de2adf3ea0a602100afbcfc98680164e1e00096b05b8395fd8239068246acb29

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_de2adf3ea0a602100afbcfc98680164e1e00096b05b8395fd8239068246acb29.html
Size 1.2MB
Sample260913-ej1wtacj9y
SHA256 de2adf3ea0a602100afbcfc98680164e1e00096b05b8395fd8239068246acb29
MD5 3b578258ead6775ca9966919d955566e
SHA1 12424a69a3b9081402de3ad0e5c9c9c0789e1299
SHA512 9cac1942888f4e38a9c70bb0e6058ab41baaa8fc7523b48caab6c73d01cdd56b04ae77c2f82d8f88245557ea664df80ef95bcf7ab88996708e98e1614ace9fd5
SSDEEP 12288:4CeSXyMTNrjTEY0+kC6bhxs7jGhalK4W/:4CRyyjT3kC6bhxsQalK4W/
TLSH
T17F45C6DB9230717FF833A8B596C8A949F3988CC1E5164AB5BC70A61387DBBE61351331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338196405825980"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{B78233B6-34FA-489A-8B3B-6395A45AF2AA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 5672	4160	msedge.exe	85
PID 4160 wrote to memory of 5548	4160	msedge.exe	86
PID 4160 wrote to memory of 5332	4160	msedge.exe	87
PID 4160 wrote to memory of 5332	4160	msedge.exe	87
PID 4160 wrote to memory of 5332	4160	msedge.exe	87
PID 4160 wrote to memory of 2180	4160	msedge.exe	88
PID 4160 wrote to memory of 2180	4160	msedge.exe	88
PID 4160 wrote to memory of 4384	4160	msedge.exe	89
PID 4160 wrote to memory of 4384	4160	msedge.exe	89
PID 4160 wrote to memory of 4384	4160	msedge.exe	89
PID 4160 wrote to memory of 1908	4160	msedge.exe	90
PID 4160 wrote to memory of 1908	4160	msedge.exe	90
PID 4160 wrote to memory of 1908	4160	msedge.exe	90
PID 4160 wrote to memory of 6060	4160	msedge.exe	92
PID 4160 wrote to memory of 6060	4160	msedge.exe	92
PID 4160 wrote to memory of 6060	4160	msedge.exe	92
PID 4160 wrote to memory of 5660	4160	msedge.exe	95
PID 4160 wrote to memory of 5660	4160	msedge.exe	95
PID 4160 wrote to memory of 4036	4160	msedge.exe	96
PID 4160 wrote to memory of 4036	4160	msedge.exe	96
PID 4160 wrote to memory of 4316	4160	msedge.exe	98
PID 4160 wrote to memory of 5296	4160	msedge.exe	104
PID 4160 wrote to memory of 4296	4160	msedge.exe	105
PID 4160 wrote to memory of 6068	4160	msedge.exe	106
PID 4160 wrote to memory of 948	4160	msedge.exe	107
PID 4160 wrote to memory of 948	4160	msedge.exe	107
PID 4160 wrote to memory of 3664	4160	msedge.exe	108
PID 4160 wrote to memory of 3664	4160	msedge.exe	108
PID 4160 wrote to memory of 2784	4160	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_de2adf3ea0a602100afbcfc98680164e1e00096b05b8395fd8239068246acb29.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8aec4c188,0x7ff8aec4c194,0x7ff8aec4c1a0
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,4901277200207703019,15090676925164814737,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,5502786699010174926,13779184232791925869,262144 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,17803537882423891014,17175031743373260290,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,15866664741040409147,9762741150339921134,2097152 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,4951367800269052344,13196849633067759809,2097152 