055955fb55e022c19c1cee59fbcce4e6ae7fc00be7064855d41a6498275c983e

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
Size 688KB
Sample260919-vsd2eatepf
SHA256 055955fb55e022c19c1cee59fbcce4e6ae7fc00be7064855d41a6498275c983e
MD5 a23bb610b9eb410f69243fc651ad27e8
SHA1 7bd781f8392ca0fac452d914d57d104699fa328c
SHA512 fb3c9827c90410506f3f8397122261953e1399b9a410a67b2ae8b37bc892517e3fae4f11dff4c61d180df1d361239ce244ddadcb7918a5e28d582898842411b7
SSDEEP 12288:l8GEGaHFMd7KDP9p/4RCRJbUhSGN5ohdwjNBimfmxBnTDUeNISIWV:KGERlHL9FKCRJbUPkh8IQm/nTDUCX
TLSH
T145E4CFF767237EAFEB9E0BF8841426510CA858971A34F14DEC0E05A17698DA0197EDFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3456	vbc.exe
1520	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Roaming\\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe"	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 3456	4628	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	86

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_659718922\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_659718922\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_659718922\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Filtering Rules-AA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Part-DE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Part-RU	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_659718922\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_443542312\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Filtering Rules-CA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Part-ES	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Part-ZH	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_443542312\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Part-IT	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Part-NL	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\Filtering Rules	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343117082585584"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{4D47CB4F-AE30-4F94-91D6-707B20E4E70F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
804	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3456	4628	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	86
PID 4628 wrote to memory of 3456	4628	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	86
PID 4628 wrote to memory of 3456	4628	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	86
PID 4628 wrote to memory of 3456	4628	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	86
PID 4628 wrote to memory of 3456	4628	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	86
PID 3456 wrote to memory of 804	3456	vbc.exe	91
PID 804 wrote to memory of 3488	804	msedge.exe	92
PID 804 wrote to memory of 5708	804	msedge.exe	93
PID 804 wrote to memory of 5672	804	msedge.exe	94
PID 804 wrote to memory of 5672	804	msedge.exe	94
PID 804 wrote to memory of 5672	804	msedge.exe	94
PID 804 wrote to memory of 5460	804	msedge.exe	95
PID 804 wrote to memory of 5460	804	msedge.exe	95
PID 804 wrote to memory of 5560	804	msedge.exe	96
PID 804 wrote to memory of 4016	804	msedge.exe	97
PID 804 wrote to memory of 5560	804	msedge.exe	96
PID 804 wrote to memory of 5560	804	msedge.exe	96
PID 804 wrote to memory of 4016	804	msedge.exe	97
PID 804 wrote to memory of 4016	804	msedge.exe	97
PID 804 wrote to memory of 1700	804	msedge.exe	100
PID 804 wrote to memory of 1700	804	msedge.exe	100
PID 804 wrote to memory of 1700	804	msedge.exe	100
PID 804 wrote to memory of 5444	804	msedge.exe	105
PID 804 wrote to memory of 4316	804	msedge.exe	106
PID 804 wrote to memory of 5444	804	msedge.exe	105
PID 804 wrote to memory of 4316	804	msedge.exe	106
PID 804 wrote to memory of 1816	804	msedge.exe	110
PID 3456 wrote to memory of 4540	3456	vbc.exe	114
PID 804 wrote to memory of 4460	804	msedge.exe	115
PID 804 wrote to memory of 4460	804	msedge.exe	115
PID 804 wrote to memory of 4460	804	msedge.exe	115
PID 804 wrote to memory of 1884	804	msedge.exe	116
PID 804 wrote to memory of 1884	804	msedge.exe	116
PID 804 wrote to memory of 1884	804	msedge.exe	116
PID 804 wrote to memory of 2332	804	msedge.exe	119
PID 804 wrote to memory of 3308	804	msedge.exe	120
PID 804 wrote to memory of 5276	804	msedge.exe	121
PID 804 wrote to memory of 540	804	msedge.exe	123
PID 804 wrote to memory of 540	804	msedge.exe	123
PID 804 wrote to memory of 960	804	msedge.exe	126
PID 804 wrote to memory of 960	804	msedge.exe	126
PID 804 wrote to memory of 1356	804	msedge.exe	135
PID 804 wrote to memory of 1356	804	msedge.exe	135
PID 804 wrote to memory of 3288	804	msedge.exe	136
PID 804 wrote to memory of 3288	804	msedge.exe	136
PID 804 wrote to memory of 5520	804	msedge.exe	140
PID 804 wrote to memory of 3272	804	msedge.exe	141
PID 804 wrote to memory of 3272	804	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Admin\AppData\Local\Temp\vbc.exe
  C:\Users\Admin\AppData\Local\Temp\vbc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=vbc.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f8,0x7ff8e786c188,0x7ff8e786c194,0x7ff8e786c1a0
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7731693957244860383,11607697992896709298,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
      4⤵
      System Time Discovery
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,18171127131955192216,6116994197588263880,262144 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,8374526981674459708,16939647453871725458,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,1167006495912907704,11160969656854408812,2097152 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14491994757916366383,4016854597054195538,2097152 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,14859496042709716913,18329440598401579581,2097152 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16343094987028323585,2174401485544281072,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,6311574952700808942,18255816774500472825,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3375121328698353631,1596790905363458436,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3375121328698353631,1596790905363458436,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6112,i,3459788495401049680,7618417685556169855,2097152 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3996,i,14537805073646403632,8064624907176536172,2097152 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,5354227185172463149,17897103508451041565,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,8307913974732528339,13279306250467583104,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,3952963951406836836,16436399301725237965,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,15057740674545979553,14434197067482215512,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,7952377460207225090,16275417244822434291,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,9367232364280751521,13232436680775781477,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,16669387447048410574,2670830392037606722,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6636,i,18258655408259531756,5323862766071961822,262144 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,12336054125847330876,16828910487408773112,524288 --field-trial-handle=2228,i,60041035802735873,1315872157814256188,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
      4⤵
      PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=vbc.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:4540

