Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/09/2026, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_0f8c9fba0cdcaa48b3e27d19e763de9cbb394767e44793fb0cad5943b8444a19.html
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_0f8c9fba0cdcaa48b3e27d19e763de9cbb394767e44793fb0cad5943b8444a19.html
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
General
- Target jaffacakes118_0f8c9fba0cdcaa48b3e27d19e763de9cbb394767e44793fb0cad5943b8444a19.html
- Size 66KB
- Sample260912-t2a6faee84
- SHA256 0f8c9fba0cdcaa48b3e27d19e763de9cbb394767e44793fb0cad5943b8444a19
- MD5 b54145f64a1e4edbbb952772ebc39078
- SHA1 ca408fa4f1422da249b0297505ab74f05e570329
- SHA512 03357cea4a18da6fea68b60741e1cf94e562bfe4111cc8df61aee979e6af14ecaf825aabe9c62f749736a78b3552367f1c63d878b0df0c515b0df3496e3c4b5c
- SSDEEP 1536:Fa9M9pOSeiVT9zDl9Q955n52nl9j9P5b9u5q505O9C9O9q9F9M9l979p9F5Z9I9t:FhQiVTthiLtMlRd18YCEUwAHSD9HjPC3
- TLSH T1FB63751C0A042F3FD7A24D99FD66690D5AF829D730780632B06DD6A46F38B6E872BD05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2724 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338354530303581" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{1D9CCFED-9BC8-499D-9C98-200842F09D1A} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1336 msedge.exe 1336 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4484 wrote to memory of 3140 4484 msedge.exe 84 PID 4484 wrote to memory of 2724 4484 msedge.exe 85 PID 4484 wrote to memory of 4260 4484 msedge.exe 86 PID 4484 wrote to memory of 4260 4484 msedge.exe 86 PID 4484 wrote to memory of 4260 4484 msedge.exe 86 PID 4484 wrote to memory of 4456 4484 msedge.exe 87 PID 4484 wrote to memory of 4456 4484 msedge.exe 87 PID 4484 wrote to memory of 3752 4484 msedge.exe 88 PID 4484 wrote to memory of 2396 4484 msedge.exe 89 PID 4484 wrote to memory of 3752 4484 msedge.exe 88 PID 4484 wrote to memory of 3752 4484 msedge.exe 88 PID 4484 wrote to memory of 2396 4484 msedge.exe 89 PID 4484 wrote to memory of 2396 4484 msedge.exe 89 PID 4484 wrote to memory of 3688 4484 msedge.exe 92 PID 4484 wrote to memory of 4712 4484 msedge.exe 91 PID 4484 wrote to memory of 3688 4484 msedge.exe 92 PID 4484 wrote to memory of 3688 4484 msedge.exe 92 PID 4484 wrote to memory of 4712 4484 msedge.exe 91 PID 4484 wrote to memory of 4712 4484 msedge.exe 91 PID 4484 wrote to memory of 1836 4484 msedge.exe 96 PID 4484 wrote to memory of 1836 4484 msedge.exe 96 PID 4484 wrote to memory of 2944 4484 msedge.exe 97 PID 4484 wrote to memory of 2944 4484 msedge.exe 97 PID 4484 wrote to memory of 1060 4484 msedge.exe 99 PID 4484 wrote to memory of 1688 4484 msedge.exe 105 PID 4484 wrote to memory of 1684 4484 msedge.exe 106 PID 4484 wrote to memory of 5104 4484 msedge.exe 107 PID 4484 wrote to memory of 832 4484 msedge.exe 108 PID 4484 wrote to memory of 832 4484 msedge.exe 108 PID 4484 wrote to memory of 4516 4484 msedge.exe 109 PID 4484 wrote to memory of 4516 4484 msedge.exe 109 PID 4484 wrote to memory of 4912 4484 msedge.exe 110 PID 4484 wrote to memory of 4912 4484 msedge.exe 110 PID 4484 wrote to memory of 1336 4484 msedge.exe 111
