a6c7e4a816035b8b9942a8a0ba33a2879b25c98ac0740b777c23a4dd51d0ec14

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a6c7e4a816035b8b9942a8a0ba33a2879b25c98ac0740b777c23a4dd51d0ec14.html
Size 114KB
Sample260913-ces93azdkd
SHA256 a6c7e4a816035b8b9942a8a0ba33a2879b25c98ac0740b777c23a4dd51d0ec14
MD5 b14a988d7290d95c2b60b3abe7465ade
SHA1 e8ee110ffdba0e9b06e13d603e7e7ce92fd26494
SHA512 c707a7b72db8d8c73560bfe6fea55f20816e9253063980eec61d3ada114fcd805b1455b71f251c23f3df23791b34e815bae00b568d73900d85df233db7eadc0a
SSDEEP 1536:TPx8Yn+hQvsdRK7xsIvHb3lzQ0TtaNoqxYB2jc1pbEaojbEaoqODfwPQUauJ:z64QlNUc8dojdoqO8PQUn
TLSH
T175B3B58752204CF6EFB44DB3459B186B3C2C1437AC4790B9E3FD8F972B5696E034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338215556277709"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{D35F5588-3AF2-4A95-AE47-BE0698F4C771}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 5360	4520	msedge.exe	86
PID 4520 wrote to memory of 4316	4520	msedge.exe	87
PID 4520 wrote to memory of 2736	4520	msedge.exe	88
PID 4520 wrote to memory of 4316	4520	msedge.exe	87
PID 4520 wrote to memory of 4316	4520	msedge.exe	87
PID 4520 wrote to memory of 3476	4520	msedge.exe	90
PID 4520 wrote to memory of 3476	4520	msedge.exe	90
PID 4520 wrote to memory of 4820	4520	msedge.exe	92
PID 4520 wrote to memory of 2496	4520	msedge.exe	91
PID 4520 wrote to memory of 4820	4520	msedge.exe	92
PID 4520 wrote to memory of 4820	4520	msedge.exe	92
PID 4520 wrote to memory of 2496	4520	msedge.exe	91
PID 4520 wrote to memory of 2496	4520	msedge.exe	91
PID 4520 wrote to memory of 6052	4520	msedge.exe	95
PID 4520 wrote to memory of 884	4520	msedge.exe	96
PID 4520 wrote to memory of 6052	4520	msedge.exe	95
PID 4520 wrote to memory of 884	4520	msedge.exe	96
PID 4520 wrote to memory of 1556	4520	msedge.exe	98
PID 4520 wrote to memory of 4928	4520	msedge.exe	104
PID 4520 wrote to memory of 1120	4520	msedge.exe	105
PID 4520 wrote to memory of 1524	4520	msedge.exe	106
PID 4520 wrote to memory of 2300	4520	msedge.exe	107
PID 4520 wrote to memory of 2300	4520	msedge.exe	107
PID 4520 wrote to memory of 4592	4520	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a6c7e4a816035b8b9942a8a0ba33a2879b25c98ac0740b777c23a4dd51d0ec14.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffca742c188,0x7ffca742c194,0x7ffca742c1a0
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,6630705967653330378,1923888755556658188,262144 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,17047840038495575335,5316393593392418885,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,14102118143131338324,13631735224071365118,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11021822453961150752,14798918119144051731,2097152 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,874862790709273451,7260252846530145188,2097152 