9aad4099e098766aa4be05cfee794b35efcbd8d884f40746b66ca486402eeca3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9aad4099e098766aa4be05cfee794b35efcbd8d884f40746b66ca486402eeca3.html
Size 40KB
Sample260913-kkxtfahd65
SHA256 9aad4099e098766aa4be05cfee794b35efcbd8d884f40746b66ca486402eeca3
MD5 54d416211d502ed0155937a5469a4736
SHA1 1ba3a26248e95bc4d3888090e852c54ed386d833
SHA512 f71ea6335163e17d30c3f87efafc7f65e997b088260e9c6ba896fa8776bff11cc8fe802bb77f1ee5b925f3b2ddd0c85663241c9514d5bda635c23f3cd36d2fba
SSDEEP 384:eJ5skw8hW8Vg99QueqwUtU/UyJnhMhSsRfvZ8MCT0RY2:gvw8hW8VgJG8yJMU52
TLSH
T1AF13A364B9C222230133A37D9BA79608FB74115B820653407EBC27E71FF1964D5AFEAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338055700042820"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{0AA5DF43-4BD7-4580-A68F-5763A4413111}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4812	4864	msedge.exe	85
PID 4864 wrote to memory of 5020	4864	msedge.exe	86
PID 4864 wrote to memory of 5160	4864	msedge.exe	87
PID 4864 wrote to memory of 5160	4864	msedge.exe	87
PID 4864 wrote to memory of 5160	4864	msedge.exe	87
PID 4864 wrote to memory of 5792	4864	msedge.exe	89
PID 4864 wrote to memory of 5792	4864	msedge.exe	89
PID 4864 wrote to memory of 4968	4864	msedge.exe	90
PID 4864 wrote to memory of 4968	4864	msedge.exe	90
PID 4864 wrote to memory of 4968	4864	msedge.exe	90
PID 4864 wrote to memory of 3820	4864	msedge.exe	91
PID 4864 wrote to memory of 3820	4864	msedge.exe	91
PID 4864 wrote to memory of 3820	4864	msedge.exe	91
PID 4864 wrote to memory of 2464	4864	msedge.exe	95
PID 4864 wrote to memory of 3776	4864	msedge.exe	96
PID 4864 wrote to memory of 2464	4864	msedge.exe	95
PID 4864 wrote to memory of 3776	4864	msedge.exe	96
PID 4864 wrote to memory of 2164	4864	msedge.exe	98
PID 4864 wrote to memory of 5624	4864	msedge.exe	104
PID 4864 wrote to memory of 4972	4864	msedge.exe	105
PID 4864 wrote to memory of 6012	4864	msedge.exe	106
PID 4864 wrote to memory of 5300	4864	msedge.exe	107
PID 4864 wrote to memory of 5300	4864	msedge.exe	107
PID 4864 wrote to memory of 5484	4864	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9aad4099e098766aa4be05cfee794b35efcbd8d884f40746b66ca486402eeca3.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffe5debc188,0x7ffe5debc194,0x7ffe5debc1a0
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,8593078745159275637,15558257567858406113,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16668619555591694710,9018065802588816693,262144 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,17287571312164366481,2571313058186401868,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17076968900082027589,17655732628722369245,2097152 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3036,i,15749043143837988211,7719147957039095428,2097152 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,7263045717102376367,12731046702418841114,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,312663241121713824,113010636244822815,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,6772610297198995867,1446928646932027234,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,6772610297198995867,1446928646932027234,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17932458636913839231,16435737224019363090,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,18076188567334585464,16777689388273220064,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,11850942819798438147,7593109169587707567,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,12117324467758332664,16479310300266445051,524288 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5992,i,5980981632871365027,4734815803069050285,262144 --field-trial-handle=2328,i,1228968972734183189,1441351533347168213,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f0b107734afea7f3ce94744be4fd297f23cbb940ab5575595680c0a10270d8de
MD5 87c24e70c07712801c44083cf538d541
SHA1 7653543a47cde07d4edda24eab837a70e6fc0e9a
SHA512 ddbfa7c5df4289c129431c2705c603d35a838a1234742243881ad0e287d2d05093c259029004a2680383a874d7b95c070a7c1cd4f1342eb7505114b496a3757e
TLSH
T12841B1F7C3E8866E890156F0A6187E2FCE1D0955432C3D5AC8E4AF1F93E24B1E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e746e25a192a4c63497b9ed3b546827abd1c215de02e1a5605e678430c4163d0
MD5 755d96e680fca0925b284068dcd98db1