C:\Users\Admin\AppData\Roaming\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
C:\Users\Admin\AppData\Roaming\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping804_443542312\manifest.json
Size 118B
SHA256 a5e0ef69ef1cf1ca9e3b6d53a0caaf6a711b0e5b71c9199c220c5cf176cec760
MD5 e742e590b22754841dd779e3439c16c3
SHA1 ec775f58ce04e2a7693fc5c64c790fc237135bec
SHA512 3730a73c5a21bb5d4e035b2d17813b4968cbfbf068bdbd2e87a748694607b5140e5f029da990aefad5b9676e14961dc7ae892811a2d203a0a731442fd0ab02cf
TLSH
T18CB092B00C1AA03B22C09320ECA166C283F80229E8022B1A088036481F8817881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping804_659718922\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping804_659718922\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping804_760739904\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe.log
Size 503B
SHA256 ba42778c46e30817933b46a0b99f9f18e81b441acd7c562a1b3c74b3d74f65ab
MD5 ee6114641761f4d337f3d80782b40397
SHA1 48a089285b60cbed9a9496a06e319fcde8fea946
SHA512 f5da8f58a3a192e7eec0d6e807b5b71a7829099c33b620db8e44f5c63889c7b33e6f07ef00fcc6e6964b885d8bc895554736767d8100211f8dd5fa03b9e885d0
TLSH
T15CF05C30363298D80D202F110800BFDA56FF475A7BA8CF2C566A535DEE2A497EB112F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b77a03e60714e268f95bffb7c3f6023c5718898300888113358160d5bf0c84c9
MD5 1975bc102ac30179bae2d0fcc03dad15
SHA1 5525ffbae283cfce877b174047fc2fa6cb5baa71
SHA512 36b47c3e3f262d1f98a682adc8a619088b9b91924df72845de92076f6c92ae4ad4e9d89cb8b6df9a18b71b594a1f0637e4ca62a3d9aca096bf4222babf241e22
TLSH
T12EF02DF9CD25BC3B08FC1B2810640B46E75113572B80889B3B3D911D8FF563B854685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4595270e39ebb15709618c16cacd5fbb0140f29841f2893a0d2e200c0c07d7c0
MD5 8cfae495b97a58a887e8551db74a74e5
SHA1 5455b9a5c0c5efbda91734fda6a79a8e493c435b
SHA512 99154413609b12e73c9d4164b890b9321113c81b38b9583749f4906c7cdd2b2f083a55bbbee68d3ddf9dc5d1c0a6d1dcfcbc45e08aaf80ed4c5443235c013690
TLSH
T1FE71D7818443F527E7582034A7DF71CB393078B4BAE79D1207ABED769B4E7494E0B082
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59453d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59453d.TMP
Size 3KB
SHA256 6829eb73ba5bfd6c4ac8390e6f0f999406c3eae626e6d5b2f11b6f8006efbf46
MD5 852b84d8ca4fd760906932ef39603eb6
SHA1 3671f5e848b84c165fcc5f02e6a996593448cad8
SHA512 fa942913f0252d0e18b5ef85cd0a11b7758ce4b2b3bdf148d2479d9b387c003603a8ee972ce723800f93a99b3eafe274e7a0c7692daf6699cd9d5ac9c654895e
TLSH
T11E61C6818843B427D3982430A3DF72CB393478B1B5E7AD1207ABED768B5E7494D07082
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 19b3bbd324c8cddf15e834ff66cf46c64a7a43de5c35915fdc477a0bbcdfeda5
MD5 61fee2baa9823e4a4a453896cb17ce41
SHA1 36e8342b3e1ffff5c5e58d6ad9e2039df0063e15
SHA512 2f0f5ae576a452e3ee5d49425bb52bb0a4c4123ed97a04a033147830463c558efa3910ec4e0e7f38a4195caf54ccf0c6c135f37140b8ff70e61ce9d9e1b6f689
TLSH
T153418DF787E4866E8A0196F0AA18AE2FDF2D0615432C7C5989D4AE27D3E3471E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 aa168108f656dce5172f889f75c8d35c9a051b63717f78a7d5d198acdc7bf7e3
MD5 974471bd2afd392268b6fe49fa96f0f9
SHA1 f16523b043d8a37481720bf1586a41b2b3d1f301