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4912,i,4256818849541699207,10062916177947242608,2097152 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17328547521204331976,5014975605811513427,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10494248672824085768,970351198587127844,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2108438438696091030,2994230794284231378,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2108438438696091030,2994230794284231378,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,3086770632069330890,4844038936048349586,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,13520261639177929397,6836358716936383355,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,12241086732542111656,17448210592777984176,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,16593687109004631604,8030525827541682756,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,15443877127074661236,12071813183951237199,524288 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,13082746770500322408,11267644277059936508,262144 --field-trial-handle=2200,i,9799669285787071859,3083965179804747078,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

030eceaf-ae56-42e0-aa2b-165c2f55acd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\030eceaf-ae56-42e0-aa2b-165c2f55acd6.tmp
Size 11KB
SHA256 7cf1ca64255086c0f79ef3178bb95176a6da7ce3361e36aede44c6ac5f120e99
MD5 b214208b3a28ebc4f26c6c6bae9fe310
SHA1 63d2ee08762cbd4fddb68753827d12fda8dd0400
SHA512 bad47e7acdd0c9ad24a2f3baa271e4788094a4024afe80b4a1a2247da91c27d8b7228a02828dcbd1905101d1fbb9ccf3d0b3baee64f3081b11ab1ac6be59f143
SSDEEP 192:sxZTRNkJ/fOskQZLW8jzodpHYHW6+WNGYo62SzJIg5N4tWJ:sxZTsJ/fOskOZ44HbGdShwti
TLSH
T1A432C615AE28693B8CCBD219FB557F53E3F9503290D10E44AAFC8A2C15EBADD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8d351e60f6633db8bd20798865ee48b08393d2f52375fe88cc9089dd325a92f7
MD5 1782998e106e34147bdf540fbd7f4b79
SHA1 dc78bc280ee6ae222c5286c61b060646bb09a814
SHA512 93c4f18ac5a12cde8340059d9204632a2ef07a28751339e62ec310b593ac1948d83195968af239ca2c2d760c9440a73c20a3f6791965655c6bd2671a40e95680
TLSH
T1C341ADF7C3E4866E890156F0AB246E1FCE2D0A55432C3D5AC9E4AF2BA3E2471D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dcca980f9137128a04db9a27462ba69b7a6f97b37b0080190d502a2ed305cf80
MD5 1f5283d58a913936bf1ddda126ae02f0
SHA1 362c3597919e706142fe51f100d9acddd24b50fc
SHA512 d7ceeb8cd05a4fd66960744e6b8583f5710c9eaf05eb4043d20efe55dc0ef72b5331f5cb677b75a2ad5042ae70a4ac7238b5bb97d087e0207fdde118ae71d8de
SSDEEP 192:sxZTRNkJ/fOsvaQZLW8jzodpHYHW6+WNGYoW2SzJIg5N4tWJ:sxZTsJ/fOsCOZ44HbGJShwti
TLSH
T1D032C515AE28697B8CCBD219BB557F53E3F9103290D10E44AAFCCA2C15EBADD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e5f56a1054411f1c730747ee41adc0f718cccec5d8407ffa876fed07236c8292
MD5 67b91095e4534b45a261ba9391dadd5b
SHA1 93bc255dd4b01ffe67c4aa6aba226ea88e5fda4d
SHA512 1ff192b5c8c54abb848d162f4071d2c911f08faf7a5d494b7c1f6fa7cc0cc716c9e68116720f79deed1d2918a02eb965fafafebdaeb1e58ef0752b856d9353bf
SSDEEP 192:sxZTRNkJ/fOsVaQZLW8jzodpHYHW6+WNGYoW2SzJIgjtWJ:sxZTsJ/fOsIOZ44HbGJShjti
