c87cdd1901bf7a4cd0caff33b380962d9d7848e6964cff3cbfe1565658eccc6d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2025, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_77a2fd820c2ac4a7f3955e5d8d7b3c88.html
Size

199KB
MD5

77a2fd820c2ac4a7f3955e5d8d7b3c88
SHA1

67fc2285c6972116f9fd953386dc86696f62e979
SHA256

c87cdd1901bf7a4cd0caff33b380962d9d7848e6964cff3cbfe1565658eccc6d
SHA512

fdcb0c59c848f46643d83595acaff80aaec7e2ddc90dbf3eb8b5fd2139207a2adf74bc8e30b2f6809df83a6921d0746c0a913f0edc520d3035caa61614887ad7
SSDEEP

3072:bSnpywl9Nv3c49nSMhMwM00usnxWbVRCWJdsnZMt9eGk:boywl9Nor0OF9

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1388	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
67	sites.google.com
72	sites.google.com
73	sites.google.com
80	sites.google.com
81	sites.google.com
66	sites.google.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1388_127618145\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1388_127618145\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1388_127618145\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1388_626259285\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1388_626259285\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1388_626259285\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133865400246320540"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{A40B5FD8-22EF-4CB6-82DD-B6441D9E8FBB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 5352	1388	msedge.exe	84
PID 1388 wrote to memory of 5352	1388	msedge.exe	84
PID 1388 wrote to memory of 3076	1388	msedge.exe	85
PID 1388 wrote to memory of 3076	1388	msedge.exe	85
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 3780	1388	msedge.exe	86
PID 1388 wrote to memory of 5764	1388	msedge.exe	87
PID 1388 wrote to memory of 5764	1388	msedge.exe	87
PID 1388 wrote to memory of 5764	1388	msedge.exe	87
PID 1388 wrote to memory of 5764	1388	msedge.exe	87
PID 1388 wrote to memory of 5764	1388	msedge.exe	87
PID 1388 wrote to memory of 5764	1388	msedge.exe	87
PID 1388 wrote to memory of 5764	1388	msedge.exe	87
PID 1388 wrote to memory of 5764	1388	msedge.exe	87
PID 1388 wrote to memory of 5764	1388	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77a2fd820c2ac4a7f3955e5d8d7b3c88.html
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffcd357f208,0x7ffcd357f214,0x7ffcd357f220
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1924,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2212,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2560,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5160,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5156,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2712,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5336,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5496,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5620,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5796,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5392,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6192,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6608,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6816,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7304,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7304,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7364,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6024,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6500,i,9431932118809451556,5948504571841328678,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4200

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0 0x30c
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1388_127618145\manifest.fingerprint

Filesize
66B

MD5
04ff014493f0809f18628dc62c12df79

SHA1
beaa359e23b7ed4a62d6e332ff565a1c72e5cc85

SHA256
429e9dc8b412befa7725b92e82a19a1c5c77dbb1e50289257fe50f206b88544c

SHA512
800c650bceb7b9a373e376ea056ae954f8e3d569c4751f0a27c6885ef285da64d5874930148d8e08a0d4591d5edd63500834358fe89f141d357adb187bf1537a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1388_127618145\manifest.json

Filesize
118B

MD5
56decbaf515f574521f86e481e880496

SHA1
cf86b7e930bccc9168458b7202ff89b50a41a8e3

SHA256
4aa32c5d74a694c56869211d6ff4a3d61334b9b61659dab631eb6c285416c608

SHA512
669804a28a9e1adde2e259c2a0442f2d8c054908fb1c382db27d6f08353f1d8e3ba495ac18ad4746aac4d19eeac67594f3b2b0789a607ceae70c445d07ba3196

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1388_626259285\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
df2d1721cd4e4eff7049314710dc7c11

SHA1
f5aed0158b2c0a00302f743841188881d811637a

SHA256
ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93

SHA512
11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086

Filesize
20KB

MD5
162b642946a24839c05530fb1e6059c9

SHA1
077376b7a9f0305600a193d03f7efabbc2aaaed8

SHA256
03c8a9d542b931ca3b2d6a9236ab3af3f4897171727eea729d75b1bfcbd472f2

SHA512
fc77d2d1e7797f7586dce55e85046bd490c8821b8edef88a014ea5e7c5da22c258a9133e4fc303e134c2778e4005433f876e667c93187d399dcc1443695c3ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e837dcfdf38fb6f7c348a7bf99dc7f8e

SHA1
44faaf41ac25e128cd0ebe58e960b7101977839e

SHA256
7f0c091c83cb6ab84ec4a4d82f7b6937a47a85dd11fde86b15149544e943ac92

SHA512
081027465efc9f2480968853951e298169424fa77f428c4e497e96fbcf76819adeb691575ce00c8c0df55dab5117e301babcb66aa2b4aea80010ada3b4b61a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58abeb.TMP

Filesize
3KB

MD5
5ccd4a086e02a36afa30c08e2a8f5b17

SHA1
b5d4b9c15b17fb732b21765febf07ba3de646c63

SHA256
bc9308d39d116a91dae87cf38b0c4b7d66d04c0a57cfafc61def9d0e4fad4d04

SHA512
96b34f547a63512c3ce49c454db19dae5a8295283e6a2677bf0d3d1bac62ba19217bf1f07d6a813ab28ece2fdd588f8a2913d152c28674802c15a56c106a021e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
35bfe65a7072a8ef796db6280a5570d7

SHA1
bd42241696cda811af5f59b5096afc96307888bf

SHA256
c8250c522226c0f4a55dff01dd089ff78380e4cff995adb5fd3d8f0d2d948301

SHA512
5440deb85375f47b5fff1f0cc1c38d1712a394dbdaa07254f97a82fe44eba969fed6d6f35be467262f93631c1ed9506e44457075fb8f1ee595de13ce5d11435e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
9b72e5d95da1b6e73ba50e876993e380

SHA1
7ae3b573ec9fe4d94d1464635f66fd69a5e6ca18

SHA256
99f786d26ea16d585c65187e7c79803e076278417db2afe397b4166f79242bc4

SHA512
77ffc8807c907400082c4e314ce9f5287acd2f275476e1d5cccdc5c39234e164f7cfdb53efeabebc22073ed293502b00119187b9388612f50c15d20613722edc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
53d4f8e8088d862bf74d63a8e56701cf

SHA1
616e53b685b9184ab283daf7f0734136f1899186

SHA256
81b3b092dad975d55d99bc275e50d22dbc40c278f7355871788b5fd6ef8f89cf

SHA512
6718939198508c578b97390a74372a1280d9e01cc2e6e01047737741647a35bd280b088e043b825639a37c39f60b20231888839c84134cbd4fec0329b0a341db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
ef6faa92c094d5562e56cf98e4fb50b9

SHA1
bf5c1108a82494c055f12ca6aae680d90696b62b

SHA256
f32e8f55a4833fe30165968382ce26ce4f4dbe3a0c0629deeaf303f01966b5a5

SHA512
5f2ef723ba86ea612a0ef5a5941931d758099ee747da9a09dc8bb6a7243d92265781518123b0271dc9ef39ae5bdee0eb6183373c73ec028fb56cb59ad674c613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
c4df611745e8e4f44c4b89767ccde0df

SHA1
d8ab6d0c11f1c817dc2e89e2ccbd69a0f1cdc5b6

SHA256
9f6ff37d1b51ae9504e090d1138e24667489ee910de1836754ea18aa7c6417c3

SHA512
bfa2b75a3fa861fd55becd93ee433ccc58546e6db91d37e9f1fa0351e0981da9cdfb7e37295a153215a328ff4cb76be0c87a5da66066edfb50c34f72bd936092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
4ae88746f93fb225e645cd0a0c467317

SHA1
f49abe712ecd38015b5a42795444cdcc30d11d3f

SHA256
41ed8f3fe34e4bbbf73ccb34d3638136653f21ec4309087cf4984100c0e47015

SHA512
19c15c1017b3b199c6710c834976ebbfb7edd5baa4686786a5a65076fec42ec97c408b5aebaa45e415e6f998dc259e1e0aae7492d8d53d3c48503b5b733a9f09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
c1b3299f66e59983f43bbae397caffac

SHA1
f5d7357b52854f22b2617eb93759ef696a11bae6

SHA256
2ab047c7e5988de9f0c026f08e21f1b0bc8d8a42fd1a9919e662daf46620a19f

SHA512
4a4b5d51dde1312b59d1f152b402e01eb3cb4dafb227250e14558c2927d82c74158043305899f3bf6c4f26f96468d7beb2c2d3017827b4a77d51f6cc6906dd12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
cc48a752029756fbb1612cd97ebc8c95

SHA1
1df19d41674bd04edea0800057e55079cec70f75

SHA256
98ccedec56c804f34c323ae0e6196db43fa8e8c3f7519a7d74b00181a5dd0477

SHA512
3d9961970a5f03978fb325cb3c5b5b70cf69b35941773bdd99b62b8786055428316627e3577a4fefce3d6e0e70086972806d3db2f663a5410cc1010d6874cf87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f0398c6669fe84061fdc5f75c2c894e2

SHA1
8b073d19718e1f685a97f3c832550c0289b5f6ae

SHA256
2949c314551221bb0655fe72f6c64b1758101c23f9c3f7cc7f0b6d73b92ae6a0

SHA512
814645c5613d6f2b52272044342ae986aff9b4ac98fee843f68a059b6bae5dbe1da31a5e2bd44941ac41d935f0af066aedd8aa74340199b6e0efa70c2ae4c3e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
937131bc93a8b71d97380aec006ca61d

SHA1
904323e0ed9fdc8d303d36d3868a80a365b5b17c

SHA256
a5df0594a290dc028e2b8cafec1e79158063c732a248c6a719508745ac102289

SHA512
fea47042e18a4e980b86e9f8a3f7943bcecf461a5a2363398a2ec16ccf07a1caf72e6035457e14f34a07ee911ab320ab3d2f788cd5fe80495c1ed4c967d6d3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
bffb15f60dcc71569d17e96453e74ade

SHA1
07a067c04079192692497f02f5938ef35041a362

SHA256
2bdf2a7c88e2c6df7b8ca1f5883742bfb6f8ad2b57030bacb512608a412dc789

SHA512
363ec9ea4c59eaae0147c84083169a11b13c9adb8d7dd21b13c55cecd981f594489b98f9231c2a9dd43bd5ea3a4d17215a870fd581492acbbaf679679a07bcb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.15.1\typosquatting_list.pb

Filesize
631KB

MD5
ad013f0723d332e26a9101a81483661e

SHA1
a3db6536228681288dbf39d4a94d2d8f11e77d3f

SHA256
96fb259d4c8d3ed7d7c657b6aecc8ccd2b0730b11244a83499c0d8dab91087d5

SHA512
b2c700ac36657d288cbe0bdbbe7856299d6af24e00fce8f9d78434ac2f10fc82f9399b03cd5995817721a0d252976f99424062e5b79d0281d8163aa5af330f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
a65385a32cef9b798268e1b6b54cda7e

SHA1
c330d1e5118d209e427523039172e0f8de5020a8

SHA256
42ae3ba87dac4ee35f4c70491f3cf0f33a8705cf109e5eebcfa8adfc7775ac1e

SHA512
d530672f8ec7c01f1ba6217e070a1ea5c8a2fa99720d4018e0d224860e07386e15300f4692d46c4038ed8017e1cd498bd79cc406d0045fb5e0549402bff3e144

Download Submit