SHA1 4d1f702684f671905afbcc94808e5e4fd3b86529
SHA512 efea20356e8ab0b290edf209ad631d8906a857c462480bf4f1fe19b78fd48ccd3f16797d81b764802633651a183f43a7212ee8d9a9f39dd6f0302b9e5dc81827
SSDEEP 192:sxZuR8kx/f6FsqQZLd8HzodpHQHW6+WNGYoa2SHoIg5KtJJ:sxZulx/f6FsqOOMwHbGdSEgtz
TLSH
T1E842E6556D38A97B8CCBD219FB55BF53E7F9103290910E48AAFC8A2C15E7ADD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d2c7167874ebe04b4a48b0dd6cace8332a3dc0f901581b7e202add42de69949f
MD5 7fcc38a00e58bbc65fc148de14fbe910
SHA1 f96257938fdea468f8fca9107ad6a5ffb5474b37
SHA512 7636e727cfe90cd56403a0ef98456a3977077a4120a0eef43f39c1101160be243cd96368d7704fd703c2560287b9cbd9a0d280222a51b5f567b95a80d5e797d4
SSDEEP 192:sxZuR8kx/f6FsGaQZLd8HzodpHQHW6+WNGYoW2SHoIgjtJJ:sxZulx/f6FsfOOMwHbGJSEjtz
TLSH
T16F32D6156D38A97B8CCBD219FB55BF53E7F9103290910E48AAFC8A2C15E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 87eb5ab89f7cf49734daf249cded7df2cb136e2a20668281d595f0965d608d5f
MD5 d7aa2b351331282f05be88765d7cc7ea
SHA1 0499edf162e04bdf838bc98672acce215e950794
SHA512 58b35ffca13c18681eb57b0abc872dd908e8d40c63e89a0bdc24f22cd76206b4bf168017d13f847872443163417401731e14cff6661f38ee33500f5f1cf52d43
SSDEEP 192:sxZuR8kx/f6Fs1aQZLd8HzodpHQHW6+WNGYoW2SHoIg5KtJJ:sxZulx/f6FsoOOMwHbGJSEgtz
TLSH
T12942E6556D38A97B8CCBD219FB55BF53E7F9103290910E48AAFC8A2C15E7ADD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 9b6faaa19df30a19f6a757b4998b0778b4ec539b35a18facafd624a21a204ece
MD5 b6ea8310f2ead4d4a26d7c6468606663
SHA1 26fe5f75b5c2c5e94e80aa8a5fa4a59c16058485
SHA512 d047f1c6dcbdedbb4e98bbb092b87c2d8185b1065c354cddd45df1529efad8d8c692b718ae1943f88c99634fee35b9628545a5d274be44699c87380ac8691e11
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdg3:ST/2dXOJhJlpfnpp3tNXVrN38rFrrg
TLSH
T158B2215571BB421039FE290892B6972E064231B33159E67B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ebd0a44897e721771fce257cb0093f479f1897b4d64c0022f6471102da6a01c8
MD5 4340b2b790ab3783d176d43126faf531
SHA1 58c2e1cd2aa897485e743c4e57bfca03f4e979d2
SHA512 e086c437a01eb005c19ef2d309aeacb39184b00477c518e860c3cce06f644ff8199d3ac88d649d31238cd4e07752e4ddb73f09ae6a83e18f8ccfe05221f5eff7
SSDEEP 384:nZiFiZcIh3sN18TUNTUlI44aKMyKGuw2fiBCdvs1iZsa+VY3lkgL/7IzOo+:wFQh3kwgQbEBCd0iZhgKx
TLSH
T11FC24A72ECA4DABBECEA4BD5B74A3603DEE4416395CC9AD4C5D85D2D00DA1DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7b975a62b4cfef20fc7b96df7542edf7025e12d45222d3f6f837526929be0641
MD5 62bcb75c096a6e71b45f323b860864b5
SHA1 b33ba5d9f0046153441ff8e623ac5c52e16e57d1
SHA512 820b8aaa069b3b7a8e3b64c070772a44dbc15448ecaacf38bf4d97333e7534dc63eae5b4451451bb4ba20006e69ef14a113bc0656cd60c728b8ddd47777dc0cf
SSDEEP 384:nXiFiZcI63sNp8TUNTUlImNKaKMi74w2fiBCdv4FR7O6R2Feo2gL/7Izjoi:SFQ630wg0dsnBCd4FR7TRvR
TLSH
T14CC25C36ECA4DABBEDFA4FD9A74A3A03DEE40163959C5AC4D5D80D2D009759D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 914410738554db9dca96e66dc8fc896829b37f3a6a83b922eb7d07ac8595d9ed
MD5 34924c6a69eaa03fb799583828bb2c15
SHA1 57b63c223b481fa2a1b8891203c0bf84d0383263
SHA512 7edffa25f2bc46ef80ea47b659348deafb8fa70b9b2e549d336bbf3a498a05c70ad6725fde765850451071f0aab78ddb040d528422fbf3196f573b929c431a8f
SSDEEP 384:nNiFiZcIh3sN18TUNTUlI44aKM1KGuw2fiBCdvs1iZsa+VY3lkgL/7IzOo+:EFQh3kwgQGEBCd0iZhgKx
TLSH
T1E2C23A72ECA4DABBECEA4BD5B74A3603DEF4416395CC9AD4C5D85D2D00DA19D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ef8ab3b2297cd0a4566340823565430468335ba57bf7aada2c218bc8b6d01a0a
MD5 f8851cd988c5d4033512d8b368247e95
SHA1 242b4d2fd83b1ebc095aa099dea3c5c7916aa01d
SHA512 5c7e6bd68785de45f7835db402745195b33038af3a85e412b35ae469a9211d3f7660ba5f0653cf3a1cedf470f0fcf06ea0e715ff865d637391992e0c5e57b530
SSDEEP 384:nmiFiZcIYf3sN18TUNTUlI44aKMyKGuw2fiBCdvs/mZsa+VY3lkgL/7IzOo+:NFQ23kwgQbEBCdsmZhgKx
TLSH
T182C24A72ECA4D9BBECEA4BD5B74A3603DEE4416395CC9AD4C5D85D2D00DA1DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1792607d9d50bcbf0bc4930ef126473c532e3b1d8e660e567f319f49bc42be8b
MD5 a5f2db8649c24df1fec20bc2b4aa38fc
SHA1 961e9794cad64dccb8982bcaea6fb06a091f6c37
SHA512 06e12909e020d90c18e5d435d1e330e36c603fbc0159ca1d5f76453786cff445e47055947dee8b9205a4da4321abfafb30bd4f8b546537e2d72ab5f8e119363f
TLSH
T16A412C5CA7F90148B3B37F5AAFF6646D487B78272E06D49E00110D4F0666A44C872737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2164-193-0x000001DDACC20000-0x000001DDADC20000-memory.dmp

Download