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0f8c9fba0cdcaa48b3e27d19e763de9cbb394767e44793fb0cad5943b8444a19.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffce59c188,0x7fffce59c194,0x7fffce59c1a02⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,11492390002821732350,10884708534999583812,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:32⤵
- System Time Discovery
PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7940606722214620910,10569660055849495470,262144 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:22⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,11495137935013097004,7526867767447408178,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:82⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,6330772080204849757,5174015232986204735,2097152 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,8043076558918638143,2037589100983461689,2097152 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,4885108864748886568,9549219020260278179,2097152 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,3841033178961681629,296193681391003733,2097152 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:22⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,503162599875712259,12097797577666537302,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,5119657245297876161,6555631347170655504,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:82⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,15833240133821733534,10715259900530962927,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:82⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,15833240133821733534,10715259900530962927,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:82⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,14203968964632273989,7447352675456855727,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:82⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,10056172207430338692,2099228532156054874,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:82⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,16124057248751537755,909016786060630550,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:82⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,8373315536359775858,15343790756537185309,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:82⤵PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3124766067685380780,6146434200868896134,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3406572056667858321,14278016249717778265,524288 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5224,i,6217160789929815013,11447886927475013396,262144 --field-trial-handle=2240,i,1674656871960080551,6712459799987191960,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
- MD5 67f6e997d9180458e1a8c1eb8facdbb8
- SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
- SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
- TLSH T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
- MD5 cf18b86051311e5d4cb3435637b32441
- SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
- SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
- TLSH T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
- MD5 be02dc26a22f37196d8a2ed1f90604b5
- SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
- SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
- TLSH T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 d35407f0bb3251923fd63b8628443e3709614383e0db021fca632aac6844ec9f
- MD5 97bfdd03442fcd8202ae4d993640f587
- SHA1 bb58661653974a430ad2b61a3229b2b05c4aa356
- SHA512 b0f54898ef7daecf00532700714e8c51ce69a40994190fdad74662569c0b5b6d75cdc1aba018e7b07117edba8d671c414d672751dc6b18e11b86f76f7007472a
- TLSH T1FBE026890EC8C32EA240F74B417D8B4CCAA13B5FD2CC6A0A1B8888887046250A6F6695
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 dd5b6675766a17646ac78d907c1205ad40b38ae50033e561a282fa5d781edec8
- MD5 0867ee2c9f39a223b6be6da984d06de8
- SHA1 24b1a48679c3bc7de478ec783b90628b21764460
- SHA512 5580334e1bcd3b1b24d71e81ffd13a1c5b649aa90dcd8d49779a32cf699b7692f61b8fdc0aa5e516da41edf4d9cbdff0081111fd5d46dde13c1e1f1c4f03bc61
- TLSH T147E026C608CACA3FA258A647416C570CD3C0374FD2CC7A0A278884A87A8D090A7E36D1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 5fab943dde502af5bdbfe75883e9fca7a78e0b7cb8282a3574b47d31513906f1
- MD5 196775acf5c15750dea23e9a1a3a9a34
- SHA1 7cf1e28853906fdd465c0532e8000f67ada3facb
- SHA512 c23774409425471b30c62f930fbf998dd21b6fcb87a96fdd8185be5c6ccafa50a653634339d07b5532dbfaabc1a81d42618208c43a0b781260ec711272f5c662
- TLSH T1D361978257934C90FF9885BCE1C5258B39B0E44B9FAB9E5F0DB4C87B5836314D51F090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59195a.TMP
- Size 3KB
- SHA256 931a566009e42d15e654240cc16d084d86741997541a09258375331b0291a4e9
- MD5 194ee7f543fcc4684de9a215c99ac44c
- SHA1 fe61c264f8a6e39b7dc169cd0b88f6749b6a23ab
- SHA512 c94969bffa369e5aca5ba4662e38cc5b094acb11e133123311f09f8ce729995324a70b6a57ee7a105ac4fef812c78dc3690b83b4dccca91b95a65d288d240e60
- TLSH T15961978257834C90FF9885BCE1C4158B3AB0E48B9FAB9E5F0DB8C87B5936714D51F090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 e33ede85186d1106a8fc8dd4e2925dbd7978c5ed4b7f31b8c6ef93be77f1a74f
- MD5 84cf03734f9e4d7f7ed3b0923e14e6e7
- SHA1 c60da1d0737c46280b03b2ce7f4e90c2e6e5b1dc
- SHA512 9773566af3c110ea6730e1ef9861411f0ecd8d201bda97990cecdeff21d133eb2760b93cf0aeedc48064bda007945a42dd58316834558f1806e87687998a1d3f
- TLSH T19B218EF783E446BE8A1196F05A14AE1BDE1D0547431C7C6589E4AF2797F34B1E00269F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 9KB
- SHA256 1c33094d5154580e8607f00d356e3d178e170ae11cd5e6a1275242ec3104d449
- MD5 cc69cc7e9596cc13531bbe66c1715aa5
- SHA1 45b5a7eb9dced278ecbd4f6834f1fc2ce0617e2e
- SHA512 b2e8a322377ac60aea4451229cc6b8d566425aa00fcd60449edd191c5d30deb18eb084b04691e6e322729ccc76d8599dd120b91d835ccb51fcc76c7a18d4f7c3
- SSDEEP 192:sxZUR9WG/frsM5IdpdDHW6+WNGYYBaefIgrJ:sxZUyG/frsMSdHbGff9
- TLSH T1B112A7556E38A57B8CCBE20DBB15BF53E6F95032A1D01E54EAFC861C05E66DD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 9KB
- SHA256 ee6a4122993200440a5b351dc9c2bff29071c7f3e9fab330007cc57ea0ec3d57