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,8136344268862588113,3491183130802832209,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,5041181305288077147,4440403735960922118,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,13896046877310885349,15770706848742100748,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,13896046877310885349,15770706848742100748,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13870623348731717449,3715020725802607391,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,1286338320876889310,17632015043276593555,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,6367014543240861850,11403136188604271663,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,14273265450750412321,2400163172264850880,524288 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6036,i,16309010583200291995,15753642913348604605,262144 --field-trial-handle=2256,i,12213010653886000637,10964406109512234436,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3b002ab8c6555cc9a3a5089d65b9f691974c8116e7d91179a8a6dcbd0721cac0
MD5 db5715837c3e5c9450a5c4fed96be159
SHA1 795481a7ee623d82819220d5ccd239ef8d503235
SHA512 85d756baa51c477eeeeebeb80fe9ebc10771378a660081211ef1473de6ab904e253d5dca74b5972f5f9713b24f507f48957f8de723e41eb0e5559f3376147223
TLSH
T12A51AFF7C3E8866E890156F0AB146E2ACE1D1A59432C3C56C9E4AF1F93F24B1D140A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3e01c9d120b50ced51c3b2e3b2ae9b2cc906a15157a181450034dcfb802d7b61
MD5 0e14a5622210e46cbd1bca1c9abdf87c
SHA1 a994e1c0b7beff47cc4bb3cf32d97ae70fd7083c
SHA512 2355e5a08b6768090f143d2849e836f6af68011d558f97bace4aa8a7e7c30f1c420d9285348ea265481bd350500e3b003302f0957c9813207893a2f935116659
SSDEEP 192:sxZmRqkC/fxscaQZLe8UzodpHJHW6+WNGYoW2SeXqIgjt2J:sxZmPC/fxsVOhnpHbGJSeajtC
TLSH
T1A532C6156D28A93F8CCBD219BB55BF53E7F9103390910E48AAFC8A2C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 696904a2e17ed6e6acfee82366e534a58b3b875ffb5122c3469097c4cfc3775e
MD5 7b9e17875666205732cc7e401e785c0a
SHA1 5e88fd191f8e8da208474c172992197a825af9a3
SHA512 c29175babd7900a7dd16caa34fa5b2ff60df04784cde0216a4b83243d8ce7ae4f5c06e112dc97cecdb0cd9727fd8ecae8dcfb9a53d5fad96fab25b76477af8f9
SSDEEP 192:sxZmRqkC/fxsTaQZLe8UzodpHJHW6+WNGYoW2SeXqIg5ht2J:sxZmPC/fxsWOhnpHbGJSeaPtC
TLSH
T10C32B7156D28A97F8CCBD219BB55BF53E7F9103390911E48AAFC8A2C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 436b09c0f2a9d8977929d236c352ff14de27a9dae9f7421d8df28b6480cd9b46
MD5 6c72947c364bf1d742adfdfa6b6fe0c1
SHA1 7167634a6fa2c0628a9597032688600328863e9f
SHA512 4f5eefb160e5d50fbbb46776c95b2d8219b2f5164a4c28269591c7cbee01edc93ebb1cbafe3725608559a24096e4788ce6b92b3ef17f62f072a30d1260a3812b
SSDEEP 192:sxZmRqkC/fxshQZLe8UzodpHJHW6+WNGYoC2SeXqIg5ht2J:sxZmPC/fxshOhnpHbGhSeaPtC
TLSH
T1F332C7156E28A93F8CCBD219BB55BF53E6F9103390911E48AAFC8A1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 434abbe9ab1c92a3fffbfe6116ba11b6f7b8b2e53f212abf05af92898b2c4463
MD5 0b2fc49a7be04b4a0cf6a38d48b2b957
