c96a990a618564ec277ee7dbe3ff92dfdf870fdc6e32f51359017484343aa54a

Analysis

max time kernel
148s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c96a990a618564ec277ee7dbe3ff92dfdf870fdc6e32f51359017484343aa54a.html
Size 112KB
Sample260912-k7ax7ashpc
SHA256 c96a990a618564ec277ee7dbe3ff92dfdf870fdc6e32f51359017484343aa54a
MD5 1954192068ac10f3463339352b25e031
SHA1 5ec67c0b0ba3fe0f39cd3fc5289ed23a5ea0db3a
SHA512 4f3ffa3d713c047c577e743cb46aa8feae529aa6ef1fba85ca476fbc15d17177f72c5fb30a8e5ef4bbcf592fdb7680a05cf2bdd994bc8c800c507bcf58df5bde
SSDEEP 1536:zPxwYn+hohTdRCcCv30CeurQ7Tt8NoGx+bPebEaoXbEao+ie3L0p:TmrQyNmTedoXdo+ie3L0p
TLSH
T150B3C59711204CF9EFA44DB3459B086B3C2C1437AC4791B9E3FD8F972B56CAE034A669
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338181395428004"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{771D7BBF-A002-4D1D-8137-C92A4F362B25}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2416	2892	msedge.exe	85
PID 2892 wrote to memory of 4736	2892	msedge.exe	86
PID 2892 wrote to memory of 2304	2892	msedge.exe	87
PID 2892 wrote to memory of 2304	2892	msedge.exe	87
PID 2892 wrote to memory of 2304	2892	msedge.exe	87
PID 2892 wrote to memory of 3196	2892	msedge.exe	89
PID 2892 wrote to memory of 3196	2892	msedge.exe	89
PID 2892 wrote to memory of 2636	2892	msedge.exe	90
PID 2892 wrote to memory of 2636	2892	msedge.exe	90
PID 2892 wrote to memory of 2636	2892	msedge.exe	90
PID 2892 wrote to memory of 4060	2892	msedge.exe	91
PID 2892 wrote to memory of 4060	2892	msedge.exe	91
PID 2892 wrote to memory of 4060	2892	msedge.exe	91
PID 2892 wrote to memory of 2104	2892	msedge.exe	92
PID 2892 wrote to memory of 2104	2892	msedge.exe	92
PID 2892 wrote to memory of 2104	2892	msedge.exe	92
PID 2892 wrote to memory of 3060	2892	msedge.exe	93
PID 2892 wrote to memory of 3060	2892	msedge.exe	93
PID 2892 wrote to memory of 3060	2892	msedge.exe	93
PID 2892 wrote to memory of 3516	2892	msedge.exe	97
PID 2892 wrote to memory of 3516	2892	msedge.exe	97
PID 2892 wrote to memory of 3344	2892	msedge.exe	98
PID 2892 wrote to memory of 3344	2892	msedge.exe	98
PID 2892 wrote to memory of 4808	2892	msedge.exe	100
PID 2892 wrote to memory of 4152	2892	msedge.exe	105
PID 2892 wrote to memory of 2536	2892	msedge.exe	106
PID 2892 wrote to memory of 4612	2892	msedge.exe	107
PID 2892 wrote to memory of 3804	2892	msedge.exe	108
PID 2892 wrote to memory of 3804	2892	msedge.exe	108
PID 2892 wrote to memory of 3224	2892	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c96a990a618564ec277ee7dbe3ff92dfdf870fdc6e32f51359017484343aa54a.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffd9051c188,0x7ffd9051c194,0x7ffd9051c1a0
