972e459a9262ce203588cd5b8d85225ca8e0092381d7c5d6e37449c034accc1b

Analysis

max time kernel
136s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7d7f14f4b122a9e8ace7676536d953d4.html
Size

199KB
MD5

7d7f14f4b122a9e8ace7676536d953d4
SHA1

e6ff94791c1f8a3130642e45ef44cd5096df2010
SHA256

972e459a9262ce203588cd5b8d85225ca8e0092381d7c5d6e37449c034accc1b
SHA512

d896e5bc387e3b80dd2023db38c9c0bea2e22853da942b29d3f8d4332f0adf31eea329ffac7a1136c08db62ee94cccb29bee78ce4c530211c719b280c90ac1a8
SSDEEP

3072:DSnpywl9Nv3c49nSMhMwM00usnxWbVRCWJdsnzMt9eGc:Doywl9Nor0Ozl

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
63	sites.google.com
64	sites.google.com
68	sites.google.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_482176945\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1154580723\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1190964168\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_482176945\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_482176945\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_482176945\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_482176945\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1154580723\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1154580723\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1190964168\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1190964168\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1190964168\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1190964168\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1190964168\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133866735775793855"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{AD1AA106-48D3-413A-A9E3-EBC64509486F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5200 wrote to memory of 2832	5200	msedge.exe	84
PID 5200 wrote to memory of 2832	5200	msedge.exe	84
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 1104	5200	msedge.exe	85
PID 5200 wrote to memory of 1104	5200	msedge.exe	85
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 6028	5200	msedge.exe	86
PID 5200 wrote to memory of 220	5200	msedge.exe	87
PID 5200 wrote to memory of 220	5200	msedge.exe	87
PID 5200 wrote to memory of 220	5200	msedge.exe	87
PID 5200 wrote to memory of 220	5200	msedge.exe	87
PID 5200 wrote to memory of 220	5200	msedge.exe	87
PID 5200 wrote to memory of 220	5200	msedge.exe	87
PID 5200 wrote to memory of 220	5200	msedge.exe	87
PID 5200 wrote to memory of 220	5200	msedge.exe	87
PID 5200 wrote to memory of 220	5200	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7d7f14f4b122a9e8ace7676536d953d4.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffa3a2df208,0x7ffa3a2df214,0x7ffa3a2df220
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1916,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2276,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2472,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5236,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5252,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5172,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2012,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2940,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5632,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5860,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6116,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6252,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6268,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6676,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6892,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7316,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=152 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7316,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=152 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8080,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8076,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7128,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6912,i,9296540120378926168,15624538553556337754,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4584

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x51c
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1154580723\arbitration_metadata.txt

Filesize
343KB

MD5
6b8740e0662b67555214c91c8781268b

SHA1
606536ad8540063e58d34c86b1aa226e80aaaf1c

SHA256
07d3423beb505d69a9ed17c71e96a88509c41117e6ab9d6014cffe81c46fe7c2

SHA512
46022d1ca0ff6cc25e93b8b65355993cf774a9297dc6262b992eef18e530ded6b6941d0be830cff76fcd355d7d375ec6cb4ffb34a756273de8b63a103fd5448c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1154580723\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5200_1190964168\manifest.json

Filesize
119B

MD5
f3eb631411fea6b5f0f0d369e1236cb3

SHA1
8366d7cddf1c1ab8ba541e884475697e7028b4e0

SHA256
ebbc79d0fccf58eeaeee58e3acbd3b327c06b5b62fc83ef0128804b00a7025d0

SHA512
4830e03d643b0474726ef93ad379814f4b54471e882c1aec5be17a0147f04cfbe031f8d74960a80be6b6491d3427eca3f06bc88cc06740c2ad4eb08e4d3e4338

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5200_482176945\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\v1FieldTypes.json