- MD5 6186af93bd6823f1e9b1b16e6a51ce44
- SHA1 b54a5bb44c58ac8cf96fe01f0a659e498ce7f04d
- SHA512 618abd53772d3183debfc87bfc7193b694cef0d44fe5810afe50395c6576ef12b420c94e07c03448b0a5a860d8eb3a0b8808b3c6b01ce48bcf57417c03da851a
- SSDEEP 192:sxZUR9WG/frsl5IdpdDHW6+WNGYYBaefIg5fJ:sxZUyG/frslSdHbGffH
- TLSH T15222C8566E38657B8CCBD20DBB55BF53E6F95032A1D01E84EAFC861C05EA6DD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 10KB
- SHA256 1262c5985e9f78e06f04e92444caf8c8bacb44ad798b1db641039c0c665e1bd9
- MD5 96a3e98ee49aee75083df1184f4b6cc4
- SHA1 3277336f6f07665d7f4c55631e11b12258ee2401
- SHA512 3eef1276c5e86d146b0e1628bb57510e0e7c823d1cfe06a3f1e4867e6474f1d7aea75333cdb4227dbce47da4f8303e2a115256ee5c682cd803d7a4f0a446c3ad
- SSDEEP 192:sxZUR9WG/frsC5IdpHDHW6+WNGYYB+oefIg59J:sxZUyG/frsCSjHbGf+55
- TLSH T12322B7566E38697B8CCBE20DBB55BF53E6F95032A1D01E54AAFCC61C05EA6CD220740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 10KB
- SHA256 57d3600e02824a387d779e087fcdc25067ed6bdd9a2099b5fafdd1fd2429ba84
- MD5 17b50aaf63c788d0b5df455be6851f2c
- SHA1 2311364076eac0ba919d11e255c072cce3cf8598
- SHA512 4558df6856185a361df2271f32312c77da4b4c3d544181a25b518cc67a7a5d8495e7485afb893d7edaa2a4e9f8440bfde79b85369a209e9752bcd1da4f571618
- SSDEEP 192:sxZUR9WG/frsC5IdpdDHW6+WNGYYBAefIg59J:sxZUyG/frsCSdHbGfB5
- TLSH T1E922A7566E38697B8CCBE20DBB55BF53E6F95032A1D01E54AAFCC61C05E66CD220740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 27KB
- SHA256 060bf0f016339edb9292de069614288bab5c9514aaf873711d3347752f72033c
- MD5 77df70d7763d8af63b180f1fb16eb8eb
- SHA1 8ed875cbf6ee9e5881992f66a46360f7cb6d739b
- SHA512 d1c6c805273b8b3b109f5290227d7e13d07f3c59b44ba81b7b2d3b2fab24533a7e83b1e2f54e5b33dc83bd1280ba1d54eec1764729fad33c98100e3c1c76d2f4
- SSDEEP 768:ebyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXaroppud:ebyYR7jWv3NpBu1ja/CL8OXRi
- TLSH T190C2E92B644DCB7E4FC01E9DDC5A6FDB2E9802C796548D4047FA944C02C77EE912A4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 e71ec9930071a4b00520e7c4f28ef4ed5ee80a1f053c35218d989c7447edc949
- MD5 14d14e7bcfac4b8c3b5d9fb0db602c5d
- SHA1 d1e8e6658274b217af8dcffdc4d4a5c8e08c60dc
- SHA512 4087ac22c56fff9fb1508516e92e18515b864948decff17b131a6ef0879cba20df11b73af965e7876bee870dc043b8d5d554cecfe35fafd31415893d35b6389c
- SSDEEP 48:KghwdR7/DcbvaHISpcK9J1jcxBMY6LBByL2xMwuUUNb4PgISINK9s1uNxmdYHYoZ:KAmYKDKmut+KmsN1+KOwy8
- TLSH T16C911A2072BB5344387E2988C2A5877F464271B7349DE63B7FAC11A1EE2AE055CFD4C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b79e.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 14KB
- SHA256 4411ad19726f8625fbd582e70611a81744600a01e0dd3c35f53de3fe83432a9c
- MD5 88aaa1b448c69882251a1e1458c7b8c2
- SHA1 cb52913253319767da194c48b871facfc85daa4e
- SHA512 4e6bd0c0e7b0803fd51ab46f611dbe0ed14d64217c2b91fc407c0586b625f04e576200253b71a16e8725accc3360778282096c7551237ce53bfb2351ed6ad413
- SSDEEP 384:+sNWlbiHin2QX5+DtE8A1WpXMFHrq7O6R2FeoBh7U6:+HaG9kDrMH+7TRED
- TLSH T19B627F36A8B8AC375EE7A587F04A3213AEF5506796852FC0D6EC5F2D01DE69C130AC13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 14KB
