457108096,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,16830361759848268242,2087384794457108096,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,9970683691809715539,18070835198395074671,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,7240909852713143438,17130002562333410166,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14074375514149588298,14458505166962873579,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4064,i,7233887651131531014,9072754808017180884,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,15111912911149951848,6294952910473947445,524288 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5864,i,9777893000470549351,3606303521627361463,262144 --field-trial-handle=2080,i,12452141782049558083,9315946786365155352,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9c9de74a2a295354225a1d7c8372b2d2a051210bd3485bcbe8ac84e538ecfab3
MD5 3e2e259a1d1ef3af58c0ff9c76ab0b8f
SHA1 dbb071773be8d29d97bf6ca9db86bb916756eb87
SHA512 f14f287452e2e4f314d05035fd31819dd87edb739ea59d12d11a079c230b34d4ba954a3ed4990f903e35ec273840dd9598759960ce6069acaf8d4e6bc5d83535
TLSH
T13BE02BE9CC16AC3B08FD571D50554641EB4113472B80884B3B3DD11E8FF1A36958A86C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 406e50b303804d570c7b887f716ea8ce3552a1245b5c5e593d91eeaa3b2e5c57
MD5 e2e4cb073f786958879cc0ae8192c79b
SHA1 77ca4a6cbe7a5164eca4b2cb4d1fae451a718396
SHA512 2819710939160e14b101b7d229ccccebe127d11f1c702d2d1ef715c1c00726be5022d4fc487d24daead08ebf59c3ed91bc03bc4915074bb358b06a717d543a3b
TLSH
T17A519EF7C3D8877E890196F0A7286E1ADE1D0A56832C3C56C8E4AF1F67E24B0D24159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 50274d7e4d434688a3952bdfc597f9baef86580609753264eb5665acbba8bb9b
MD5 9ea86549af0d6278b2381e0653f07715
SHA1 394000281e19d810f594c106dc798442a4905bfd
SHA512 38d54cc84e8b53f07f8bed003fcc205a243e54d3d460a209507432512747f1905bf21f7ca625564a525f22f5ee743c2c9c1ed5e5766017c99be574197c7a1976
SSDEEP 192:sxZtRzkx/fWsJQZZ0OzodpHXHW6+WNGYbIGFYTpIg5eQJ:sxZtux/fWsJOZ0V3HbGFsYZQ0
TLSH
T1E032B7156E38A93B8CCBD219FA55BF93D7FD5032A0951E48AAFC8A1C14E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7a18fa5052fc61a7cf83f2de0a3816b6c3588bd9e30edf835ea43c32e068ec69
MD5 59ecd5706851b13ef0e3c876b2131e66
SHA1 7c7b793154b706da950789738c1994b7d90f9f16
SHA512 04854cb3ede704a6197d25bf321bde14e17d60b9f1e42152f3d5981cff4ee9c96791cd54937ed0070e80083fc47056305a9b5988b9c11a9e7af1a67f1e3bb682
SSDEEP 192:sxZtRzkx/fWsVQZZ0OzodpHXHW6+WNGYbIaFYTpIgjQJ:sxZtux/fWsVOZ0V3HbGFwYZj0
TLSH
T1FC32B715AE38A93B8CC7D219FA55BF53D7FD5032A0941E48AAFC8A1C14E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e66e6dffcf6243b81a8b45e7e52682aae828d5d42ec4525f42d53aef549b7682
MD5 d40a91fd8d28036aede939f79dc29be7
SHA1 185e1731d7f7f455e71f0f60710a738df6ea83a6
SHA512 2a92a50e6b804a0bb1a93d4992928a5b4f85d6f77f4718f7d136abaac5e2b018c204ae8772916aa4bbcaa81228000f5fefb3e551f5f2f222e2fd3625be75208c
SSDEEP 192:sxZtRzkx/fWslQZZ0OzodpHXHW6+WNGYbIaFYTpIg5eQJ:sxZtux/fWslOZ0V3HbGFwYZQ0
TLSH
