e21228bfb805c55533e1c18b05380fa433df0f56ec75acc0fc255501d1b0c67d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2025, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_727720b78d29d7e017027a2454c22cde.html
Size

99KB
MD5

727720b78d29d7e017027a2454c22cde
SHA1

d39db7ba167bb9f8bcfe7009a320d99e70f22816
SHA256

e21228bfb805c55533e1c18b05380fa433df0f56ec75acc0fc255501d1b0c67d
SHA512

d4b76b9f33d0fba6a9db5fbc52d6edfe96001d29bec80db2958ab8cbf7df74f3e54beb5a65440b83913e705e5e5a1de56c41c3fc51a470463c88502a34400801
SSDEEP

3072:RRlBuh/b5vfdikc8IL1VIS2OBNnoCphLZDrciTW41vyOntMrU:vlBuxb5vfdikcBLQOBNnoCphLZDrcpU

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6064	msedge.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_331739169\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_2107496644\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_2107496644\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_695123435\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_695123435\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_695123435\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_331739169\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_2107496644\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_2107496644\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_2107496644\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_331739169\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133864394374408649"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3446877943-4095308722-756223633-1000\{42BB56DD-DFC9-4B6D-BF6A-09A26338746D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 3224	6064	msedge.exe	84
PID 6064 wrote to memory of 3224	6064	msedge.exe	84
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1956	6064	msedge.exe	87
PID 6064 wrote to memory of 1956	6064	msedge.exe	87
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 1048	6064	msedge.exe	86
PID 6064 wrote to memory of 2944	6064	msedge.exe	88
PID 6064 wrote to memory of 2944	6064	msedge.exe	88
PID 6064 wrote to memory of 2944	6064	msedge.exe	88
PID 6064 wrote to memory of 2944	6064	msedge.exe	88
PID 6064 wrote to memory of 2944	6064	msedge.exe	88
PID 6064 wrote to memory of 2944	6064	msedge.exe	88
PID 6064 wrote to memory of 2944	6064	msedge.exe	88
PID 6064 wrote to memory of 2944	6064	msedge.exe	88
PID 6064 wrote to memory of 2944	6064	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_727720b78d29d7e017027a2454c22cde.html
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffcd261f208,0x7ffcd261f214,0x7ffcd261f220
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2244,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2636,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3412,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3420,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5536,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5540,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5920,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5912,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6056,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5292,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5524,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5524,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6260,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5808,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5764,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5676,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6184,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6552,i,11813723893452078354,560539699785513238,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping6064_2107496644\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping6064_331739169\manifest.fingerprint

Filesize
66B

MD5
a9e3cf0a18cb6ca25bfb4ce3abbcbdb3

SHA1
a214d02de4324586ebe24d5255244256e200020b

SHA256
42d745bf8d6c81c7e1be8a05dd897f9681c14899a5ccb56d64f5656d6b5db68a

SHA512
860bf843741c6273407ec964d6e4131a7d15f73c45c4124796c5fcb7f36e59a104ab89b59d17a230532addfa2eda0fb6a95cd103c828b027ca366107c408f9ab

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping6064_331739169\manifest.json

Filesize
118B

MD5
69cdba269c964a19494350e90709392e

SHA1
40270de55e4c670a2e4a20f19d1c8d53048d78c5

SHA256
ae1fb39641c69c58230b7fbf2932ede2eec0c25cf61661306892d7bf433ab5f9

SHA512
b82f3b89da8725751bdd56f22e9cfa256e3e0f6633653480492a2e7a75ae52025b1118470ab3f964c317b4463db7cfc8770675c4f83efbb945a50cfef1c2afa7

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping6064_695123435\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b0736a36bad51260e5db322736df2e9

SHA1
30af14ed09d3f769230d67f51e0adb955833673e

SHA256
0d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087

SHA512
caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
371f47fbca1edad5a4463b070696fb7e

