2ad3500560a66d34ae81a78dc42088df0c4629086759309761b91fb19c338f12

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2ad3500560a66d34ae81a78dc42088df0c4629086759309761b91fb19c338f12.html
Size 116KB
Sample260912-srvawsbj8s
SHA256 2ad3500560a66d34ae81a78dc42088df0c4629086759309761b91fb19c338f12
MD5 7b42f8a2726f445bacace13b1231598d
SHA1 c26565283923b4ea1eaabbf9559289878712af07
SHA512 fa1c797ca79b5101ddbcbfecf5f2c24c374566a8e0b430dd1ec228b4684a0d3272be959025bf8ed59d0fc02926981ad02e8fd73fd49613f02ba812665b03ed86
SSDEEP 1536:deEQTIYnl6tZTBWeQndfB9shvptORi8Z4bGaj+RD4szf4/AYRB04yfR:dXuSx/Pti4bEn4GR
TLSH
T108C3D59342201CF6EF6609A2929B1A5A3D1D413BF84700BDE3FCCF963B85D6E064766D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338240191098197"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{1ECBFAE2-A5B1-4128-A728-59C43D1D2AAF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4036	3820	msedge.exe	85
PID 3820 wrote to memory of 2732	3820	msedge.exe	87
PID 3820 wrote to memory of 1992	3820	msedge.exe	88
PID 3820 wrote to memory of 1992	3820	msedge.exe	88
PID 3820 wrote to memory of 1992	3820	msedge.exe	88
PID 3820 wrote to memory of 1412	3820	msedge.exe	89
PID 3820 wrote to memory of 1412	3820	msedge.exe	89
PID 3820 wrote to memory of 3568	3820	msedge.exe	90
PID 3820 wrote to memory of 3568	3820	msedge.exe	90
PID 3820 wrote to memory of 3568	3820	msedge.exe	90
PID 3820 wrote to memory of 2580	3820	msedge.exe	91
PID 3820 wrote to memory of 2580	3820	msedge.exe	91
PID 3820 wrote to memory of 2580	3820	msedge.exe	91
PID 3820 wrote to memory of 4440	3820	msedge.exe	92
PID 3820 wrote to memory of 4440	3820	msedge.exe	92
PID 3820 wrote to memory of 4440	3820	msedge.exe	92
PID 3820 wrote to memory of 4376	3820	msedge.exe	93
PID 3820 wrote to memory of 4376	3820	msedge.exe	93
PID 3820 wrote to memory of 4376	3820	msedge.exe	93
PID 3820 wrote to memory of 4472	3820	msedge.exe	98
PID 3820 wrote to memory of 4472	3820	msedge.exe	98
PID 3820 wrote to memory of 3948	3820	msedge.exe	99
PID 3820 wrote to memory of 3948	3820	msedge.exe	99
PID 3820 wrote to memory of 3856	3820	msedge.exe	101
PID 3820 wrote to memory of 2000	3820	msedge.exe	106
PID 3820 wrote to memory of 4920	3820	msedge.exe	107
PID 3820 wrote to memory of 3532	3820	msedge.exe	108
PID 3820 wrote to memory of 2612	3820	msedge.exe	110
PID 3820 wrote to memory of 2612	3820	msedge.exe	110
PID 3820 wrote to memory of 4820	3820	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2ad3500560a66d34ae81a78dc42088df0c4629086759309761b91fb19c338f12.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7fffbbc6c188,0x7fffbbc6c194,0x7fffbbc6c1a0
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,415886816158859678,6386701043549448544,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,2656912653655199016,9757836202204259506,262144 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,7451121436192621870,8729744425210463699,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8260790923660186276,15659116675793857879,2097152 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,3726517191933074035,15511462497199925066,2097152 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,705556842079249408,515995757821034664,2097152 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,15931889963708295489,14469686797294168759,2097152 