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,1115338302869162251,10555332534403656561,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16358487428284085275,4586523524319282017,262144 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,12137447518666310267,11911939886041445129,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,17568544253740021524,13730808334287112077,2097152 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,8456265796893658669,3690809368664938709,2097152 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,8488676170839730631,15930629166530699192,2097152 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,18210062428349504515,4454189795191829391,2097152 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,15286430501430361546,1530534218004740295,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4724679540508530245,3424818180920977596,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14461797863628126524,5729995318089655997,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14461797863628126524,5729995318089655997,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,16522191136276997085,680145050327329885,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,202023476385221937,4212508936138074289,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,10691310866075333209,8470079686143857888,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,2622733290799515698,13127901666084644590,524288 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,313340271402660489,13095853772464092488,262144 --field-trial-handle=2432,i,1876566806293391148,15674868608118448372,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e3afce20225296ceedb5b6b0fcbb5438c2bf14410b8cae7d507f28bc05f96457
MD5 f44c4c7794c80ebf8389b6bec43524e7
SHA1 cea2f6bce77ff8e861283ee7bb785b60a6b0ad32
SHA512 7015b1ebab608d662d2f0cabd26cdf5517ddae7b3f17a83656f0c80e45eeef3e4853617d2f107677c29380c5e16c89b1c62ab1bbd55bab13985230fc7cc1fd3c
TLSH
T17D514CC2BDF160D1FBA8007888FD91D7327A4573174B1D392D91C778BA2F76618063A4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de2f43976173192dd2a2f89601981db9b4c8b2eaa61a9045a13937f1e9913f9a
MD5 f2a4069208aa2d492155042c0e497998
SHA1 262c762349692454253bee34029875f0b762ac19
SHA512 0e09e5178e703e9c46c5ec50cbda79046f75c6cdc0161895bf53a0296283a06a33a5be60f8e47c03bbdeedd9b666ae8bf9c41066839922fede1426c8617c9be7
TLSH
T12D418CB7C3D4867EC91156F05B246E2ACD1D0A5A526C3C16C9E9AF2F73F24B0D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c5863823aa1b02a00d716bd0bb65ecbceac6e35001db0ed697f1b4a49886a859
MD5 c0c4b58eb9ee5ce7857fdb4acd549089
SHA1 8eabf2dd21a240e922383e28fdae71b5231d17ca
SHA512 b4dfe384b5cfca4218549c2762f9ef4d00fde74eb0d1d9d69d3379f4044b13b0e79f44f4aeafa38b48e37297a91a0376d225e926af8df46e801fd411f385f05a
SSDEEP 192:sxZbRTWn/fysWDndIdpdqHW6+WNGY3RKkIgrJ:sxZbAn/fys2eEHbGi9
TLSH
T18612B852AE28A57B8CCBD20DBB257F53E6F95032A1D01E98EAFCD61C05E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 61c3b9932b7ee1b4d06697013a50c32ab6c49675bf0af007501ed37323712404
MD5 1dc7b7700a6c07dc209a0e668ba60c46
SHA1 0b99de1f32f01b492771952af4511e36387aa2b5