SHA1
45a489b4975d6dbb404f6aef80da21f53f7b88b2

SHA256
2877d47ed85bfa233a517ddb63e56bf56e759a0e9bb33739c69c258d03ebc035

SHA512
5c5736df39a883ed325a6601068252eb6614d9538e80977a355e8d6baa5c5fff264c781704775586d70dd640a69f012dd340f2f2147dd8e4b1dbf8b8a05527a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5924b5.TMP

Filesize
3KB

MD5
eac61066b3164edb68e70fabc9d78c0d

SHA1
4e3fe961131efefe9845f7ba5f427357deabde85

SHA256
1b64565d05e4eb0d54084be0854f75654b040902f072ccbb023f3a76c5b1be89

SHA512
36a5c05ee8849da2e2e2cec3fd694fa8b7dbd141c7ef95f6f4872133220cdb1fb32f6b48c849b1b30345f64afd42d2738ca964a24856352f59b3fe46ec0ff2cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
2bd5a61527b350bcfd06b4c8ee9aa8d2

SHA1
714a9c625d6e95a6c1efc106c3133fa3eccffd75

SHA256
0d80409189e64e7cf5a34b88e8d13f79c7348e143d49e9d34583aa41052c3326

SHA512
eeed8016f8546befc44d521414b8452b613f7d60ef3fd2d1e695707f8d33f9c66b77135622c01f0735cb3a5fffbfeb3bc3935df735aee007eaadaa831a32c52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
afd5d06374348ce73291531d8c45bce7

SHA1
d79a110713c396c97f085313f1a97a1512617332

SHA256
1dff8b1e67463cbbd20cb3117befd1aa70c80d3200b91f8e28159040788f3e92

SHA512
8835aa521d9c5a05a4e84719e8e64c34937da5e68fae2143b73ff65508bf757ccea4eb542947a45e3915ad43beacfbd6bdc21dea59bc9fbecbd8de4671e429ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
b489bcdd848cc622e34617d9dc18a559

SHA1
4d6744303342e85db6b237993a76d12f40b23eee

SHA256
3e70c6e5e8a1fb77183728a23f3a5bd3d2f612ae25587fecc60bc17090711400

SHA512
1949052bba268a899f41cc23a2363811a3ae561390377b94eadd382a0bf8f08607f7cd277a1e49d2dd796478d71695cecc684be2afeddd2fab761879685d8389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
0c9ff06fe98849f6ffc5e03232b6822b

SHA1
1247cd78f0a99eddc4d059b1cf799369bc00908d

SHA256
091334173dc639f330443788672b7a4626f4d51ec30ff3144e83708f87b0ea08

SHA512
d9f4761336fb60091b74031b64b2b8b18e2e7739eb59bcf37c439a1f8e0a8b0dcbec934109cf29e927902964bfbcd450db6c5a5c25862d1738fdc2a7450f17e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
22901881cc9c2a8d62033aeb794ad95f

SHA1
758a7569afad72ad8a8a6aa3c9a3bc96fd09ac74

SHA256
3c5901341d0deef2ad6c266221988838c5cd2b37191037a3ee1bb1fba1d06728

SHA512
96c7670051e4a75d3caeb6ea832650ef0c9da169f17b28aef8f837962dd94bf83b048d90ced80f78880ea707e2dc70fd1d6889c144153961c7dedc5ef6677c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
77f2ef02c2378b7a3829de0d8337f476

SHA1
9e993da969617802a4c57320ed5c76a8b28300c7

SHA256
492fe94474bc7b0fd6508c65acb6bc6a850e63fef73cfba171affc4e9e46ff1b

SHA512
31548449e2e5502587ec098da22e8a15741deb0e25ce503a5eb77559de5312446158fa139c636ec814cd3f22a20536b61ae870c7253a727d4ae8cf3fa4ce0499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
3b2798ee1632d5e12e8d1342ba9b8a26

