d384e0c47ced57f094a2285f4fb25b2f2d70c996caed397d40f273927f873b4a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d384e0c47ced57f094a2285f4fb25b2f2d70c996caed397d40f273927f873b4a.html
Size 147KB
Sample260913-a4befach74
SHA256 d384e0c47ced57f094a2285f4fb25b2f2d70c996caed397d40f273927f873b4a
MD5 a4f230d761d5849135549ffc4f39f2e4
SHA1 84124080238f32b88a3023717a501cf9dc702cc0
SHA512 df9ff9986b86b42ac22e1d14fe636f61e8ae32494397c09d882344ad542a33e3ffecb6fa9c908f9306db8670b85e6eada19b244e15bf49f157786cbd26181730
SSDEEP 3072:mLktlQ7N9KO+ESYqdoIdogDZeHAjsSXrY:mLwlQ7N9v+ESYqdoIdogDZeHAj+
TLSH
T10AE3A4A762204CE4EFFD1DB349DA492F3D2E0537980250B9E3ED8E965FBB91D0309496
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1032	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338320748169468"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{F5262E32-7A19-4C7B-B62D-1283919D2464}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4644	4436	msedge.exe	84
PID 4436 wrote to memory of 1032	4436	msedge.exe	85
PID 4436 wrote to memory of 1444	4436	msedge.exe	86
PID 4436 wrote to memory of 1444	4436	msedge.exe	86
PID 4436 wrote to memory of 1444	4436	msedge.exe	86
PID 4436 wrote to memory of 4272	4436	msedge.exe	87
PID 4436 wrote to memory of 4272	4436	msedge.exe	87
PID 4436 wrote to memory of 3784	4436	msedge.exe	88
PID 4436 wrote to memory of 3784	4436	msedge.exe	88
PID 4436 wrote to memory of 3784	4436	msedge.exe	88
PID 4436 wrote to memory of 3932	4436	msedge.exe	89
PID 4436 wrote to memory of 3932	4436	msedge.exe	89
PID 4436 wrote to memory of 3932	4436	msedge.exe	89
PID 4436 wrote to memory of 2408	4436	msedge.exe	90
PID 4436 wrote to memory of 2408	4436	msedge.exe	90
PID 4436 wrote to memory of 2408	4436	msedge.exe	90
PID 4436 wrote to memory of 396	4436	msedge.exe	91
PID 4436 wrote to memory of 396	4436	msedge.exe	91
PID 4436 wrote to memory of 396	4436	msedge.exe	91
PID 4436 wrote to memory of 1400	4436	msedge.exe	96
PID 4436 wrote to memory of 748	4436	msedge.exe	97
PID 4436 wrote to memory of 1400	4436	msedge.exe	96
PID 4436 wrote to memory of 748	4436	msedge.exe	97
PID 4436 wrote to memory of 2460	4436	msedge.exe	99
PID 4436 wrote to memory of 3172	4436	msedge.exe	104
PID 4436 wrote to memory of 4116	4436	msedge.exe	105
PID 4436 wrote to memory of 2504	4436	msedge.exe	106
PID 4436 wrote to memory of 2188	4436	msedge.exe	107
PID 4436 wrote to memory of 2188	4436	msedge.exe	107
PID 4436 wrote to memory of 1544	4436	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d384e0c47ced57f094a2285f4fb25b2f2d70c996caed397d40f273927f873b4a.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9f6afc188,0x7ff9f6afc194,0x7ff9f6afc1a0
