ba25c461dc3a6d6d1d9e4a2fd4c290932080a2b6dc5106611cf0cd5ef2e82197

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ba25c461dc3a6d6d1d9e4a2fd4c290932080a2b6dc5106611cf0cd5ef2e82197.html
Size 105KB
Sample260912-skshqadf42
SHA256 ba25c461dc3a6d6d1d9e4a2fd4c290932080a2b6dc5106611cf0cd5ef2e82197
MD5 a62ebf31fbbd556e12bc9faf3cc7e97e
SHA1 385635b4054c9e35635c4c127d774782e02cd4d5
SHA512 ff53dd48bfef956dac6b63949c4cfd9615b3326354ad41944da1d6888b7e244381d09f929bc2c40dc82d890009f8101d6a57c1c2a4a26830d07838e006be90b3
SSDEEP 1536:DPxaYn+hJvsdRmbM3LIvKHuClNQzTtXNoLxa8JybEaoVbEaoX6:j80QBNJaydoVdoq
TLSH
T1CAB3928701204CFAEFA14DB2425B58673D2C5437BC5791B9E3FD8FA72B41DAE034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1972	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338348248866425"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{582D81AE-87FC-4DB3-83AE-B91DEFB5FEC4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 1216	4696	msedge.exe	87
PID 4696 wrote to memory of 1972	4696	msedge.exe	88
PID 4696 wrote to memory of 3400	4696	msedge.exe	89
PID 4696 wrote to memory of 3400	4696	msedge.exe	89
PID 4696 wrote to memory of 3400	4696	msedge.exe	89
PID 4696 wrote to memory of 3092	4696	msedge.exe	90
PID 4696 wrote to memory of 3092	4696	msedge.exe	90
PID 4696 wrote to memory of 3864	4696	msedge.exe	91
PID 4696 wrote to memory of 5088	4696	msedge.exe	92
PID 4696 wrote to memory of 3864	4696	msedge.exe	91
PID 4696 wrote to memory of 3864	4696	msedge.exe	91
PID 4696 wrote to memory of 5088	4696	msedge.exe	92
PID 4696 wrote to memory of 5088	4696	msedge.exe	92
PID 4696 wrote to memory of 5408	4696	msedge.exe	96
PID 4696 wrote to memory of 5408	4696	msedge.exe	96
PID 4696 wrote to memory of 1572	4696	msedge.exe	97
PID 4696 wrote to memory of 1572	4696	msedge.exe	97
PID 4696 wrote to memory of 2292	4696	msedge.exe	99
PID 4696 wrote to memory of 3540	4696	msedge.exe	105
PID 4696 wrote to memory of 2408	4696	msedge.exe	106
PID 4696 wrote to memory of 5388	4696	msedge.exe	107
PID 4696 wrote to memory of 2672	4696	msedge.exe	108
PID 4696 wrote to memory of 2672	4696	msedge.exe	108
PID 4696 wrote to memory of 5220	4696	msedge.exe	109
PID 4696 wrote to memory of 5220	4696	msedge.exe	109
PID 4696 wrote to memory of 3300	4696	msedge.exe	110
PID 4696 wrote to memory of 3300	4696	msedge.exe	110
PID 4696 wrote to memory of 3048	4696	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ba25c461dc3a6d6d1d9e4a2fd4c290932080a2b6dc5106611cf0cd5ef2e82197.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7fff0942c188,0x7fff0942c194,0x7fff0942c1a0
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,6119361519059142345,3790360464214470929,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3483336534461454296,16181277235196789472,262144 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,7244795248450546154,1121018793139342878,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,14451117721946222133,7722499045370011885,2097152 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,14372834154589025963,6741393604294865314,2097152 