8a0316ce88471d0ba2e9eefc0fc6432283d6655274a8441a48af3346d35500a9

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_8a0316ce88471d0ba2e9eefc0fc6432283d6655274a8441a48af3346d35500a9.html
Size 1.2MB
Sample260912-wvbvhasbma
SHA256 8a0316ce88471d0ba2e9eefc0fc6432283d6655274a8441a48af3346d35500a9
MD5 263334cf670ca047c2cc23caf7f08ac7
SHA1 fa164d7c7b96ae743729d92a3892a0dcfb2a17cf
SHA512 f278cb9425d33657324764805513bb15824ec496c31c62ddc621a610c8c9e2ecac516727c30798de7ce164b8315183d6f556799e320a57c76ad2a781f569fb27
SSDEEP 12288:5CeSXyMTNrjTEY0+kC6bhxs7jGiaR6YiErGWT:5CRyyjT3kC6bhxsPaRRiEqWT
TLSH
T16145C7DB9230717FF833A8B596C8A949F3988CC1E5164AB5BC70A61387DBBE61351331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4012	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338255200682479"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{B4570A48-610F-44DF-BAC4-1CF40E14FB4D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 876	2872	msedge.exe	86
PID 2872 wrote to memory of 4012	2872	msedge.exe	87
PID 2872 wrote to memory of 3244	2872	msedge.exe	88
PID 2872 wrote to memory of 3244	2872	msedge.exe	88
PID 2872 wrote to memory of 3244	2872	msedge.exe	88
PID 2872 wrote to memory of 3576	2872	msedge.exe	89
PID 2872 wrote to memory of 3576	2872	msedge.exe	89
PID 2872 wrote to memory of 1996	2872	msedge.exe	90
PID 2872 wrote to memory of 4236	2872	msedge.exe	91
PID 2872 wrote to memory of 1996	2872	msedge.exe	90
PID 2872 wrote to memory of 1996	2872	msedge.exe	90
PID 2872 wrote to memory of 4236	2872	msedge.exe	91
PID 2872 wrote to memory of 4236	2872	msedge.exe	91
PID 2872 wrote to memory of 5688	2872	msedge.exe	93
PID 2872 wrote to memory of 5688	2872	msedge.exe	93
PID 2872 wrote to memory of 5688	2872	msedge.exe	93
PID 2872 wrote to memory of 2000	2872	msedge.exe	96
PID 2872 wrote to memory of 5316	2872	msedge.exe	97
PID 2872 wrote to memory of 2000	2872	msedge.exe	96
PID 2872 wrote to memory of 5316	2872	msedge.exe	97
PID 2872 wrote to memory of 5840	2872	msedge.exe	99
PID 2872 wrote to memory of 2512	2872	msedge.exe	105
PID 2872 wrote to memory of 5904	2872	msedge.exe	106
PID 2872 wrote to memory of 4792	2872	msedge.exe	107
PID 2872 wrote to memory of 4484	2872	msedge.exe	108
PID 2872 wrote to memory of 4484	2872	msedge.exe	108
PID 2872 wrote to memory of 5336	2872	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8a0316ce88471d0ba2e9eefc0fc6432283d6655274a8441a48af3346d35500a9.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe37aac188,0x7ffe37aac194,0x7ffe37aac1a0
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,4516018078194881923,11591350052973749503,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,17410659630234306417,1913362705877969809,262144 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,17757165343613186282,7713884271741160006,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,11394568061803670304,6219394330423974387,2097152 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9191562562149222535,7063685481063980366,2097152 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4420,i,4800375797236112522,12412234053030788831,2097152 