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,9914922179892029175,5406954635500798194,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2796899311578233315,11030708190737317832,262144 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,15721158197505655794,3768769545095106557,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11755101444522544755,9558069125145897587,2097152 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13826467874518243829,13850260561478291838,2097152 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,15008798344912314724,5412476485694825946,2097152 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,9937607082444584987,11417923985207901599,2097152 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2783834675305620204,13308032047542266693,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,17292371018816672163,10026527554973867384,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2667661986499169188,995886714049678137,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2667661986499169188,995886714049678137,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,18124697163887889098,9739931274636179407,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,4490247769387025835,2594565719598069921,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,6861756599894670302,11352323762470779065,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5903451823909843691,7168460235582759146,524288 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5264,i,2318465824506001737,8461160324506188475,262144 --field-trial-handle=2032,i,10368296514491843213,16952795391476473005,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aaab0c3c382b05f6e1f926170e213edaf705e0ddfd59924cba0686565e92b5d8
MD5 1db6a454592c8cfb393ccc6d8362f538
SHA1 0678a5a82f95a4cef8c5847ae8f6842c973a684a
SHA512 1f48855ee9dd365a334fe879b0648915bb72d43f5613010e96fbbdfbf31c515d29dd46e224b73f3345dc7d211c2d126d48d0dd981f0811d582ee6326dfabb9a1
TLSH
T144614A810BB088B3FBA451F8C6F498D7BA32838D58839E210AE4F56D9C5332741F721B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 922c1d59f4b72ee9d507b30a205da6a352a8f873a4704ff2ba6e1bb89dc3bd9e
MD5 15ecdb7892c001fdbcae9b53bbde13c9
SHA1 85d167ab1d7f7af3b132a2d108119876ba586fe1
SHA512 8765f7a2e836fbe1626842e9047f35411c0b8423998664c059afc948d2b861a461ff137ba7954a26a28650b3cd72f8687e96aae8cf43f8e1b5219af2470c9b29
TLSH
T186417CF7C3D4877E890156F0AB246E1ACE1C1A56432C3C5AC9E4AF1F67E64B4E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1a47d081570c99136fba9be5ab5be4b92f716abd04f481e06f290452f1f63f88
MD5 957d8e12684209db19a98d410624bab4
SHA1 dc5df3e59872e763c9c52421c8929c6d6ae2616e
SHA512 bfa11c82823877de973d8927eac1cc7eb732131ca0acd4fa676d85f47dadf0b8f76c0151c4b9c90e2eb7faed56b643b94d983726449383195801f30b22242cdf
SSDEEP 192:sxZPRdWE/fPs9cIdpdvHW6+WNGYgUC+CKaIgrJ:sxZPKE/fPs9FZHbGTpd9
TLSH
T12B12A8166E28A97BCCCBE20DFB25BF53D5F9503261951E58EAFC861C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e09b69977e083b0ed1e4cdb4bcb7503d925f610c1550d4ddc74e9d7fd9bdb407
MD5 244425c74cd4e96de7e043fddb8b46ea
SHA1 e49bc6bd9551f85017933fb29069e0f6e820b5c2
