ad65ec3407e73dad76b14eaa34babd904cbbfdc56ba4d7828f5d095b23801d50

Analysis

max time kernel
144s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
10/05/2025, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_010bd921a56c42ff3ed7aa029a9c5fb5.html
Size

28KB
MD5

010bd921a56c42ff3ed7aa029a9c5fb5
SHA1

a008f043557db8a63078bafc78cd6dcb41df9d31
SHA256

ad65ec3407e73dad76b14eaa34babd904cbbfdc56ba4d7828f5d095b23801d50
SHA512

582d2fa664aed8346e61206af589f85096f891bdd763567161c243f46425a4f1f4f8079cb29b72b4c65789badbd9516b7253ad464b5bfd4a3e5e8fdf85522706
SSDEEP

768:awMHwx8RCMxYEVvixEmiDWHxm8LuX3PPaX5HoQKGNaQaUeqkVZNG26aXRfWRy:awMHwx8RCMxYEVvixEmiDWHxm8L03PP9

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_844878822\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1585449355\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1585449355\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1160814753\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1160814753\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1160814753\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_844878822\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1585449355\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1160814753\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1160814753\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_844878822\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_844878822\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_844878822\deny_full_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133913321670541426"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3588213599-686740421-4058676312-1000\{DEFE7E7B-4FBC-407F-A602-FC0D222E4C65}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 1028	3616	msedge.exe	82
PID 3616 wrote to memory of 1028	3616	msedge.exe	82
PID 3616 wrote to memory of 2992	3616	msedge.exe	83
PID 3616 wrote to memory of 2992	3616	msedge.exe	83
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4700	3616	msedge.exe	84
PID 3616 wrote to memory of 4824	3616	msedge.exe	85
PID 3616 wrote to memory of 4824	3616	msedge.exe	85
PID 3616 wrote to memory of 4824	3616	msedge.exe	85
PID 3616 wrote to memory of 4824	3616	msedge.exe	85
PID 3616 wrote to memory of 4824	3616	msedge.exe	85
PID 3616 wrote to memory of 4824	3616	msedge.exe	85
PID 3616 wrote to memory of 4824	3616	msedge.exe	85
PID 3616 wrote to memory of 4824	3616	msedge.exe	85
PID 3616 wrote to memory of 4824	3616	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_010bd921a56c42ff3ed7aa029a9c5fb5.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x30c,0x7ffa97cdf208,0x7ffa97cdf214,0x7ffa97cdf220
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1764,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2256,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2312,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4136,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3444,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=736,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5652,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5724,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6096,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5112,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=884,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5812,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5572,i,913824913622643334,13536339554924489454,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
75092eb3d74139ddc4cb6401ce331a05

SHA1
80a3b43b6225d7d2f15b356594607c3e01547c80

SHA256
ebb3a90f6b130d91e888ab2a577b5ddc2d5bd321565778ae4053ccef2c3bb2df

SHA512
8101707e6727592c6bede6b64a377ce2acfab9b2d73a83fe96119b845ae6b4684db5edd430a57a9ec824a3f1225d11046c537b0e379a0e4f42d4966a7c0b9104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
108KB

MD5
06d55006c2dec078a94558b85ae01aef

SHA1
6a9b33e794b38153f67d433b30ac2a7cf66761e6

SHA256
088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd

SHA512
ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d17d69cbe83e7779f4a54b0c056ed4d0

SHA1
05838724217304ceaa329281df5651e6d6bd857a

SHA256
65ceb7b8e3fe95e3475eaa67649b081e92d09824ddcb3eab7cb9e0a176b6ce7f

SHA512
70797972e0e2c8ec36630ae5882cd94ab285143c48022d9e0b589c8323d680cb52d2aebdaeae0bd19ac9cd44921124634d5ddaaa9673a35e19632ba666668a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
21a1b4b43e411ca89dd362db55641bf3

SHA1
d224792367cb9bff9cb4167dea2ef54a551bb125

SHA256
40a40869004a0e17441fce06380c4df376b8a2d58e8969f5d711f44446fe890a

SHA512
9c1ee9daf2a6f9ff2540f606ea1826ff4648157ebdb5bd2db42a7c3f4bad765f6d0602e6ee748d64ad26834a3784ea6fb3658c04ffb5c95b7f4db057af3ebc08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
18debba8f284f6e6fa38bfa007985635

SHA1
225e28fff37f954d6c5534f7e58c94fdf9ca89da

SHA256
f0d48fe96e006dd95341248387b8d6ed05aa458320c780aaaf28f6f22dc20b07

SHA512
7becd9732831ff7bf2416d7fb0e6c8c6bcac0f8c5e40987560b4f62420bf788feb3eb14234e5bf61c26e192f0b17f1d8ed40946846bc1dbe0c0f6c186acb2071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
b872b64917a01c48269cf059543fefab