SHA512 cfa6842ce7c2fcbb09d50b6a6e07dea2d85e9d34ede9b84060da410ddd48dc1c9ed2850d99f2006cb6a8e920fef99da7206aa0274b2c2f196581b92ba7f34815
SSDEEP 192:sxZbRTWn/fys/7ndIdpHqHW6+WNGY3+KkIg5CFJ:sxZbAn/fysreKHbG5Yv
TLSH
T1EC22DA52AE28697B8CCBE20DBB157F13E6F95032A1D01E94AAFCC61C05E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e923a30a12755d366571c86cce824345962bab7a9a39d3c74c26a83f099f84fe
MD5 0190ab0b431e00eb1ba8a0750d0cadcb
SHA1 e4dcce2a4d85c3d0c69678b451018045ffd64f9c
SHA512 c48a4894ac8dd7e7009af98d694ab86c9a3853ef4dc3046feeeacf5342b8b2d81aea85dc878d782ee5678b480aa29028547a59e54fab64b3fd47e923978fc832
SSDEEP 192:sxZbRTWn/fys/7ndIdpdqHW6+WNGY3eKkIg5CFJ:sxZbAn/fysreEHbGNYv
TLSH
T1A922C952AE28697B8CCBE20DBB157F53E6F95032A1D11E94AAFCD61C05E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fac4c715a4319d8049b5ba8326004da7dd976405a22ab059f7d9651d17856895
MD5 afab895e6598d56866f80cb7a2d55375
SHA1 4f3639c452e1b878c9f0c53f516b30552e9dd6f9
SHA512 3747cbe501022097cdf97ed28604e0a07fa263ed33ed3860df921c97e45ead9f32751369e6d0a7e0d71dcc4ec7cda84c7cd4c97c20ff40d7d4da06bbacb63a9d
SSDEEP 192:sxZbRTWn/fys/DndIdpdqHW6+WNGY3RKkIg5C3J:sxZbAn/fysjeEHbGiYZ
TLSH
T1C022D852AE38A57B8CCBD21DBB15BF13E6F95032A1D01E98AAFC961C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8c5ed86897a8acbdfbf79cb473d72614ec9ccd5a20eb693bb3bab9953bef4d97
MD5 476c3fe438ff91fce9235bef5728fc03
SHA1 299446ada229b291e505ef9a16dabba7441fe6df
SHA512 ac51defb3f0a7bb3c253f1001186c99d73413e3505b3f687b5ace179457adc4f844401a01e50e19b73fbedbbf60252ef8fc060b00378d6afc2a777f020434ea8
SSDEEP 768:dP30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72CrolZMZ:dP30AbSWvS2l9u1jaLmLZ12Zy
TLSH
T120C2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA944C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a82455fb9db45c8fbe4f2b0a5d106be58d69f5bfc432e66ecaeee980fb9e714d
MD5 05f18c988fe491f6cdd2e04088cb1213
SHA1 d7b5d5d59015fe93ebbdc821c01351af8d1a836f
SHA512 1c4738c6b3d5bc908d08b4b460fe3532ddb129ac243954604bd7ff133aabc16c7e992739073e3cb601436b308ca124ce593b9adeedc256b42d1581ec59a343fb
SSDEEP 48:K0BQ9xbfj8bP6nISJ8K9p1D8xhsYarhhyLKV4kKIYJbUzEIScJK9A16JxyZYLs0y:KcyIK7ia2VKKOEhH2K0kS3
TLSH
T14791EE4531BB064078BE264D90B1975B528132F37018E62BBFBE65B19E2FE084DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb7cf1a9-baf1-4a52-afbe-45d76c5794fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb7cf1a9-baf1-4a52-afbe-45d76c5794fa.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7a0dc946b03f4c5a57e860d4b088a62b237a1c33e5c0e09d0d81a572a6cdac81
MD5 d0c36535e7e5e0dc31da214007b67f84
SHA1 0c23a36e1412e5c39cad0b01ed1bfafb38d84129
SHA512 b018cabc76abcfadde2e2a930d8c9b9ad98c271b1ec17f5fdc375166069c08d2820a7ae6144cefea3d31f57bf451eb4b846a0bb3aac9e3bef2ddb696af798b6d
SSDEEP 192:uxdsNVjQzPwVLkmwpuuTQmiU1bmQ49iX5F7Z4e/iIEy/RU8:OsNVjwAypuicf9iX5F7ZTEmU8
TLSH