SHA512 b28b71997af4b29071291add3ce499efb0f64459369970014f918410fc62f088a3bbbc9a6974aa80313f70f8cfb1ced208c454fcfe851efdfdbaceef510849ca
SSDEEP 192:sxZPRdWE/fPsicIdpHvHW6+WNGYg/C+CKaIg5rJ:sxZPKE/fPsiFPHbGspdn
TLSH
T18A22B9566E28A97BCCCBE20DFB25BF53E6F9507261911E48A6FCC61C05E6ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c68f7b0634f8d7f6de93904187d2f4b8545a2fc2746ac760223481d71c17bb01
MD5 e0f661a2ecbe24bc6b053cb70c83d08e
SHA1 d5191927528b922891bac085ce5613f38c6c47af
SHA512 416c8fc65b813f0b0921daba3694fd8ba01234b05001ff248cd92e7946a44cfefdfe4945458c1dea438aba62d806f1f671667f2f3b882759a766099ba2d73b7f
SSDEEP 192:sxZPRdWE/fPsicIdpdvHW6+WNGYgxC+CKaIg5rJ:sxZPKE/fPsiFZHbGKpdn
TLSH
T14722B9556E28A97BCCCBE20DFB25BF53E6F9503261911E48A6FCC61C05E66CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 3b69e0bbab4303714693d21a2024ba3c03edcaa60dc0df97317ffe4c71dae357
MD5 5381b719ef008925f8533964bd688358
SHA1 b73a8c7c06694799a99d223cbc95edaa71434a8c
SHA512 af5230591785e173e5160f26e8fafc0390ce9e36563ea5e8a80bcf2c7305bbb6b8a30c2d48224ccdc6efc9f9c0971f21d63c6088967d198e1855e401adce5037
SSDEEP 192:sxZPRdWE/fPsXcIdpdvHW6+WNGYgUC+CKaIg5xJ:sxZPKE/fPsXFZHbGTpdB
TLSH
T1F822B9166E28A97BCCCBE20DFB25BF53D5F9503261951E58E6FC861C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 54762c6d16d11890af79092fbd88346e2db09cc3a9a2bb973da98e50f46afefe
MD5 f1b94cc71ce37d18c72d4c2ab2cafe89
SHA1 a582ded9c84907a1b8ef8ff49f04c600bdd656d5
SHA512 a0ab8a2ff3a9647d947dfd888ddbedc8a89320af4b8c0c9518eaa814e138079c5f3243182f99b55330a89942740c6687290b9cd25b7cda23004580505a7dffee
SSDEEP 768:+7ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz9roR40:+7ichfPWvPZplu1jan+LKgz2C0
TLSH
T119C2F93B644CCB7E4FC01A5DDD1A6F9B7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e2e9af4cc41582399dceee3871ec4d51c0de42a47acb0c49ec60f10a5c0245b4
MD5 20971b276a4a696f06003209b92abb28
SHA1 8d38e42145f9220799aa595b32b3c4259946d1a4
SHA512 01f8214df8807d6f198d1da8ebe4bc4557a879fa374b1d254c2c595946f24564e7e8b68df4ac40d30bc8fa95943760393f0e70f5e2b6643132e47c7461ba3d98
SSDEEP 96:KAdOKOY6VAr8QuC+giapzIIgKQ1IWgsYIZ2recK3Kai:URVAr8QuC+1ap8IU1IWdYIZ28Xi
TLSH
T1FD91F40036BF024039FE69498171DB2B054171BB3258FA3B7F7850A39D6AE192DFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b637.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b637.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b7393fd27a331a2d2ebb8c3b0743ec4fbe5b51a6fedf6e2e8e17596752c943ff
MD5 c4a3a2de8e2e1fab7433934a07538be5
SHA1 0e7945e06c00067ad154d778c86d2e9b2947d518
SHA512 c73432316a49de1a0c2d354e260b4138c06f203e20bd9a439d873953a2da832c6477fb8a9377ef3c668914b6082d87db92c49d7d0a8e7bdf5c722fdd1fd8dc5b
SSDEEP 384:jZcI3sNnULjsB5fD3sBGYX5EzyOi6QnBS7O6R2Feo+op:73wx32GYuzyO3QnE7TRFq
TLSH
T1A5829C716C789C779CEBA195F44A3A179FF88027A6C86F90D1DC7F2D01CA698130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 66707bfddd0599d96b8c1d43fc4d56f3f39eedc91dfb62c69b811b81a419ff4b
MD5 a425ebd516dea58a30fd74d78819d0e6