Filesize
509KB

MD5
630f694f05bdfb788a9731d59b7a5bfe

SHA1
689c0e95aaefcbaca002f4e60c51c3610d100b67

SHA256
ad6fdee06aa37e3af6034af935f74b58c1933752478026ceeccf47dc506c8779

SHA512
6ee64baab1af4551851dcef549b49ec1442aa0b67d2149ac9338dc1fe0082ee24f4611fcc76d6b8abeb828ad957a9fa847cbc9c98cdf42dd410d046686b3769b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
60d40d2b37759323c10800b75df359b8

SHA1
f5890e7d8fc1976fe036fea293832d2e9968c05c

SHA256
c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0

SHA512
0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
32e00a72dd0a078c7631e4bd6b4a20ec

SHA1
505cfaa1b9b73907beac847fdb260eca1c1ca373

SHA256
d9403c2fbf40152a81f36ae1d6ae0823b4c368f166620dae9d218366f1a02e73

SHA512
ca8961e638c7ac33f593e62dbbe570000dcf2afff09e1f668e4d2dea1c8cba7f102810dc9f00cb818b7dc6da000b0f2a50438c281106ae177332bf24b12f4e5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587e53.TMP

Filesize
3KB

MD5
ad63cb3b643053eeb0db98fd41a7413e

SHA1
0d94938deba6af25a01269035d00164b11ab2f40

SHA256
f1d3f4e3d8072d0b5ecd3eff9ce1aff23974caef28d1e039fe47d290f19ad706

SHA512
eadf2ba5fad66a0f67904ccdeaeae6fb915b4716b90604a361a0690ffba807ac8388c83b2075c123f7cdb11fb86d2dfaae5797fc1f1962cf010893068bb7a540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
b0e906be3088bfd3f0bfc412c3cf0cc1

SHA1
d5cf46d6f78a3d0bc912f5f79ef4f80feef3ae2e

SHA256
335c1046c8dd58efbba5842854b0ecb8829b5dd4df9b26f06112e6e17655c0d6

SHA512
9df7db6eca68246b6169c0192ba528dac05be614d8d5ae5983bf7e48b5f4c5531a60da2d2bbc9a3ec2adad8ed264398a882240ea0116155c15358f4de53fbc6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
810064b0e9fb328756d463161eee6c39

SHA1
c9c7b7a948fd6f0b1ba0a3073dbe4709b55cf09e

SHA256
23bf845a381636b6cc43f34c0aadb5d2b19b27ffb74aff20066e4539ea420e51

SHA512
566aca36efa2b9c5f7b870be33c48bcd5d6d230fb41c0724bcbfa9d16e541fccb69cbd2fc29f6a359ce8bc23e4610f6db3939e9f5dadc63aa37ca808c6561bba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
426d602618cf8746295f1dd3b921ab06

SHA1
9bad5dbbfbbbdfa6246cb7c84fa252a3c48c65a0

SHA256
55e161e19a8dba851cc33007ceb614fd761853e5fff052c86fbab99369a1f59d

SHA512
fcd2f09e8a626e2ea713404c90f7a8932eaf74ab82c335ff76b9b1e01a2fb72991189ba130e8022adba96933c0691c92e0d4eeb470862c4cfcad53ee1db00d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
32bd26b7a11d9697f94c7beb7ff3550f

SHA1
6918f3eb19f7b32d77ae014aeac7ae240acd575e

SHA256
bf9559e6ca2725610c2ab00ca40ebc407b74f8c370d4a7f18b21eb017ef2323b

SHA512
10a2864f7f82b50160de825d22bf50839d5831f00038565edb413a9532614dabbeba6ca2484da5ff62ff9ff7fb9caed32a42e757404dc9e8759f975d9b027c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
2b58d6c9263f580e75788116c60ab12f

SHA1
020375256cc923336f5f2cdf03cb8014513a00e6

SHA256
fe29ffca1907678f586cd9cd67400e8e5b240087b75e68c5693d53eeca811f29

SHA512
0a739124fc5e5eda8768efae484c93002a1ce1d3ab7aca9532c6fc3ebda18da07ed2c823f4125cb42dd7fddbd3ec6ccaf8510be964f89249206863f9f8efff91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
e137b7237b74f7992e2efaf5b816c933