T15532C715AE38A93B8CCBD219FA55BF53D7FD5032A0941E48AAFC8A1C14E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 44c43fa818d0e66e2de85e6190cc2b03e01010e7e4f4877411a398b363cf7386
MD5 3eab70121bb6b360eefa5eea5f08fa8e
SHA1 a2d4393ba0d57ddccf04c313afc1689a110e3254
SHA512 c687635015809c7ea9a2603ddc92b086896aff763c91f21097c14dddb0b23a059ce0bfd335ee20f9695c079c5dbdc82cf62cefa7c4c4c7d37515b1632539d5e2
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXWFnf:OtfFvpopPxrB4RhfWdf
TLSH
T193B2151571BB021038FE690881B6872F464232733159EA7B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e2445ca5ad308f968a8abdfacd8aa8497da53bfe865e711aa3ecccfc4169626c
MD5 e0e60f998fe8f7563e807704c1de18b0
SHA1 c1b968b3404045eee06ab2a7b10e1a5d412d3876
SHA512 9f736e54cf6d17b7ff739ea0c073c34a8a46ff94457a1d4d3bb10457bbf71d41ef3cd9d687f17739eb3b5429a93b79f45595b08294adbdb2b2acf80672977add
SSDEEP 384:nniFiZcI63sNX8TUNTUlI4Y5mguH0K2flBE8noQz7ryD7O6R2FeoZh7U9gL/7IzL:iFQ632wgQT6BE8oGGD7TRElQ
TLSH
T174C26B72E8A4CDBBECEB8AD9A70A7607DEF44163968C9AC4D5C85D1D00975DD030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 433081ec8cdd6ec29afaec6a6caa1ffbc21d8112721638cdb3b831974c888681
MD5 1fd510992197298bd9993532d7222423
SHA1 575f24e94c7ced5244385e4d7f54c2f3714548f4
SHA512 6f8534d03759fd908f51c432168642879fb4e14c288cf83de8b106cfc1e986a973012bb863627df801291145d89eb9dd147e92dc199300ca974c8e7cda174ca4
SSDEEP 384:nbiFiZcInc3sNX8TUNTUlI4Y5mguH0K2flBE8noQz7r0D7O6R2FeoZh7U9gL/7IP:2FQc32wgQT6BE8oGwD7TRElQ
TLSH
T1DEC25B32E8A4CDBBECEB8AD9A70A7603DEF44163968C9AC4D5C85D1D00971DD030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e17ac7e78c20e1d79e8113ce942e4fbff4f44b568b4cd8a3994e6402523c4ca3
MD5 bc85fd2e63c0f0cfff5116234a05818b
SHA1 70dd03ba7b1e19fd252ef94666f1afe3adb56edf
SHA512 afaa5b65bd5972889d72609b0e1aef23d2cb00bb5cc1604535c7515f73a9424385d77ca98d856b9c72bb75d4a6ba19292d5b43a7ec4bc56c818d9a648cf80363
SSDEEP 384:nciFiZcI63sNX8TUNTUlI465mgzyH0K2flBE8noQz7ryD7O6R2FeoZh7U9gL/7Ig:HFQ632wgwUq6BE8oGGD7TREMQ
TLSH
T10FC25B72E8A4CDBBECEB8AE9A70A7607DEF44163968C9AC4D5C95D1D00971DD030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 47bf494d15745282af6a57fbcdd5478c40994d338bc9468c938a72ec2fe5e6af
MD5 1f9384897c2101b9cd893ed2da530e05
SHA1 bf0b009aa3a497539581e73c317ee51cc4b53b63
SHA512 4ba58797a0d1e11fc8b205c55a9f16cb2afe6e6713933ffb4e54ffd5b3a5fcc26676a1a629b1af8e510683740a88bd3b49f5c83c32dab0716cded274fb3d5dfd
SSDEEP 384:nyiFiZcI63sN48TUNTUlImS5mg5UnK2flBE8noQz7DJ7O6R2Feo4gL/7IzAoE:5FQ639wgMvJBE8oGDJ7TR6n
TLSH
T1AAC24A36ECA4C9BBECEB8FD9A7097A07DEE40163959C8AC4DAC85D1D009359D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 66c55c044071a0d3c474423bcb816d33e4895d142cb0e795f4c30fa7abde09e9
MD5 ea55a78bceed98200f67239afda6acd9
SHA1 e856bd430d4783c88afd40e729b142bfb4b705e5
SHA512 d24554d8c629f744e3a3eafdcf153caea86b09e9ae9cee90b7b7b2a746782be4814f90f165fc6c3ce7929d41e594d9f3b4bb339c3b03177250831f70fa2a8941
TLSH
T157411A58B6E91108B3B76E5AABF6A86D447FBD772F17C49D10110E8F0A62B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/624-192-0x000002AFB5740000-0x000002AFB6740000-memory.dmp

Download