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,12911410171557138260,16954239903182252397,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,3546533877981013028,13921048143060284586,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,8893674278031680593,3597911948444899204,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,8893674278031680593,3597911948444899204,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13752665119399439862,490086532609607981,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,15064951364924611773,5730777196887603168,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,15292854718586113694,8336931046829897215,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,15640183296840124701,4516736535900279129,524288 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,6330153088720638223,5598680906500856563,262144 --field-trial-handle=2268,i,5453404731192604891,17531805708918828401,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9c9de74a2a295354225a1d7c8372b2d2a051210bd3485bcbe8ac84e538ecfab3
MD5 3e2e259a1d1ef3af58c0ff9c76ab0b8f
SHA1 dbb071773be8d29d97bf6ca9db86bb916756eb87
SHA512 f14f287452e2e4f314d05035fd31819dd87edb739ea59d12d11a079c230b34d4ba954a3ed4990f903e35ec273840dd9598759960ce6069acaf8d4e6bc5d83535
TLSH
T13BE02BE9CC16AC3B08FD571D50554641EB4113472B80884B3B3DD11E8FF1A36958A86C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9895fc8f306010a387081a529a871712556a158553218e451ea2d25bf9abe531
MD5 ebe2887c1c866ee737c85bcd46892222
SHA1 20f547ebe4ece7ee0ca8fca5987aa08d04e61820
SHA512 3cc9ce1ec35880d398725626609f7293ff535ea8c96b87e511a25a458ca3e5b9a7e8c64b9182b6e26afdac091b0fb80766e7672b248d2157e19aff17ec7f1a37
TLSH
T1E0419EF7C3E8867E890196F0A7286E2BCE2D0955432C3C5A89E4EF1F93E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 23ab855c0a3082c7e6184ff619bf0c991e5c49cc8640607405e45b1ab69adfe1
MD5 e9bd0cea1f1379d8266f51a354d74ad3
SHA1 72d0f534453614c71bb432b7132e8e0109b675f5
SHA512 48f901f987870b70955ad295fabfbb6460e457e9971096f7d5741d0a8e0af79adf4f421c545639e6b2e9b048cd4535f3f3f4e008c9dba8ea29488089ab0ef7f2
SSDEEP 192:sxZtRRk2/fbslQZZh5zodpHqHW6+WNGYbIeFYfSIg5XsJ:sxZtg2/fbslOZhyKHbGFUYa9Q
TLSH
T1C532B615AE38A97F8CC7D219BB55BF53D7F95032A0951E48AAFC8A1C14E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 23823843761c47ac39ccebf7dc17f35db70c746998b9322584afc741db319037
MD5 f3843b273271a20f4299c74b0e3056b9
SHA1 b6b7f43939c911d5b900640061ec93d21bf5f17c
SHA512 d55c7a1eceac5345e1a38bd5b5dd12d6724222339a401995d6fd2b988e01ce67c474737d8abb9c625a9c6962e3f3a0f94ce0f8d329fb64522d42fcc62d8352fc
SSDEEP 192:sxZtRRk2/fbsdQZZh5zodpHqHW6+WNGYbIaFYfSIgjsJ:sxZtg2/fbsdOZhyKHbGFwYajQ
TLSH
T15E32B615AE28A93B8CC7E219BB55BF53D7F95033A0951E44AAFC8A1C14E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1cbb7da83abd47968fdc2dbe661ff893db44cc14045198c6b7396c0913deb503
MD5 f6b9818589444d93b7d43a4697a8bf62
SHA1 e70eb362b1a6a0a73b6c54d0b2661c5ec77b3933
SHA512 b8c3ef77071de2462969d4ad9bb0d2d83e2731909ad2f3c7b25da0e1aebbbb4ddb2d2516ef1fb9aea3e036aee9b361acc2c06de0a909fae87a5d2e8e3c47a42e
SSDEEP 192:sxZtRRk2/fbsPQZZh5zodpHqHW6+WNGYbIaFYfSIg5XsJ:sxZtg2/fbsPOZhyKHbGFwYa9Q