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,7377651557786983188,3692163314570441690,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17508170576888579319,7511428515916393236,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,17496196637116615508,6278617031243533127,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,17496196637116615508,6278617031243533127,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,7896121927801695670,13340505800271388482,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,16565222877658740798,1975980986329613754,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,1966952818617337129,11069738439157225302,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,10786872217516215385,3644758352166623462,524288 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,2208135123468890241,16454117479368791336,262144 --field-trial-handle=2268,i,15985898041995039005,10697066905469749495,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4446a8d10183e097237a9e5ad93ff8e99b7790684bda7666d36292d754ed7ec4
MD5 33efc2885163079328f1e39a915738f7
SHA1 b0ce67764a6d68b747e0e7166555a03caa3a0ce4
SHA512 0be9930d05930b1f039bc56e8ac34512c3198e322400553caf8ff92389d7c6ef616c805012c6ce16697022f5d0b9d60f62c1003306e430d3549cfb3a4f555dbe
TLSH
T116514F8246A2FEC0F799073160D712A33730984D80B32E4A11A8CDB9BA0FF56B134C74
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 111864b8214a07a3add48edf8a185eef6a82958c2bfb489812329c39d554b2cc
MD5 0c475b764b289a0471e5d5b05638c0e7
SHA1 568aabef94cdca56552e79bd07767be74f60e7a5
SHA512 65eef7e38b824192e6a66eb5a7ed68e94626934b6c9d9ae5ffec96802e783739623633e470627cc394cf0eea1b1f204af9138f5a3ed97f8b9189c7763c90206f
TLSH
T10D418BB3C3D4877E890556F09B286E2BCD2C0A56422C3C56C9E4EF5F63E24B5E20159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 09cd3951b8e36ad552f54e6ce456b816c770627cff85b73ded5760683259197a
MD5 02fc6c92abe2abf5bb4869019ed7c6b4
SHA1 c46df82539c66bf7e0f15e611d05685b75facfa6
SHA512 f5121eb528e6f10fbc870c7f301d4fd7c83c4358e4df799d74957d8746798e3e526900913f7fc158134910553020e25d9a61ddbb5a613336f2159904de129da9
SSDEEP 192:sxZRJR6Wxr/fR4so45UMIdpd0HW6+WNGYYBaZjKIgrJ:sxZRJPx/fWsJ5CGHbGfn9
TLSH
T1841296116E28657B8CCBE21DBB25BF53E5F9503261901E58AAFCD62C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7f877c83fbebd6e5d61034827770915eb47425bc150551da41ae75ad9e777cb7
MD5 6a05bb68b878a1a5ad4e2111a19334d4
SHA1 255149cfd2b2e9b6d6a9a004971209cc91e3154b
SHA512 c2f5d2a8cf76747e6d88a1b3923b7364984675538499dee47ef9bbbec4b71580d075f0c10bb0c357cf38f50d7018dfdab66fa5131a05e9c492fced4ae3602208
SSDEEP 192:sxZRJR6Wxr/fR4suD5UMIdpH0HW6+WNGYYBWZjKIg5+J:sxZRJPx/fWsw5CUHbGfTc
TLSH
T16122C9516E38657B8CCBE20DBB15BF53E6F9503251901E58AAFCDA2C05E76CE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 51aa82056104b560b8ee4665ed6b3534c19931262c1dccaa7e6bcda6912a41c0
MD5 5803ee8fffd86d1008d4d2893fd675b3
SHA1 b2ecdc014d0c122d726e7b3103bcbd29d734b952
SHA512 e542dd678f024fd5551a3c6a5169341c8009950531db524c47fc423e3c20347ffced7766d4bd953520f9a964a4a9c4a71562380cb25ef6c37ba7d4ff27546b4b
SSDEEP 192:sxZRJR6Wxr/fR4suD5UMIdpd0HW6+WNGYYBWZjKIg5+J:sxZRJPx/fWsw5CGHbGfTc
TLSH
T15122C8116E38657B8CCBE20DBB15BF53E5F9503251901E58AAFCDA2C05E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 37dae896ee86053808aaf17a8caca2ebdce2a9b45fdd8d6d55777a3f4af1bf28
MD5 5582d5454b1ff020502862a470af20dd
SHA1 76a6665f54a97173bf23f54a5f943f8d8286403a
SHA512 26928f2a88ddafd9d8dc4051197a17b2e2fe7d4ac047c835574b721859388ef794e72836ef372ef0774c409625156671d1422ce08475b40e1e5a25ee70197571
SSDEEP 192:sxZRJR6Wxr/fR4su45UMIdpd0HW6+WNGYYBaZjKIg5MJ:sxZRJPx/fWsf5CGHbGfnu
TLSH
T16222A611AE38657B8CCBD20DBB55BF53E5F9503251901E98AAFCDA2C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 54c8cb6211e1be1762c541a1162ecf77aafc139f2ed66162eacfd404864cb5a2
MD5 5230d81a71d6e541be4c09ffd0014ebe
SHA1 9073121a442853aaa7c32b5ce60d6404b0a5b868
SHA512 a231000949063a33267e2d1775bad5c8f064774ecaa6ac12482d3d2bae62fe357ec8b39d5a088001933cd74c2fa02342d8ee9dbd5b4e40d4be483ae39ba886e3