TLSH
T1F232B615AE28A97B8CC7D219BB557F53E3F9103290D10E44AAFCCA2C15EBADD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 56a9f56a5beb37c5a0b35ba7afcb8659fb45c7cc24327a1cbf932b17bc43f2a2
MD5 e50295fe547dfcb154768a7a27764a7f
SHA1 e5d807669bb48e06a536abb59ef5a32029b1e5f7
SHA512 e21819326b0bae8a9b37b6ccf7e8bf1592e2e40bd50d73e2386ccb458ff4bdf5d494c56de7a526b13e9afdf2b606b218d3334179fe13ec066e0c386dae352c82
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3gT1oLUXbxlp+lyp:SL29ObJffppdNlrtgBoLUXbxlp+lyp
TLSH
T10DB2111571BB421039FE391892B59B6E068271733119E66B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ec9a37f8dae4bc4baa5ed11fb26e7a52cff02ef753bd6d19534d016415368a85
MD5 4cd60875cc4bb7333b5b745442f7bbfa
SHA1 671d08d4a49e58df094bec387334603464c97119
SHA512 3ed0cdba879ba27c37beaacee064e548f8da6ecb00bf2a917818dfb9203f52339d969d65c6c8ce8192ecaf2e15398b3d377ecc2581a6ffc7b336e1d70175c818
SSDEEP 384:nTiFiZcIRsNu8TUNTUlI4BaKMAtDw2fLBCc8ibqRKQl/sqctkiC+sa+VYPd7UXg9:+FQRHwgL8pBCcX8KQl/nniC+hg+1n
TLSH
T1D7C24A32E894D9ABECEB4FD5A70A3603DEF4426399CC9AD4C9D91D1C00DB19D530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 260bfb4772eb4f8e32d55a93a9d82f95931992d9e7ce0607d84c7d18bdbdb631
MD5 832ee0a4b573c67d299911280f678763
SHA1 98f4cbdb8ed4378ce46176c294d09ee08815b7f5
SHA512 edeb24ebfa2015bbc4613b3159ed29e2680f62300eccac2f7582a1050f3f23cdbad95feed9f2b8e8d984f30c3e1013c8fd8ed49c987e8f7387461caf429ee7a2
SSDEEP 384:n+iFiZcIRsNu8TUNTUlI4BaKMCtDw2fLBCc8ibqRKQl/sqctkiC+sa+VYPd7UXg9:VFQRHwgLWpBCcX8KQl/nniC+hg+1n
TLSH
T1B4C24A32E894D9ABECEB4FD5A70A3603DEF44263998C9AD4C9D95D1C00DB19D530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 257200c258a1ed510d747e47a2ea8efe643683d3d810c55c6ea3ba81127825d5
MD5 446691e58b055d6dabd3a81004cbd070
SHA1 fa75df14cc214b508ce5d068448492cccc7e91e5
SHA512 12e4d8746b6bd8fbed71bcbf84d8ad85e809f6a99975290f12f169db6ed0a24dd57b256fbe0d57e495a91b78a0f7a4e5f921dc0d40d87a86ca7416f61256d611
SSDEEP 384:nmiFiZcIFbsNu8TUNTUlI4BaKMAtDw2fLBCc8ibqRKQl/sqctGmC+sa+VYPd7UXi:NFQFHwgL8pBCcX8KQl/n3mC+hg+1n
TLSH
T1CDC24A32E894D9ABECEB4BD5B70A3603DEF44263998C9AD4D9D91D1C00DB19D530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3ae47e69ab7c2897df745cd86005c8ed9e57392aecea6f2832a4896fbe849ab7
MD5 e7dd4a335c8b23977f5be60831207969
SHA1 7f900b01a9d92250100730d775dbcc9d3fefa3b7
SHA512 6f5d38b4df435c53993852b3b3a54d83b4e150e32c78c3800509e0b954947c24934abd8a6a5699dcc4edcb585f31faa41e228ff0bff2a47fc5e6c6dbf54eb24b
SSDEEP 384:n8iFiZcI63sNk8TUNTUlImOaKMiY4w2fLBCc8ibqRKQl/XFCCsa+VYsTgL/7Iz3r:nFQ635wgaRoBCcX8KQl/XFCChgNr
TLSH
T12BC25A32EC98DAABE8FB4FDAA74A7613DEF40163959C96C4CAD81D1C10D719D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 040cbc5c0d5ca3163f215156e17e3da33e54b2ba87a6a6f63c27bca9386fe1b9
MD5 8af505d82ff6f5dcf7d9abe1b4551a52
SHA1 25a157997cd31f35b15bc27f1ee5baf98469cefd
SHA512 f8981d50410ea5a2a792cb97f4ac0c43c21c4bbb3fb22ddd4f607f78b4b65e06895ae08767ea763e549c2f61a5f27aa51d64bd225f91175fbd0d7b6e0068526d
TLSH
T1D0416858B6F91148B3B77E16AFF2A86D487B78232E06D45E10110D4F0626E40CCB2B33
MD5 SHA1 SHA512 TLSH

Submit Download