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,9560685141408402922,1758101344360984322,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,4287557509652921588,4185579851733348181,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,804596122755302845,334218586004869190,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,804596122755302845,334218586004869190,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,351137350906112857,14853772007703193288,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,8786043971020114662,3688965032838940251,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,3627213112549678736,5964453512195988739,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,14479698205256728104,13324252303298245132,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2920,i,17823322154702921439,18388287202069317028,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,9830109604259906240,12161668007889400751,524288 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5984,i,3429445790432538346,15878096613711355725,262144 --field-trial-handle=2332,i,5376720967760612664,12650063758710701745,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e592612fec54e3b288cf277d3fdfdb18968d13463da4429e821c04fb7bac8eb2
MD5 65d0808195130d56b75d2787a1634b36
SHA1 50a052901ea865c7e29498b0e0907760e4afe72b
SHA512 65697e530f59eac862adf64b61d0621eb13a02d2fd392ae21ac702f84f0646f36d73702c6eac5f07cdc8bddfdc3f742d1230be944cb86f68f3527a5953a1883f
TLSH
T132E0788409C5CE1DD140F74741585B0C818037AFD7CC6A451744C49C7107D50F3D7DE0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9c9de74a2a295354225a1d7c8372b2d2a051210bd3485bcbe8ac84e538ecfab3
MD5 3e2e259a1d1ef3af58c0ff9c76ab0b8f
SHA1 dbb071773be8d29d97bf6ca9db86bb916756eb87
SHA512 f14f287452e2e4f314d05035fd31819dd87edb739ea59d12d11a079c230b34d4ba954a3ed4990f903e35ec273840dd9598759960ce6069acaf8d4e6bc5d83535
TLSH
T13BE02BE9CC16AC3B08FD571D50554641EB4113472B80884B3B3DD11E8FF1A36958A86C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bf538ac3be5851b564e4639cf4cdf33ba2f9a1f155eba21f7bc5e877ed257ad0
MD5 aa74297fee156ec22f410daa67227c84
SHA1 982513cc87050fb621da283328b204077cde7a6f
SHA512 ee6b24676dbc972fdb0ef4fb09668bbb5484ba05ea83317a18bae664a157f22d07e714daa60649242315eaa65ba23fac8ed7a8669810d7dd64e86d758b47fbd9
TLSH
T13C517CF7C2E8866E890156F0A7246E2ADE1D0A55432C3C5AC8E4EF1F57E24B0D24159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5983dd040f8fd449ee61b29d1426b0a0ced8baa6291923fb2613cfbfd60a552e
MD5 4090017bd9298df8c207f28a8ec30bc1
SHA1 ecd83288f94e142e0982f6f96e3807d7bf372435
SHA512 d9b45289082c82ccff0310d64408f199ccafd4d8d95d45636fad478eeb2ed71bd4f598960564b5234f532dbb4e8f9c55020c038f2dce62775d61a8def03986c4
SSDEEP 192:sxZ/R6kr/fYs/QZZAfozodpHVHW6+WNGYbIaFYZduaIgjRJ:sxZ/br/fYs/OZGb1HbGFwYZLjb
TLSH
T10232C715AE28A93B8CC7E619FB55BF53D7FD1032A1951E44AAFC8A2C04E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 14fee23993baf7fdd5e4f3e327f9bb3f59da4a820d433ee05fb746b5864dcd79
MD5 18c4563b92c4de20e9ef34ba89edded3
SHA1 870c13fb3895e1879830820405d4138466d45232
SHA512 72b9b6464f722f47918ace2ee2e66390e87392a9430901587566768285d6c8e0230df948dfe734ae4f789202da38b19e5d1372fa784bca047731f5d91958d4b2
SSDEEP 192:sxZ/R6kr/fYsPQZZAfozodpHVHW6+WNGYbIaFYZduaIg57RJ:sxZ/br/fYsPOZGb1HbGFwYZLFb
TLSH
T1AA32C815AE28A93B8CC7D619FB55BF53D7FD1032A1951E44AAFC8A2C04E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b607692f8fbd071761b6a89cb0553fa958ae0916e6714c99b884b49036e0682a
MD5 69e38f5b396ca9d6722ad089e5f12328