SHA1 7aaef5fb47dbc390a084ef319d869cca4c84ed53
SHA512 5845e1d38cc58f1849e1d855c1139ca930bdbd2ca7eb330935beb0b920d44a97b979db5e8c092497c7a8c646a3c2dc08b5867ca104076db50624d80bc46131c7
SSDEEP 384:ciFiZcIBRsNc8TUNTUlIlijsB5fD3sBGYX5EzyOi6QkBS7O6R2Feo+op:HFQndwg7x32GYuzyO3QkE7TRFq
TLSH
T15DA26C725CB8DC7BADFB9685F54A36178EF88067D6C4AB50E2DC6F1D008A598130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 d321a3db82b9ed1f03b069f15e839d2c1c23500006c487903afd39e3d4fd2bd2
MD5 acfa28ce897d853575744d7d3918f91f
SHA1 abadde48f1b85fc69fa7e8ff2ab4e621a192d70e
SHA512 13150f742711498911fdb86c0eb631217f1159f10074277efd999c2641a55e24682f8231a4da5fcf5b23ac30bacee2895ddf899853184684f6e93c7234698a1c
SSDEEP 384:AsNnU7jsB5dD3sBGYX5EzyOi6QnBS7O6R2Feo4:Aon32GYuzyO3QnE7TRr
TLSH
T1E7625C716878AC779DE7A155F00A36139FF8906BAAC42F94D6DC2F1D05CE69C230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a35fb22ea7e925d17c454035d58f31da14f2418d11eda817b340e727edfa532f
MD5 0996cfe1046fd10d5542e0c2e0ee03c0
SHA1 566da1fbf5c2715ad333ab658fe4b4a8067733b9
SHA512 461458d6d0192fdea1bc85fd021746dfa6b66b1fb40840f7b07f49424155d8fe684420bacd9725c7e36d599cbfc6228ce19bdffaff6d28afe94c1ff3102e8b81
SSDEEP 384:pZcI3sNnUijsB5fD3sBGYX5EzyOi6QnBS7O6R2Feo+op:h3lx32GYuzyO3QnE7TRFq
TLSH
T150828D716C789C779CEBA195F44A3A179FF89027A6C86F50D1DC7F2E01CA698130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38ce1f9ec7a37b789a9b2d7bf4b7d9dc7e779489e90bbdbf74164cc24e5e00ca
MD5 2eec869463d978612acfdb8bf9677478
SHA1 8faa2c3f806c94a4149e586f0e23f68835e314aa
SHA512 12cd0ebc41a6ea891ea7979161379f8c89d353ece8fd7af17f1a1c3d37954e0a92de7aca5152b6930a16781148ca2cdb7e7f79075530b2e05869c7c73b2ef26e
SSDEEP 192:LJONf6DphmqQmiUyJQq8wGYX59ez6CyORMWkk7WyU6:lONf619RRwGYX5EzyOiwJU6
TLSH
T18502D735AD78BCBB8DE26E45F5873613AFE4112BAA942F54D6E82A1C01D764C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 04271658b27facc2e0da7919e58f638285c1837addde992f82be67d6827a468a
MD5 6f6cc475e79135dc0bbdbc149cb23341
SHA1 d55573a6b080bcd1af026970661be80642c10540
SHA512 639694e4a2071254ee2dbf4a500e7517774c8ee6d5663073729a52bfce9f950539463a43d1083d37c59e38dee4ee83e440ad7989505bdd4d79333a28aa8dc7fd
SSDEEP 192:LJONN6DpheqQmiUyqQ38wGYX59ez6CyORM6QukIIBo/59U6:lONN61xM38wGYX5EzyOi6QHBSU6
TLSH
T107122A32AC78AC7B5DE26595F48735139FB4512BEA846F54D2DC3E2C01DF69C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20acce57-4cc7-433f-86f8-566c56b1daa6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\20acce57-4cc7-433f-86f8-566c56b1daa6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d23d7787c01a5ea9faf6deb518668a3e5da58c2a564db1e1c532bfdc136eb67d
MD5 91b76c3ca4fc9735c43c02227b91359c
SHA1 710ef78570b65c27af9046ca64c6e7c2399f6556
SHA512 34e8128d4fd63a26975d9f62b57ba6133a2a34f2cc438a37dff00137eb0d4d63dd003ca79db2199f3be545d54802b6efa0e832de6909431aefab0df68c2d2ba8
TLSH
T1E941366DA6FA1148B3B76E169BF7A86D487A79772E06D05D10010E4E0A76B00CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download