TLSH
T1B532B615AE38A97B8CC7D219BB55BF53D7F95032A0951E44A6FC8A1C14E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 5bfa3d69ee01accd2c30d24bac30a289d707b0320177ba5b1721fdc2edabcbda
MD5 214f5f183d801ba549b313b07e02f053
SHA1 f05605543471f896edd8711da4f07a987521df30
SHA512 c4772d4432c787e1d6f9a245c4418eb24020e6866c728360fe947069286f03620f5f50c2b61a06ba78d81abbd05086a98647387c437a5fecdf729649e835e3ba
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXal1L:OtfFvpopPxrB4RhfarL
TLSH
T17FB2641471BA021038FE791881B5872F064232B37159EA3B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3856f0edaaa1667b8027cb0b915f7ac7b9c829276ef4e163ad657bb9c5ceba38
MD5 09f97997ee453d2cb199e27974c904c2
SHA1 aef2dbd2e238a741eb32e61e78d2d037b22bbb74
SHA512 dbf7baf4b4a81f77fa5fef316692c1d1cc8d9c8c06be4223685be3404331c281c04f2ff474cc1f57601a69cdd2acc52d4ca0be62a05fe7f37d6a24fdd34a6dac
SSDEEP 384:nQiFiZcI1sNQ8TUNTUlI4L5mgfFRK2fMBPOmJu/LQGUU7O6R2FeoPgL/7IzLo9:rFQ1hwgFqqBPhU7TRQa
TLSH
T19DC24C32ECA4CDBBEDEB8AD5A74A3A07DEF44153869C8AC4D9D95E1D00875ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e15a147f5e4fadb860a2ccc8607163b9563de3f56430d97add853944228f43cd
MD5 edb8eea870e785c487f7c03cb65506a9
SHA1 ecf4edfdec9185f69de062cf4745712c1512e170
SHA512 cd9399c4cbf84e78fe63b7601ab5bac5ca815458482f053fba152faa1cf0f0ae8318f36a5048c730ea6f077091801dc426c64bee43a7d8f5c3071384ad0cdd6f
SSDEEP 384:n9iFiZcI1sNQ8TUNTUlI4L5mgKFRK2fMBPOmJu/LQGUU7O6R2FeoPgL/7IzLo9:0FQ1hwgFbqBPhU7TRQa
TLSH
T167C25C32ECA4CDBBEDEB8AD5A74A3A07DEF44153869C8AC4D5D95E1D00875ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b9914cc28332bc0b300bd027b504d7026eb821764764c7c7ec52e6c8b673f493
MD5 7b0fce22c81ade6dc149d40a07ca56dc
SHA1 6e086a1cf0cfeedf4746e9b7a653f38d80ddc4b2
SHA512 04774172dc3dc17f5e3ec81e36cbe91deb8f9ebc9354042964a8928378cd1046f3214aba492aeaf1b2b3f227c31068f0a4a064d44708850b5267b5726bf3416f
SSDEEP 384:npiFiZcI63sN08TUNTUlImo5mg58nK2fMBPOmJu/LBXj7O6R2Feo4gL/7IzQo9:AFQ63pwg2DQBPWXj7TRya
TLSH
T1D3C25C32EC94C9BBEDFB8F99A74A7A07DEF00163859C8AC4DAD95D1D009759D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0fbb0aa9e40bcecd6cd7782bda47625c9cf40ff121b7e4fa198a75a56b715576
MD5 2709ee60a2f97e7c2543fcf6d1e8a7bb
SHA1 255bc93aaf1ef7a04c5c6c0ff333c786c38ddb35
SHA512 7d03fed0472c5844331c6cde55004744bbb2ad25124256fd660dbdcf20fd513c17b4087143c55277cbf7e5f14287a52c9c4811c2a5a1d96b39d6f2bfa89bd49c
SSDEEP 384:noiFiZcI/TsNQ8TUNTUlI4L5mgKFRK2fMBPOmJu/LQGcU7O6R2FeoPgL/7IzLo9:zFQ7hwgFbqBPnU7TRQa
TLSH
T1E0C24B32ECA4DDBBEDEB8AD5A70A3A07DEF44153869C8AC4D9D95E1D00871ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 312804fecaf1243b34c388789639c3c6fdd380d0fd607af565d748a1a6bc7e9e
MD5 ed3b1f91abb0643dc3dc2bd59aabd08a
SHA1 bd4d6a8b1c436c3b80325c1f01cd22eb156cc11a
SHA512 e86eeab22f274a78d7c4c1263200a97299f113c3a109103b8e6041f3704e12bc8dcc6a7c58faff5b0198d4fe44ac8ff24cd7fa3d1f98ac5d334d04b1a64c2238
TLSH
T123411A58A6E9110CB3736F5AABF7A86D547EB8772E06C45D10110E4F0A26B01D871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5840-194-0x000001FE2D8F0000-0x000001FE2E8F0000-memory.dmp

Download