SHA1
059d29825e168c7bf689d9a878e53dcd42940e71

SHA256
1a2a62afb7e590fd45de13bba903dacba8fc67ef602753a2de74e46887e7414b

SHA512
e23d46f8578087033fb2db5861120443191fac9f702c0c81d302925f8d38a3ca9f0ff80c5b87c16e1f1ce9e59e277583cff02e2c8d1a6ac846e5291ead89eb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
d6cadb5dcbb0fdf0cce323c6366fa907

SHA1
0b13a617cbdffeadf37727235362700d1bb720cb

SHA256
15e5da9f9df6f746f0dfe01d8d1aeb3990dac21fe37e4269329de1a455c08ffb

SHA512
9d067643717391f53796c0ecf9ce346801ae6ebed6b1dc7eaeefef983795df38f45ef00f29e3586e0bb561fc69d9df950c239218b58f048df5d07d9fab5f56ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
afc96164be194edb483c5e6dbba450fd

SHA1
ed16828864fdc39a53e1c7028bed2e79163a103f

SHA256
b982c4bc66bfb6c4dc4998a880a1bffef9db2f8ab3b7dccfa6a9d9959ef212ee

SHA512
0d055ea6243549f7e4527d8c2b452c00a601921a255165a1570e7f910febd292d3db2a84bd20e36bea2abeb9568e6e46b18f4ad0612c98d23e0120b20a6bbd80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
462B

MD5
84433bc8d00b52114375d24e2cfe6e8c

SHA1
bc50857dce774bed93a3122fcf7742c4a8ac1027

SHA256
192d675320a9c33f0b49d8e1aae8ac7147311bb40fe8e92cb9a052c79fbc48ad

SHA512
15d01b62a3204286bcb8c71c0e91317f8ea0791bb09ce8dd7d2b7e8029afaa9fad0fdd51e2a49483f552ca576b90cc959440c82346a64f06bbbae287a392967d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
b10b13464b803a7bcd98ede3fbddf3ed

SHA1
227231558944a66100538ee0eaab376dd9429f1d

SHA256
d1af0ceb266abffab4ba202cee657f900e97b9e46d835b60ba4eb3467abd89e1

SHA512
bd31ea60c9dea19eded015ef4c2a9ac972b168ad87977b22126e64a592c6be1578d7473375f98eda2040844ba77657cdc6fcc8b12b2ec4037c12fdaeab77a6f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
3c078ec6c21e4811e8d1dc7ff17e3bd2

SHA1
1c5ac0af52d5de92866c10656776f7a01486e834

SHA256
1256b39018c013abd0d42f175ed9e6832755eb6a825a79cf03ac841af8daf27f

SHA512
0e68f7fe1e6f87d69e70aa9d2f59d546776c760858d92da0eb05d0ac7ac4ba5ba5e26322693ddb1ece3e43969b73c630ae09e37e19d9f3fd2308f874d82f9254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
cd5ebfa8e4c088dadc91008ba8c8f540

SHA1
3daf3a26679121690c812ea89c0d25e3dc40d930

SHA256
4bbd4e401b48236ae8b77893d6d0d0cd11e5b01d657771a96cda3c4a7b315039

SHA512
90efec97f81e1966369c8733cfe17af03d32f01ad574c4caf7b55ae8f4033a97217662fd68ada5740dcc2469d8ce458aaa6e9e5cc79fd264e2f846563c053219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
6b42f50a9b69672d140819295e4e34b0

SHA1
4ed956386ad2bb856c5957af51417dcfab3c9dcd

SHA256
1e5c5cb77986832337962ac50569bbb22170efd40a7057b33d61ee2c6fc55775

SHA512
228f9e406021e74171f7c71394dd54316bf94891567069bb7ca4397d9d1d2dfe18ff4a90c18d67d69f16008126d235ee46ab4de99c44290043e7e9482ec914d9

Download Submit