SHA1
c927c9845ce97618e93a9485791a32eb47e290e6

SHA256
269293e05457da2df9f4865bf12fbdd70e5b7cfe46de211eae58a67a5ffaa6bc

SHA512
1e32acdd74975314d393a18fb7c6e30dd8a61070525682a66f96de9af4ef1c92b50ba4f1ecbbbf39cc905c09f828c22f97ae90a737d9ad819d824bd8af833031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
52bf7abf4365420578d258385ded30f3

SHA1
28a5f1fb2a76d85a04c355682460f449c5cfae98

SHA256
d75da9ca376b7167994d8dc283a333dcaeac0f201053b47536f5a606aee7ec4d

SHA512
060a79fd2322a8986875ce57f23fc95b235b873f8a10f15c3df90ff5be8f0d2a85fb40b18a56e2b543a93e490cb155872a4ab267dd1f630e0545d72983b21667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
ae7116f4a2e8648b72ae815a4e2732b4

SHA1
2e2523e5e953479bd340fbe53e8b97be7fd6c81f

SHA256
6b48cef84a65e55b8170e65ccc021819047589ec7ec5d6e357c88b5dbb08e9dc

SHA512
1bb652c5413e9f3d4348f8f7fba1ebc6d6bdaf79fbe500152c175ece81f50a86afdf3d53c446f978a19df8d57dc1de187096032d81c6ac3478ddd4747c49e393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
a8e7abbaafbced8dc54f34dde0df290e

SHA1
f8ffc8fd8bc240f937cdaf350dfd8f180c0af6c9

SHA256
052080abf5e6b020c3ad5c3dc2d6b1aa4c531048fef98e6fc8a3bfc3f7037443

SHA512
95083ca09543a6056091787692fae2da26b887f1f1952febc8ece7614f19e871c2d4182be92dacf04c441ea0e5482e627714a9b0c1f474eb70d0439ac126136f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
9127eac8ade6675ec142d6e0e40993b1

SHA1
52cc86189da901095d7e767bf61d0ba2c12eecfc

SHA256
e8bc0545ff3bb4ad190677f7026fb77d4bdfd17006863b479c93baf4953f89b0

SHA512
fbfe5c0eae521e078206c45c2acaac023c304dc8cd221a387c59ab674611af15b9d4decfd1315cad76cc256610b226e1df7fb25af0817dc0c77192add7a586d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
983e9c5d5cdf7f58361f869f7712bc0a

SHA1
566dac3e847a840efbbb4874639b8668d5617452

SHA256
67790eb965965e3fabf7f1f3d238a2887e04ad92f212cc66a3e2a47a8c074e6c

SHA512
12e0f004603e34dd408a743ebc6adb51296aa62b08e93cb9e59c9bf0e150199b8e80903c43757713ea437a633048ac4e408c4c76bfb9ca66eaaa6ee388923696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.14.1\typosquatting_list.pb

Filesize
631KB

MD5
d92af9553af8973d79eb61a32aacca2d

SHA1
b60dd5bc7a4194792a05477b7e661b120a0f9d07

SHA256
8f04e34ef5b125203b8be86dd9dbda42d7396685232bd94c87a250545f0e67e5

SHA512
a7bb5559d56b7c48ccf6b0404d5893da4fc9b74301cec6b0308e513d773e1cfc02ced8dc41d3644a4a04476bdf87ad78ff2bc1abf207f43d2e7141fa66f3c763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0099128f33a944d3b5e3c24df2bddc33

SHA1
9b5bcb6112c7db373a1007c934e9d8bbbfd5875d

SHA256
a56e6ee768ea3ff93d2224af42deb60a29e297a81d1a2e5de78264852ab7c46f

SHA512
9b44117765221bdd3d8c3e5e1159427f8608ab7d8a64fb91cf8d2d0e0a7a6428619123e3a66c7767eed9508acc8cd1e27b2b3955cc04f83d2010b697aae422cd

Download Submit