T165321936A8786C3B4DE3A554B4473613AFB85167DB886F84CAED1B2C05DB2DC530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5f17d0723e24c64de9c3fb276190983e26e2a17f5b82dd87e0f3789452d554b1
MD5 6334ca1646a2069586f1f351ac3d9733
SHA1 cc0b9703bb3ce759c73d10d87b5309061bcfa06d
SHA512 9048acaa60816d14dfb20d5d5c67d3cd835a9aab8284a4da6294307fe0df8db49ba9c931b51863b3acbcc4de8217f962424e5ea924f9e95155d56b94d22c8ffe
SSDEEP 384:pZcIelsNVBwAypuicf9iX5F7ZsEmsa+VYBNHoa:hUMy2VaCEmhgcB
TLSH
T17B929E72A8B86C7B4CE3A255F58736039EB8806793C86F84C9ED6B2D05DA5DC1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bf0e0d22e6ecce1903563034dcda91019cc13e7d9a224b91b511b8c89f7a43c4
MD5 06a1123bb8b299e8d419c9bcf9ea77b9
SHA1 8ecea4b883d3b7cd28b69c37fedf73cf4c8b4e45
SHA512 0d9ce0f1daadd94b3f78683d2a186396ea9476fc70fcf8aeffc3d854290f13b604eed61320e117d3ff25197b38ca9a51c68540efabc0baee89e7bd915faca786
SSDEEP 192:uxdsNVjQzPwVLkmwpuuxQmiU1bmQ49iX5F7Z4e/iIEy/RU8:OsNVjwAypu4cf9iX5F7ZTEmU8
TLSH
T1A8321936A8786C3B4DE3A554F4473613AFB85167DB886F84CAED1B2C05DB2DC530A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 08351ffb1bb80e18dc697e72da81253a562388dad1c60d20752edf6ba8d0d4cd
MD5 739cf8650ca43e3917770becc67fed83
SHA1 d6a716c6c415502ce06f1ae5a781f27a363ea9df
SHA512 4f4d3bee1c20d11c3cb7cd9dc8e6d1f4133071ca868876a2e8cf8271054446bd9ee0b0c2a5a2f2850fa22992ac9acb3008ce717326a8074d3cc97d92543b0919
SSDEEP 384:eZcIzsNVBwAypuicf9iX5F7ZTEmsa+VYBNHoa:czMy2VaREmhgcB
TLSH
T1E2828D3268786C7B4CE7E295F98736135EB8806793C86F84C9EDAB2D05DA5DC0307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eeb0165fd1d54207db7aa37c5d2eeea7557028c9b786fb9fee26e11926754d8c
MD5 84826f2bd502e10bc414c1a308994080
SHA1 0419cb5ecfdd250fcc3d8ce6701ad6edcb819533
SHA512 cfe30baf4ec23b36de9211b502bed024c9e8545daa2081c1dfa1fe9983e55140ac28ed66dddee895cd5ec6445626682e2abd3b1b0772b2160c5d01c73d3afd75
SSDEEP 192:LONlB6AmwprQmiUyqw6siX5F7RJiEhkZU6:LONH6ipdm6siX5F7GEWU6
TLSH
T12C02FA35B9686C7F8DF3AE49F14737239FA5116BE6946F84CAE81B2D01D768C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4889102511f28152665678f615290cb2af2ba6cb55159b36c1ac0b550c48a3ca
MD5 a7d9b633d343d1549a836b96b788a845
SHA1 957ddacf4339c28abab47a72b4ea97fae738aba1
SHA512 98c223956010242169a744c72822667dfdee6ca0479e4f2d3956e2529750365f464f69d3beddc937273bebe9f3b251a982b23b95eb4262b055c5b3f6e8ad765c
SSDEEP 192:LONg6AmwpaQmiUy2w9siX5F7Z4e7lREy/RU6:LONg6ipW09siX5F7ZDEmU6
TLSH
T15B123C36B8746C7F4DD3A554F04735136EA95267EB886F84C9ED2B2C01EB59C530A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9fe949f009d8ba0f14194af9a752a2f16906af25b64bc04edcd09d1fb547622c
MD5 c2ac7d65225f76ceb5645dd1374b88c9
SHA1 ee1af28aa7ca001530b24004871c1fdb60ac64ca
SHA512 ac2240d2e8373b8062d3ac69f5a63abda224392c2ddf00ecfd0c424387a2cc2a9c7b2ebb87c601409580296687093590988f9528344b4f580541a215c32e88a3
TLSH
T16D412698B7E91158B3B76F5AAFF6B82D447F79772E06D55D10010E4F0A32A40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads