8a1f3efaa9857e99129997e551c82a6f9ab812403187c314043578c8572c19c7

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_8a1f3efaa9857e99129997e551c82a6f9ab812403187c314043578c8572c19c7.html
Size 116KB
Sample260912-ym23tstdlh
SHA256 8a1f3efaa9857e99129997e551c82a6f9ab812403187c314043578c8572c19c7
MD5 438198543d0727a0586d211025f64978
SHA1 7097997a4accf1563fb8cacd93cc8fdac7baf906
SHA512 a60653b72343009c2d70d00822d7c257475c20df0c807d01323630d9330e3401ce0666953330051d1aa5c7580d33b8417598c08d00ad6fc303d7c62cd1026f97
SSDEEP 1536:mNEQjYnl6lADwBjtuP6k9ThvQtreEfQkKnaj+RH4sofe//aRB042kOr:mq2DqitQkK/d42
TLSH
T11FC3D49342201CF6EF6609A2525B269A3D1D417BF84300BDE3FCCF963B86D6E064667D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2452	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338261949424916"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{13E4E02B-35B1-475F-9A1E-E0D6FDF0C034}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3924	3208	msedge.exe	85
PID 3208 wrote to memory of 2452	3208	msedge.exe	86
PID 3208 wrote to memory of 908	3208	msedge.exe	87
PID 3208 wrote to memory of 908	3208	msedge.exe	87
PID 3208 wrote to memory of 908	3208	msedge.exe	87
PID 3208 wrote to memory of 4256	3208	msedge.exe	89
PID 3208 wrote to memory of 4256	3208	msedge.exe	89
PID 3208 wrote to memory of 4868	3208	msedge.exe	90
PID 3208 wrote to memory of 4300	3208	msedge.exe	91
PID 3208 wrote to memory of 4868	3208	msedge.exe	90
PID 3208 wrote to memory of 4868	3208	msedge.exe	90
PID 3208 wrote to memory of 4300	3208	msedge.exe	91
PID 3208 wrote to memory of 4300	3208	msedge.exe	91
PID 3208 wrote to memory of 4668	3208	msedge.exe	92
PID 3208 wrote to memory of 4204	3208	msedge.exe	93
PID 3208 wrote to memory of 4668	3208	msedge.exe	92
PID 3208 wrote to memory of 4668	3208	msedge.exe	92
PID 3208 wrote to memory of 4204	3208	msedge.exe	93
PID 3208 wrote to memory of 4204	3208	msedge.exe	93
PID 3208 wrote to memory of 1012	3208	msedge.exe	97
PID 3208 wrote to memory of 1012	3208	msedge.exe	97
PID 3208 wrote to memory of 2032	3208	msedge.exe	98
PID 3208 wrote to memory of 2032	3208	msedge.exe	98
PID 3208 wrote to memory of 3396	3208	msedge.exe	100
PID 3208 wrote to memory of 2640	3208	msedge.exe	105
PID 3208 wrote to memory of 4136	3208	msedge.exe	106
PID 3208 wrote to memory of 3500	3208	msedge.exe	107
PID 3208 wrote to memory of 380	3208	msedge.exe	108
PID 3208 wrote to memory of 380	3208	msedge.exe	108
PID 3208 wrote to memory of 2692	3208	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8a1f3efaa9857e99129997e551c82a6f9ab812403187c314043578c8572c19c7.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe32b9c188,0x7ffe32b9c194,0x7ffe32b9c1a0
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,5495093740028452475,3601359179546781878,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2163148006411063028,493577161497235251,262144 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,9144585612093218433,3389952936085829557,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11847079615232319139,802107515427638268,2097152 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14047969213825441095,10958847560018053204,2097152 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,39108785595444411,2950131343172473217,2097152 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,5332527264035697408,4797429360572295259,2097152 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,8331354451469756822,11228125011390740371,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,572049678706990993,11314297131599139022,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,18297678237344034029,182205951982603499,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,18297678237344034029,182205951982603499,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,1380673633025336631,9564186104782768064,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,1107201796485199684,16378997068711117558,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,18141818796452707768,13974188851463246410,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,3088439204881137948,10892720185675908453,524288 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,15535327036300247508,12446390235453494932,262144 --field-trial-handle=2244,i,14498530088262587915,3142101416804354683,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c191fa19f4efbe8a6df3c852cc937513a340946e1a8dfaa96e13568345a89d71
MD5 b7f64160514a980fc2fcc5b9607396f1
SHA1 e5ac6452f8ea92b7cfbff440f0b0ec6188df18ba
SHA512 381efce133c368f294786b56deb181cfbffc6609ab58bc49facb9b60f926d7093c72f3ceaa82f07b4e02109bd73032cd46e72c8f5cc3d1efccf9c45614a88ea3
TLSH
T127517295C64193DDFBE5137867C52F973638B498A6873E4200A7FDBB580A71CB143474
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 59c2e79493b46dc0fd9ef945db42d10424fdff5c7e028cd54a08fd1fafbd214d
MD5 cd9883cb520e30a5092c36b24d627658
SHA1 4b4c3df3aabe855a962ccf3e62a63d3795e9721d
SHA512 bbd75b5664aa121493f9f165519bb51c7cf08df0f8e1ad13e31682a67bff72eba71afac65ca70a19d3f06fa853a9db0eabad0dda2b09de3d0f0606e56e0cfbc5
TLSH
T173519EF7C2D4877EC90196F09B256E1ACD2C0A46422C3C16C9E9EF1F67E28B0D20159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7ceee0395b1a8697dfe42f350edc8af362060dbb15a6d8d843dd6409761297bf
MD5 7dc1855c7d8db437d37b51fc480e8619
SHA1 5c18afb930fcd029f88006ed4361b4737a395061
SHA512 ac91215995d3140779fac8febe2672879940d949c2269807e9d9010c36791b7d5ee0d04ba1074c4282dc6c75e6861d27c856cbb2045e00be2f5fcc1ebf9bca96
SSDEEP 192:sxZrRfWx/fEYsnf3IdpdaHW6+WNGYrbw+IIgrJ:sxZr8x/fEYsfYkHbGxX9
TLSH
T12F1296526E38A57B8CCBE21DFA25BF53D6F9503251941E54EAFC861C04E7ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0dd4b8a5ecb5d8692e70a9da7552223999a5eba347909234891fe78d6e6889ff
MD5 fabcc698240fa0106232b5b3a257e6b4
SHA1 be84058693f56526b19f285703435ce0fc1bbc67
SHA512 f0ef2060bcdfdcf90e2e9d38dfb8eabd57f32b45b9ac099fcd62303dfdea4054c1130953aacb24b0295b621b48971908379d12b92fd2697d583240d6515c7c44
SSDEEP 192:sxZrRfWx/fEYsiA3IdpHaHW6+WNGYrtw+IIg5rJ:sxZr8x/fEYsZY6HbGdX7
TLSH
T1DD22C8526E38A97B8CCBE61DFB15BF13D6F9503251951E44BAFC8A1C04E7ADE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 42aed2aacf855933e00211ff5efe924c79d7c293be93663dad2139736865ce52
MD5 10cd740576c2dfd9ac9b9955e452cf02
SHA1 e687a161e4c08f96cd41a434c3e2c18227a39620
SHA512 6cb2c8dc234c6fd661d629bacda5b193484b3282be39d910c8ead285679856770ad107baf3767339430118edbd4fd3810b9db1e56fe744afccb60bba5ef3d1ea
SSDEEP 192:sxZrRfWx/fEYsiA3IdpdaHW6+WNGYrrw+IIg5rJ:sxZr8x/fEYsZYkHbGvX7
TLSH
T1F322B8526E38A97B8CCBE60DFB157F13D6F9503251951E54B6FC8A1C05E7ACE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 763f4fd7b43600930a8628e6c62a9e835032f71adca9f21d794f2c9c221d4380
MD5 10abf51f9f33b9848162a6f76d5d7e2a
SHA1 d38e44fd4c9d748580112feb63d703ab5dfdaf1c
SHA512 2ab2c370e6f458df37caa8ac8bc01b961ca6692ac6fbe16cdf87d64082257a37c645684771bad002b389ad7f5cdc5411f11a23542ff698571c73e0a2420c620b
SSDEEP 192:sxZrRfWx/fEYsif3IdpdaHW6+WNGYrbw+IIg5xJ:sxZr8x/fEYsCYkHbGxXV
TLSH
T17B22A752AE38A57B8CCBD21DFB15BF53D6F9503251941E54AAFC8A1C04E7ADE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3b107ffcad7bc5e145553bc71c2c8d0cf0d3d99f22388d70d097a2c51f47568c
MD5 840fe7b474cee0349a66bca98b920e70
SHA1 4d492bde3579bdf68e08900853c0950ae4ea1a75
SHA512 1043d3e542fb97f14816087214cefab7d6fe3ffa77142861eaaa366e7ef93399dcd87eed6ec921a86b5d50b9fb00694b2debcb68e5c6d20b3b5f44e33a56b80b