SHA1
886becd368160af687fd200abf98c2607dff2fd0

SHA256
d0e7a1e857ef35a59a503a21a4c0cde27a3f7e34c6a515f9fabf4978c359ebef

SHA512
49ef4f0fbbdc07d041100905559a821d7194806d389711a13ed22923fe396a7c527273d8bb158feebccccaeefbcf44f841111f349d837a4cc73cf6f875711b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
c64b79a6b3d1f4e4a523a1f26641174f

SHA1
1fe15f878f478c9946c410edffe5f576bdef9b1b

SHA256
7fe2ea6fca2d1cd6874c9eafbd9b4de83d0775b4875d9a31a667b6204309512b

SHA512
54023acd4022ffd5037fc2674d2ed652114d713a346c26a410990193f7c7c0ac7cf52bd355e63bfe068b4ea7f3830f6776eb651a16562630cf59069308b59003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
462B

MD5
076cb4eacca9b1ed32f6e079fdadaea9

SHA1
abcd501f9dce79d231284a3a6201ecb774778d9a

SHA256
4af6cf09ade90d7a50a745f29b3a343ad1f23cd96fd80ef7e3b1ae8931f04ae5

SHA512
2939775afe57831b708997ed831ba359fc24bbc94180e21ef86839ccd87f57cc628dc67f53ba8ccb11ab96bd94aa296801b5df42043d10635549be7ebd245ef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
53KB

MD5
4df2b4e78e8e4cef4441a7a1db2d0d30

SHA1
786d51260dbe8a9fbc6b8be9d71c7ab6f74acdbb

SHA256
b465276f1e4c0eca028797cebe761e1689f60e07320ef20a19bb9136b695e82a

SHA512
fc591732c1ef20a3e556b31b129234fb454e1535a831c0aa85da35a820f8bc01dbfc418c762817e15ee6f2b4eda37e1e269539e5dbfe4974b438533a31374b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
48KB

MD5
326df04c0c532a9140fea90fef9af7ad

SHA1
934ddc228776652abd8d2dcdec4736341a4e4cc6

SHA256
69dece69d08e80403f88d30b7683a02b6ee83926d7e8b78fd3e88fc3fe3ef291

SHA512
a2a3d6be5a8ae9d46d4dda05ddbe823a9e9cb2d7fbb729dabd02587044dae2afc27e0b27be463d7a9bea3e47d82d5be71319d3dd3b36d8679e8b48b19d953765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
376061cd86105f518c42df7ac9d5afe1

SHA1
b2474fc1da74f65009a1e2f6b5ad8df29735bc62

SHA256
2adecf715ecb69747887411358ec03f7f6e8ff81c8bf37c06ae681a3a78466f3

SHA512
1cc37d683efd9671aeda49c295ddb17d1066c40d2abbadce7f435c8e36f23316069812a69a666ce2a61cc9c7f99f467626f586f652b486b7017f41dc3f27b413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
48KB

MD5
fb9d6c45faab8245072f7eba254e63e1

SHA1
968163140d4de3f7063580731c61a3f8dae88d09

SHA256
62ef0d489602eb74570df20a683209e5f2b18af0778163bb9c44d217bf78640f

SHA512
e24f01b751aa625c5f80e0a92e2f6a9bdd7488126f5af6af894720a012a61829cf9552095cf1b0be072407cbcff38637d97212edc54d6961263ce5d4e4ba8be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.5.9.1\typosquatting_list.pb

Filesize
67KB

MD5
a50b46aa311787328482750c251d2633

SHA1
eaa327f9a89e5ec13301979f4ce49a36fc871049

SHA256
019b9efc88e3e5939912472d7a9e43a8d9b675fff7ebf9b7b445042f6de4b721

SHA512
a6820b29aa645abebeca3683ceb91372d69d8e589859e03f653ad6b2f3470ce2248603ce265c5d11f3da4833776d22493f3371e8e297591b678fa364bb5dc149

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1160814753\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1160814753\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_1585449355\manifest.json

Filesize
117B

MD5
ec2d07974ef45152a83c82d09a08e138

SHA1
cdfca8778648c74844b359b2d0f1d405302de8f6

SHA256
bd6ad3cd015f36a4958892945f666703aeb10b2999422f58b699ba2d0895fa87

SHA512
a9ec4562f90d2400229c6b30259ba569181398e20ede3dee4e8199a3c46f7607de5f78ab2ca115d83e7296f4e373625790ebe00108f1d0568b8f6f42cbc26dde

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3616_844878822\manifest.json

Filesize
176B

MD5
778202dc964e7fb0ab5bed004f33fb14

SHA1
932ed013275e2c1172575885246c937c7cca87af

SHA256
4474f08d1718da148ddb55aeb998886c053f6539c2fee3b3b1796f3855792ff9

SHA512
9105af9928af4bcceb2cdc2161137ef6b07f4b97d663bbf27086f80dd266e967a5524aa5aec3f457493a0c4b98aa092aac6bd5062e72cbd4d939402c92093948

Download Submit