SHA1 11e3ad96f3021311e70095af28844789e56aa012
SHA512 d03922a5004c348568dc2b018b2255890b5d9f5e75d305ea50fb569b6604fe828976dd4b64268aad0bd27451b51f4a8d7974630336bb771900cdf958d3d28a40
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgD:ST/2dXOJhJlpfnpp3tNXVrN3m9vY
TLSH
T1E8B2335571BB421039FE391891B59B2E064272733119EA2B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 331be259434f272f34753a8b959a983de2779953faee555adffd367cdb500383
MD5 03020510eeee8cd3c813dd1dd02b6764
SHA1 b05c15d1018b24daf333be54a965443c2b2dc6ca
SHA512 6087a6b736e5ce769b0603380b28b56fb0d29b3759041d7514e949bb56a2bd11a7d8972cf8e2f1e4402404278b1fb95045d982776e55003ce5d0e106fd98b2cf
SSDEEP 384:nTiFiZcIB3sN+8TUNTUlI42aKMBovw2fLBCNfunKUpiV7O6R2FeoCh7UWgL/7Iz1:+FQB3DwgasVBCRPUpiV7TR5cO
TLSH
T114C25A32D8A8DA7BEDEA8BD5AB0A3A03DEF44163858C5AC4D9DC5D1D00DB6DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9908655371511c334eaa90da9097eb488d4138f2fa612c3f5bbc1d128fd0b141
MD5 70da0a59920d7c942e4aae7e03a29a1c
SHA1 558a8bb2ada70935c90964972ddd55248e798716
SHA512 d6f4912250b95df97060fb9988e0210ea5e5ab37250eb206fda6b32cf7682d5957ad689ce96a9d687e6fb4289a957ee4c8eea6a343a5835f6a7976a1ff3b2a99
SSDEEP 384:npiFiZcI63sNU8TUNTUlImNaKMiC4w2fLBCN7FW7O6R2FeoEgL/7Izzo9:AFQ63pwgbToBCBFW7TRNS
TLSH
T18DC23A36ECA8DABBEDFA8FD9AB4A7A03DEE00163949C45D4D9D81D1D00976DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ec874812a8af6680b8a631d7d2ae283f4bb18f3e249a9727f10955ef75189629
MD5 17669c3e8a85af69358cb8b2047011be
SHA1 3da9cb6bfae42cc8fe87d0424b995ce1250b5dee
SHA512 0cf6a074c4239fbdfd0d5008857dc17cfcec35ca0679bbd91ba99596b91c1f17ac520825c758c4b48cd9f1cfad1d966d5f545ab225bdc77403009aa38176c29d
SSDEEP 384:nmiFiZcIB3sN+8TUNTUlI42aKMRovw2fLBCNfunKUpiV7O6R2FeoCh7UWgL/7Iz1:NFQB3Dwga4VBCRPUpiV7TR5cO
TLSH
T162C24932D8A8DA7BEDEA8BD5AB0A3A03DEF44163858C5AC4D9DC5D1D009B6DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2a40015ffa9784790f6c5d69e8bd0eb7270f8cd6808d33fe301e8d06c4c07a27
MD5 c0034765af163406add98ff664c2e5c9
SHA1 b9567887dd23d0b5f63b8031b3675638cfd712f1
SHA512 2c12e4dc527be4734f661ecfacad8ed913d0117b0acd71aea3d1d4d60cafb238455758c92e6638f674c95e15f76ac8beaedcbb8eea52e52312f85b285d3d9c02
SSDEEP 384:nCiFiZcI5Fj3sN+8TUNTUlI42aKMBovw2fLBCNfunKU5mV7O6R2FeoCh7UWgL/7G:JFQ5F3DwgasVBCRPU5mV7TR5cO
TLSH
T174C25A32E8A8DA7BEDEA8BD5A70A3A03DEF44123858C59C4D9DC5D1D00DB6DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4bcbc5004d318314726ba81897b605746b4dd0438b6a24e73b059a59eb2b4719
MD5 a77350e37d3427f32e2a485e45f67339
SHA1 2f2db31660a775545c1d71541799a4a57574bb48
SHA512 4ccce87db42f2aa38751cb5bd6aacaf8947d0d2400fcd6307cf0bcaab4b9597b318e9f2c624f88909671f95974529b4e1fb36fb799bb7f270219b08d1b12becc
TLSH
T1F041F858BAE90108B3B76E5A9BF6A96D087AB9732E46D45D10110E4E0672E44CDA1B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1556-198-0x000001DF622E0000-0x000001DF632E0000-memory.dmp

Download