SHA512 8a0a9e4164a1029d80480aa6070ca5f6d59421ee809a089df740f5058fd2628b568819b492b11185f5f6fe40e9775089113fb43953b726638aba2ae8cf5581ca
SSDEEP 192:sxZeRpjR/f2s+QZZNINU+zodp63HW6+WNHVKfYfbIrFY1eHIg5tKaJ:sxZe/R/f2s+OZN7lsHbIfVpY1IjL
TLSH
T1D542D915AD28693B8CC7E219FA55BF53E3F96073A0941E44A6FCCA2C14EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e759b6b4d7fbda244787a10f43b673bc2e1e53b375e2c6ef1caa9aacfa2b09ab
MD5 f5f348e03d102e0e10817479037b8ca2
SHA1 aca5ff0a541915eacd714184272d94f0a6247565
SHA512 34d6463448abea4f6903c55c71e75582bf3f383dc3cca3207f20ffdf798a0134888bc22ecbc2a9069a8720f4c768eb8437f9e3930e4c06e4a3acaaecebdaf262
SSDEEP 192:sxZeRpjR/f2sjQZZNINF+zodp65HW6+WNHSq/YbIwFY1eHIgjKaJ:sxZe/R/f2sjOZNGliHbH/F+Y1IjL
TLSH
T1FC42C815AD28A93B8CC7E21DFA55BF53D3F95073A0941E44AAFC8A2C14EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6e4d1be2d5316499bf026c1c9bb3e0eff4ec9f502157d8ad07bb8617fd38ec65
MD5 c7de3d73a8fdec83a12c0ac9c9a61162
SHA1 5712fadafdb16702e4bea93ff477bccd91d884da
SHA512 978874aea4b79bfdc069fbcc3eba9c726ed6ad170a32f1cb9da02b80f8d55adebf30bf56192bd19d5c3f6223fdc721010b26a88109b9c6c07ca90696ec64cad3
SSDEEP 192:sxZeRpjR/f2sQQZZNINU+zodp63HW6+WNHVKfYfbIKFY1eHIg5tLPJ:sxZe/R/f2sQOZN7lsHbIfVgY1IjLR
TLSH
T12C42E915AD28693B8CC7E219FB55BF53E3F92073A0941E44A6FC8A2C14E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1cbd33e34382daefab64c3ed132a72b98251cfe83b960f1ee3f703217d0299e2
MD5 54c8341633fba2b125743b30948cccc9
SHA1 28e89b10e1e0c4678193aab2734d51eb69631602
SHA512 4d557ca12b754d3e7b73f4d57ca24f64ab7ff1f005a15d8d097e11fba2a9901fd136bf4538c072c2fd1f61eb0898f4d88d7f5fec88d65b86a2ac19e5311f45b9
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfwLWLlMC7fnroO:0RyktjYEbvnWvDBltu1jaewLWLywf0LS
TLSH
T10CE2EB3F780CCB7E4FC04E9DDD6A7E8B6DA802CB9598894047FA945C02C77EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5a0944c7f36c7cb9694cc3050572793ae2982fd1acf27a940fa36db5c092bacd
MD5 44b255f9c235c0c98f38555b49fa2cd1
SHA1 56a9935e45dd3c1edc481b64b00459b354b2b07b
SHA512 f0ad3379cc3ace609a44b7f1747ae63b2cffd862874c549a06d508af37d20d7304da676064ff0adfdb8c684496be7de6763104b800c4de1a80dd9df6dd9f4b95
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX47fp:OtfFvpopPxrB4Rhf4Tp
TLSH
T12FB2121571BA121038FE790C81B5972E064232B33259E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d3b1dd0d8fd23f58c930469150565f7b017d6752691c994fb94d00200c38e6f7
MD5 1b65ab65973f434a42558845df8a5652
SHA1 f264ee32e8e61243f0b5ede2dd022d503938d651
SHA512 1b36ffe7bb372369b673815ef8b625ae282bbe03bf4fd6c4fd2085d922fcc56fb2b930df3e557577031cef0732d5e805ba0390e24af84a5dd8918818c48c5fe8
SSDEEP 384:nxiFiZcIM3sNn8TUNTUlI4u5mgiL7K2flBVTPUVYoN3YgL/7Iz3of:YFQM3awgcFdBVTPUN3CA
TLSH
T1EDC24A31ECA9CDB7ACEB4B99A74A7A43DEF01163D58C8AC4D5D94D1E009329D170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6df66a888dd8f765d5de9d4144e124917e71916ebbd12b155b0477ec8cacd25e
MD5 e4dc0ff21cb9575a3c59581285eba9da
SHA1 833cafae3e6512b9f558534898aa9781ffb59ecd
SHA512 6e5e5f36ca31e2ca40ea612b0e9aab00744e39ba74ba3ae136452f61c9ee964d06f27f8dc90f6aeebfc17ec32df894676ed73daafa0a895fa62393c81f0f37dc
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mg5VnK2flBVTPUVD/7O6R2FeoCWgL/7Izgow:qFQ63AwgSqJBVTPy/7TR/N3
TLSH