- SHA256 4d725f44f121cf7f52d79c02d2c0e6c3195e5ea6065289686d2c040ea5a547c4
- MD5 9601fed306ebfdcbf9f003947d0a4802
- SHA1 23304b42a8b1677f825509b4304d0876ed0fb070
- SHA512 6424656d11f1129307bf6c4804a97681a4a4d0bf33868c204bdb6db71ee75235054cd12a7bd3a2bc36e95758b5a3c091f9a162b8058b0641ee731c53a02505b2
- SSDEEP 384:+sNWlbi8n2QX5+DtE8A1WpXMFHrq7O6R2FeoBh7U6:+Hj9kDrMH+7TRED
- TLSH T1C5627E36A8B8AC375EE7A587B04A3213AEF5506796852FC0D6EC5F2D01DE69C130AC13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 21KB
- SHA256 2717ce80efb21a589d18cc0acb3983b0b7d2115527a905b7e6da247b7f121a01
- MD5 a33bf69000b1788ca75c7cb0e4f62c8a
- SHA1 214d174ed11d237f388281c8f88df9fd4f2c56a7
- SHA512 923abd9ee1b1f5444ca23f96d6a88d667cb3ffe37de69f8bf62eec79256f3b12d724d82cac646340ca1c74ff7a1131e67a14c1bae254ef7c26935c4aca62285a
- SSDEEP 384:iiFiZcIYEsNW8TUNTUlIlybiHin2QX5+DtE8A1WpXMiHrq7O6R2FeoBh7UooT:pFQDnwgwaG9kDrLH+7TREBM
- TLSH T1C0A27D739CF8DC3B5DFB9A86F54A32139EF950A3D585ABC0E7DC5B2D009A598130AC12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 c2077a91d9f8f4ade141fd38754887ee79af599b53e6d0ac720b0a7405e0965e
- MD5 9ac59c0502e9d1c1279dd1831ebefc6f
- SHA1 bc76bdfb237ea1868768a487905ab78b6c00319a
- SHA512 b946cff8afd90774d845afe5687d50bf08e261fd25bf85039c1d7b693482a823db0525ee8af42926ca7985f344ea01145bf1a79f2aa34980686eb5e100167efc
- SSDEEP 192:EON76nnHGQmiUyKUQYcX5hQDP1UjzorA1WXMcVGU6:EON76nCqQNX5+DtE8A1WLQU6
- TLSH T13A02EB35ECB87C7B8EF7AD46B0863313AF952167E5946BC4DAE81E1D00D765C230A923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 fc04bbc70705d40a8bf00c6add3291034684ddedeeb1d7a60689e8ffa39cfc0f
- MD5 0927d308be1b2e85483bc4ccfdccb302
- SHA1 18fcc340d25db4b13c076c3643bdf6b0c000b8b4
- SHA512 e842a9e0a0b8136a05d0b286900d7b809707c42eec76f14e6936ec98638d880bb900c7532d06f737777531739f0a6795088ebaa9054edd861a112cd56a6f47f6
- SSDEEP 384:dZcIisNWybiHin2QX5+DtE8A1WpXMFHrq7O6R2FeoBh7UooT:FioaG9kDrMH+7TREBM
- TLSH T105828E729CB89C375DFBA586B04636135EF9906396C96FC0D5ED5B2D00DDAA8130AC13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 18caf47e1f60df30ed1a1da87ca0dea0af87dfc0dedc171476c7fc64820225fa
- MD5 6ee05ff8b4567f0b543d862d92a0083e
- SHA1 df6e76b9790001409ec40ad5e15505e6e2fbf79c
- SHA512 9709353e9f5db7aee6c05c951969919ffd5c56dc176eefefd22d7b7b305acb28d9d4acaa387f56404241ee7b3b6ab0853d9574c01acc31fe7c3092ad951a4c7f
- SSDEEP 192:EONv6nnHMQmiUyBUiYcX5hQDP1UjzorA1WpXRqlsg3dr/5rqU6:EONv6n8jiNX5+DtE8A1WpXM5HrqU6
- TLSH T1C7121D35E8B8AC675EE36586B08731135EA55127E6497FC0D6EC2E1C01DE66C530DD23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7e89f067-6915-4cbc-a54c-30a03fd88dad.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 b5593853e44b5739c1aae72e50ad1dd07f679b06f7ac66612dd938725ee7f6d6
- MD5 b326621578e91bdeb8e30d8129ad89c4
- SHA1 5d47a9d28b2d26057d0db861639e042d6b34e9d0
- SHA512 ce67ad7f9c90dc3e2a8fbbefa3eae1257ecd4f0692f328d3bf56c80eacf957d67d23d01e70618a9e14a38cee75f08932557bdaa82b3a9e249e15b35ffa672ecf
- TLSH T1A341FA5CB7FE1148B3B76E5AABF2A46D587BB8772F07945D00010D4F4A66A40C9A1733
- MD5 SHA1 SHA512 TLSH