SSDEEP 768:9uyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX6ropvKK:9uyYR7jWv3NpBu1ja/CL8OXxX
TLSH
T1C3C2E83B640DCB7E4FC01A9DDC5A6FDB2E9802C7A6548D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e3d69da9227c8bb36ac661466c99db3ca0ba1d96f417b8154e06e2e268c245b4
MD5 578828ba8838a22bafc73cd2a730ad28
SHA1 6f4547777518d05e4c70c14625d385891585cbd3
SHA512 e2dbb5c78aa55aef63702e2166040c436e78989924d08dd4d72eeaaf6419f09413787d06ae7c8b89f3372db5ac4e575aab84bc7a28167a083443df6abcbaf698
SSDEEP 48:KgLuvL1ttOb9wVISrOK9715OxjeY4JbPyLgvmqwaOPbmdGISCPK9e1kPxYfYlW6P:KIogKV2qOPyKQEb7qKoIamz
TLSH
T1AE91546531BB020139BD2448E1A29B1E435171B73058EA7BFFBE10718E2AE1D4DFD8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a0bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a0bb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 bcf6032cb2173447394d95f32eb8172aec0b3a74935ef1801ac60634a4069782
MD5 4b6af49635626c3740f9a0c720ea611f
SHA1 194289a8b1625bd512fa147083f8b271a1932b71
SHA512 e3049d6a0aed70e6527bfa95ac1d4275f28a53e1224954744406e57eb808b610f4c49e1f0a3f42f160c796a83820acb8fd657a0306f7f3d256cb4c557d67d600
SSDEEP 384:KiFiZcIxWsNz8TUNTUlIldUOl0Hi+JbQX5+DtXO7y84hgH7O6R2Feo1h7UcoL:BFQEywgTC/MkDdO7d4hgH7TREFs
TLSH
T111A26E729CA4DD77AEFADA85F44A3213DEF51073C5C5AAD0E2DCAE2D019B598130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4317f97f8d58ebdbdeb75e0eae69ec2c5c640a5365caefde40ed178b77b55c7f
MD5 9492a49d8c18b911fcfd52af5b2b59f7
SHA1 5d685571ea0b40102319352a85deb1b9f78e8bb3
SHA512 fc330560af11fe95b3ce9032839005debf4bb3855483c64281d8b51719a90058206ead888b5c183f1e3b5de881d5fa2c0277d4eacd7541b78ef0188eeb63dbdd
SSDEEP 384:LZcIksNhkUOl0HiGJbQX5+DtXO7y8ZhgH7O6R2Feo1h7UcoL:TktCjMkDdO7dZhgH7TREFs
TLSH
T12D827E31ACB49C775AFAE145F44636139EB95073D6C86FC0D5ECBF2D01DAAA8130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d709a91a4ccc8c946952c81a17661b4ff9f33873f41772913b5e2370ef739611
MD5 064977be1a940bec3bd361245da22264
SHA1 14fe25412db3144934799c9f84e3c8d00edadb67
SHA512 23a91d037bb8778e271b3a761303aa8365c84a1afa72d676250742bc2e67ac5871b11fb1e964fbe3b4dc87f984aa162e4b23b2300809d1d4debee11b90dd9a3c
SSDEEP 384:BZcIksNhdUOl0Hi+JbQX5+DtXO7y8ZhgH7O6R2Feo1h7UcoL:JkeC/MkDdO7dZhgH7TREFs
TLSH
T1CD827D71ACB49C775AFAE185F44632139EB95073D6C86EC0D5ECBF2D019AAA8130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 22b70193ba597216a16a357a8e5cdbe9cfd665feac75771e43004a77b8536caf
MD5 a3b46f5033bea2d38bab9407bdab9af4
SHA1 6c5be6affb0e46918763368cace0026bfb3a77c4
SHA512 117563fa28410b28c6245bae72602345120fce645e46d3d6787b2f1737d623ec6c11e6cabd29e820ddaf7790cda24a9d01b1ebce9fc6c15ea6fad239984feec0
SSDEEP 192:EONc6nnH+QmiUyp45YcX5hQDP1XO7uFfEFg3h+r/5SeU6:EONc6naT5NX5+DtXO7y86hgHU6
TLSH
T1EA120C31B8A4EC775EE69595F08732539EA51127D5887FC0D5DC3E2C02DF65C230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae9da192d3782ac110effe770bdd440397f3c6c43d52c1729627d1d5119255dd
MD5 d1bb6ef1d3c6483f8842173621f217a9
SHA1 769cce7d104322dc9cf9a5a79390643029231879
SHA512 665727739008fccc5299799c8ca4241c47dd068fa917952cb45f5a4b16dc25e7e59cd496738e4b72edfcdb7b07d2cd9792999cb3a2ea96c4ed41756d42c6c1e2
SSDEEP 192:EONK6nnHGQmiUyk4QYcX5hQDP1XOEMchDyHU6:EONK6nCQQNX5+DtXOghmHU6
TLSH
T11802DB34BCA86C778EF7AD45B4863313AFA5217BE5946FC0D5E86E1C01D765C2306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2acfb8523eb6d64065947608286f998c19e34521dc70ba73a1a6dd4f87f382cd
MD5 1b323a74e792a3fbaecd47a622e5670c
SHA1 918944ebccc479c197b3187363ac5fb66c6c4c76
SHA512 532c25287477f5fb1d1eaa9f5f9a9846649447920983e38c0cb70b87c3e6e1c4f727440b3b471404f713b7c51c7063d93abef74ed7eb8fb54b7d8f72fcca4987
TLSH
T187412988B6F91158B3B76F5A9BF6A86D487F79371E06949D10110E4E0622F40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download