T15EC23A36EC68C9BBEDFA4F9AA70A7A17EEF00163919C8AC0D5C81D1D009759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2536e4635d929ab29e2260d8449f1202e4f074cba61c0237160d83845f23926b
MD5 6f00db69045ee9306c2a12bdc45f29e9
SHA1 b8e19ab6f3b6de99a73d62b676a1eab3f62d2f65
SHA512 cf5674bb6563c07f91808f98a8d2400d18dff1c44e5765b23bfd5937068f6df6243be55ab74148cda7c17d4ab670132410d871504f0cf3512208e1c65ea26671
SSDEEP 384:nKiFiZcIM3sNn8TUNTUlI4u5mgzv82K2flBVTPUVYIN7O6R2Feo/gL/7Iz+ot:BFQM3awgc48MBVTPkN7TRJ+
TLSH
T17BC26C72E8A9CDB7ACEF4B99A70A3A47DEF01163D58C8AC4D5D94E2E008719D170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 31cc7e4fbb18cc4c92a927cbdeabcbd2bf95cafab7fced2718e32893e0165048
MD5 09e429de25d1e7ab15e5f0cd3aafd209
SHA1 a0c4fce27eb387367979176c27950472527d4c87
SHA512 c6f2ea41f1386250809b21e3ee1a17eff099b18e0a88585d5d21faa037aeaf8af0ff4f4cff299608bd4c3c0253209f71a76b62695b5162efe37fb638b6c01eb6
SSDEEP 384:naiFiZcIb63sNn8TUNTUlI4u5mgz282K2flBVTPUVY0N7O6R2Feo/gL/7Iz+ot:RFQG3awgc98MBVTPAN7TRJ+
TLSH
T139E2B2F198E789B6E8AE4B47673D2D0299FCD163B5888980F7C54D1DCC821BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.18.1\typosquatting_list.pb
Size 1.4MB
SHA256 f68ebf4f35df006cbd1c9074fec6a8fbc51a55eb056513705c9298eeb7a1ed2e
MD5 9c02e27f8bcff0a9a7d34d95f0db301e
SHA1 199a0696caa2a5399769ccce2d8855c86727f029
SHA512 39a238ac2d68857406d3fffe8d87162a109b5fb32aa010ca8dedf2ba58e9537e067ea4f16ffa225c1c85c8457cbfda2e2c3a774fdb76eefe35e03bc4094e3d09
SSDEEP 12288:8UIKHjzcldcJ9KDIyDSlypFtZPxzSsDDCVJNz:vUcJ9ODSlCFt3Sn
TLSH
T10C65B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C855F2BC6AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f5405c66f490eb2e702d19c03cad0c289e8ede023015ea72906fa4a53604c93e
MD5 97647c1930bd5f81f9799ab6878502ea
SHA1 6ac5439afed689716853af89def3a179a8b2f67e
SHA512 f99352bd0675d64df74b51fd03c5ea4caaf1357b0fb569fc0dbe29fabc1f69a53b2a32ace5da93233d80ec28c4450d815d193a8de245395ba58f190864fdbc92
TLSH
T1CD512EE04C3D5AD1D5FD0E7EB09B35ED94E8D622B8A434793858E9988A7A61D308483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 12016e1865509a8dc3aecbdcef953b6f457b07dc5b8718ea37c041105571b486
MD5 747a71cd0767f6215ce2e5bb2b10752c
SHA1 842e49cfa2be74ff9e9fb3d00e42dd310a0d27a8
SHA512 38e7b51dc7980921e61fcf831312db24c2c11d54d7c356b3f3a53402549e18453dca76ec9da90bd204bae7ad1fb9a79be749c24d92a1df1acc2865ce4ac13c25
TLSH
T1B65130E04C395AD1D5FD0E7EB09B35EC94ECD722B8A434793858E9988A7E61D304483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b2284d16ff1c3f17d4b83965b212d91513efb7cf2ec491099eac7334c84f8285
MD5 c03d232b4b1d18415f0b79f23bc84f6a
SHA1 521522541c1fb9d7c151721e39704849c03ea74d
SHA512 e379db0f342cb64d7f70b42436e9d6b59f9498549929ed960a244def81ffd4a8a7a12bcd01784a63034ba0bf701c7b5976a3fc3528a2b0dd34d2dfaf0ad1436d
TLSH
T1045140E04C386AD1D1BD0E7EB49B35EC94EC9721B8A4347D7858D9988A7A61D3044C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a65b09e586938ad2aac3efde433bd157ceec8d778ca53c24d7c869d296f71bce
MD5 d197e53a120039a3dc9423d30504fa3b
SHA1 593381cb3ff9299a47b2640385feb73e4ef11990
SHA512 e24d99536cb1de1e7b535598da2f676a6b8fc23a5d0962ca126206042d1347c7d11e0faef70eaec4f7b958f0c6b45dcf97ff863dc0748b83d8ccd0af282c80a7
TLSH
T17E412968B6E91148B3B77F1A9BF6A86E447E7D772E0BD05D10010D4E0A26B40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