SSDEEP 768:o9y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb/roRzh:o9y4J/DWvbtBhu1jajiLm0bsFh
TLSH
T1F5C2FA3B644CCA7E4FC00A9DED5E6FD73E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1a88549927eada530f6e07fd13dc44a1f717f13f0730d15333e84e9ba88c87ab
MD5 8b1a6bf0264fa60346402a8198bf2de0
SHA1 28d3fbef88f19126a5d2b5265395b53839a00ce4
SHA512 5c356d966643baf9a425d089eeb4a3e07b7fa7dfee2a7ab74b29cdc7643ce3b18ba851cc2d96d145bd43fd5f341b60f987d420ef444368ba9111b7e90748400a
SSDEEP 48:KIDI1Ks04jyLbef70DCOcey7bCxKISm7K9C1Q8xhsYarhhyLEzy+suCLbyB6ISWY:KIDCKs0+r7GKIXq+T2Kg0x
TLSH
T1E3A1454135BB065138BD298C82F4871FA28132737118EA2B7FBC50A69E6BE044DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57b31f20-3e84-419c-9edb-96b7b69ce6e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\57b31f20-3e84-419c-9edb-96b7b69ce6e8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7775ca4ecb78cf40bf3c12ed05f6391d764585b848533e001b33c15a688c990a
MD5 56f9f25c220ae3884e96e858b16892ff
SHA1 ad7de804df009e27f6a62f5c33dceec7f837ba5f
SHA512 bc9f813a9b0d127d998f1a7fb14c02c577fff34d0331e6c9c36d96db9bc7fd440bed583957c5d04dc4c038b9a4ba9e7ee395bcb375a217f4c344d0296cd1cf4d
SSDEEP 384:BZcIesN1UAdYD+tZtDjHX58EV8GAqXHJrj7sa+VYhd7UQoG:JeSYD+tXLa2Hhj7hgghJ
TLSH
T12D828E31AA78EC7B58E7E685F54B21139FF89053A6C86F90C6EC5F1D00DA6A9130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9ed039cb60b6934d0b1586d5da37452e1c89c6fd4fdc09bd0cbbb2feee143aa3
MD5 a6cdabf4616ea73dd7f9c27e575f2cc8
SHA1 e3aedaac796e57f0416d5244298ee3731361eee9
SHA512 5b4f5f5097fa7133abc2a78004d5959de38d5d0ccb1bf443e160da743047f6033066a8bbcbdc5b647b07b0e3aad8bee2cdb0ba96347779e1449e561fd2458238
SSDEEP 384:dZcIesN1UpdYD+tZrDjHX58EV8GAqXHJrj7sa+VYhd7UQoG:FexYD+thLa2Hhj7hgghJ
TLSH
T191828D71AA78EC7B58E7E285F54B21039FF89053A2C86F90C6EC5F1D00DA699130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 de9d1b5b0682ff6c59cfe8b136386a4db4b65ad359d61f7efc58b3f625ad8a1f
MD5 dce07810a33b4c43a9e453cc96554826
SHA1 f32f0676fa54892fdcc8f6322cbcd1b70e25a5a7
SHA512 620b301d52aa6f9d8b267a97243e956c1a4e4e03d81b77a3b67beb27e2a3f320fc257beb8ce609fbe8d37b7ca3de764a4de0b95ebbafab55b674dd93a8f63a4e
SSDEEP 384:AiFiZcIpksNm8TUNTUlIlpdYD+tZrDjHX58EV8GAqXHJrz7sa+VYhd7UQoG:bFQmjwgNYD+thLa2Hhz7hgghJ
TLSH
T18CA26C7299A8DC7B9DF7DB85F94A2213DEF840A3D5C8AA90D7DC5F1C009A69D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b88d87ec4daeeec91cbd2fb19bdc0fbc1bc98a4141b3019520bc7c0741241d6
MD5 d29ada5b933ff82e9dbe06fdef032062
SHA1 579e548d9312d9808b0320c8302851fd39b0d916
SHA512 ab48eee9fdf3246972278b2fd9b48d1d92dee926dfb1fad6b95dd7ae6da474e9acb4894130b91414c65ddfc71fc9c88b37e5ff3040a3d3fe5f6bdae1e6fb2924
SSDEEP 192:1ONf6wlDcQmiUyMyx4X58gZ5jzorGAqXgSJrkveY/mU6:1ONf6ksOx4X58EV8GAqXHJrP7U6
TLSH
T11B120831A478EC3B5DE2E584F48B21139FA45117EA896F90C6EC2E2C01DB66D530A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f7a45ee71db4a35db84c53958587a652ae7888ff773a0d533bcfd6bbcef9ede6
MD5 5fcc7066a73e4393610a9f4c38d23d26
SHA1 d9bdf741522bdf36183b8994b5cae579f1f8e153
SHA512 40cd85e1c42690f3d81a11602e7e08e30b4c871a1525ac773d6a1d1bb58ed4b17d3de2f39be122e2f06c01b550a2016e8caecc338004ed4de2bb107d7763be0c
SSDEEP 192:1ONCq6wlDgQmiUyqyW4X58gZ5jzorGArDlM0U6:1ONp6kgUW4X58EV8GANhU6
TLSH
T17702E935F8787C7B8EF2AE49F58A26139FE5112BE6952F40CAEC1A2D00D765C1347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 08dfda8f531facbfc07ab25adf254512f8cb56739f530febe4de4b6742bcf97f
MD5 83022d50ecca316840803ce3bfa6268a
SHA1 ddae3dd381422172add1846fbe012b958bd8132a
SHA512 c4ab4dd6a8ce73974ced1e1bb7e1ba3d91ce318f5c434b9ff2b8c18f871923fbaecd0457a4f479919787b0d7b00966b142a3f58f04f2d67d674ccc159a65cd6b
TLSH
T1E0411468B6E91158B3B76E5A9BF7A86E447FBD372F06915D00110D8F0A27A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download