SHA1 63ec7c73c23a91fc7cfdfa8f89c84789a1514b2a
SHA512 75ba79b62bcf72bb39c7db3b84ed517a9d407ccb7dba147cab28ad466a1eb04b792ea2300a92d8979929103bcd1468626c2880b77fbfc5a3cef07c843ad65cd5
SSDEEP 192:sxZ/R6kr/fYsPQZZAfozodpHVHW6+WNGYbIHFYZduaIg57RJ:sxZ/br/fYsPOZGb1HbGFlYZLFb
TLSH
T1EF32C715AE28A93B8CC7E619FB55BF53D7FD1032A1951E44AAFC8A2C04E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1f23a1348f687ad9f003ec0e99dc3bc696643ff7b2485b0671033cb68c396560
MD5 470b6779acc5bade1da277049e3f83cb
SHA1 a403b75f1f2794136c2dffb68a3613aff9ce2803
SHA512 e01e6d773f361bd5f3a83112f0ea94053ae0d0db85edc0eb3051ab587429db771f3514875b69500c13c7473fff79ac2e094fd7e02515a76f38d2a9cc5fafc40f
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXorvC:OtfFvpopPxrB4RhfoTC
TLSH
T195B2361571BA021138FE690881B59B2F464232733259E73B7FBD14A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 949de6a2c1aafb42b167bccf5f84551583e5f21dd68d824aa4ef718e5b8f533e
MD5 6314f581b715f9855ee5a78d360f5f4c
SHA1 e305d406fa4797394b3375406d3ff089a76beeb7
SHA512 a06c2e152c20250d4224c61947bcac9a1f94ce31dd988afab427258020205e8cb6ab9adbe491e0fd5b0f50f8f273f0fe4cecc351825bc78e1d59c47a165a16a2
SSDEEP 384:nniFiZcI/3sNZ8TUNTUlI4l5mgj2LKzfMBP0q+GctEv7O6R2Feoth7UtgL/7IzYe:iFQ/38wgNpTBP0CFv7TRYze
TLSH
T198C25B72E8A4DDBBACEB8BD5AB0A7607DDF44153868C9AC4DAD94D1D00D719D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 51174cbe9254cb65a492ba668b866f0e4165c2ebd6e258f5a768cd0845662faa
MD5 44b08be3913fc536e725e982ae619d06
SHA1 02013d4f3f7980a856bb752cbb9a0a06ef1f4e8a
SHA512 4beecba07f52e8a44cd917590b66c42001b6de5be4b8a954973576af85c529a76012d14991924f9c285927f79af39a0aec03f2c1398393f15d49bec4e01591cd
SSDEEP 384:ntiFiZcI63sN18TUNTUlImX5mg5jnKzfMBP0q1psa+VY2NgL/7IzToe:kFQ63QwgT8vBP02phglN
TLSH
T1B2C23936EC98D9BBECEB8FD5AB4A7A07DEF01163819C9AC4DAD85D1D009719D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 610a5ce8aa6158878c5b63a95edc2fa66249d5c5986f510295249f4a59ac919a
MD5 f5a2ce9b8f4876160c717573c079db04
SHA1 2838fb92bd6db2132dec418b4b2168fce70dca8b
SHA512 b82277ea22393f73b39b5f8d3e657bc0a112577c651102eff532c3b0ece1e6a02ac144c41b6cff6fa85ae1e0bc83ff0f980497581e588d54d11ebcdbb90b91e9
SSDEEP 384:nhiFiZcI/3sNZ8TUNTUlI4J6Q5mgA2LKzfMBP0q+GctEvsa+VY2NgL/7Iz4oe:IFQ/38wg9F6TBP0CFvhgWN
TLSH
T1F0C25972E894D9BBECEB8BD5AB4A7607DEF0415386CC9AC4DAD85D1D00D719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4e505fdad9a183d019e873c900b1b60e7a054c071f0b0bd51a4238b8d4c929d0
MD5 4918b9b56008293bf7193136437ee89b
SHA1 c536e6339369771bd1d9d1eb8fe784eb5fd17225
SHA512 7dcc7d795f13a525c75a503c46e0246a37ee23c2149170944d3a959bb6a9a112389b88c5d83c7a13dede92c0942b8c17f2df289b9c68de2590f5f9f9b57442e7
SSDEEP 384:nCiFiZcIjJ3sNZ8TUNTUlI4l5mgj2LKzfMBP0q+Gctxv7O6R2Feoth7UtgL/7IzH:JFQ938wgNpTBP0Cmv7TRYze
TLSH
T19EC25A72E8A4DDBBECEB8BD5AB0A7A07DDF44153868C9AC4DAC85D1D00D719D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f45f10f1cfc1eff2664f3a9ec6fa548c785ac13c41ab699779f26f245457d224
MD5 c34ee150f88710508f379f5904afa035
SHA1 950805eae332e148919f6180c2c947de5c82feca
SHA512 34a01c6f571cab96cb527c2e2907ab991985cf86a634698b2fd2024e6200f7389643030124b3518718c9efee1c6b99f81772f2fa5415a25ddc73d3fe1797200e
TLSH
T1CC411C58A6F91118B3B76F56ABF6686E487B7C772E06D46D00010E4F0A26B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download