vbc.exe

Path C:\Users\Admin\AppData\Local\Temp\vbc.exe
Size 1.1MB
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
SSDEEP 24576:jp2silPBMIXGWClfuRcUGIJYK15Qs/QZM:jp2sMO7VzUTJH15QFZM
TLSH
T19B454A21A7E94129F1F33B305DBA736459BEBD3A9E36D38E2294940D5D31E80AC64733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe

Path C:\Users\Admin\AppData\Roaming\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
Size 688KB
SHA256 055955fb55e022c19c1cee59fbcce4e6ae7fc00be7064855d41a6498275c983e
MD5 a23bb610b9eb410f69243fc651ad27e8
SHA1 7bd781f8392ca0fac452d914d57d104699fa328c
SHA512 fb3c9827c90410506f3f8397122261953e1399b9a410a67b2ae8b37bc892517e3fae4f11dff4c61d180df1d361239ce244ddadcb7918a5e28d582898842411b7
SSDEEP 12288:l8GEGaHFMd7KDP9p/4RCRJbUhSGN5ohdwjNBimfmxBnTDUeNISIWV:KGERlHL9FKCRJbUPkh8IQm/nTDUCX
TLSH
T145E4CFF767237EAFEB9E0BF8841426510CA858971A34F14DEC0E05A17698DA0197EDFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-13-0x0000000074910000-0x0000000074EC1000-memory.dmp

Download

memory/1520-14-0x0000000074910000-0x0000000074EC1000-memory.dmp

Download

memory/3456-6-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/4628-1-0x0000000074E02000-0x0000000074E04000-memory.dmp

Download

memory/4628-0-0x0000000001180000-0x0000000001190000-memory.dmp

Download