2145d0962376235bde6ba0b0ba6fa8c87f2864a03133e8dff605a20e3bf178e6

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2025, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_81533f27a70adf424716ab27711446e1.html
Size

199KB
MD5

81533f27a70adf424716ab27711446e1
SHA1

18f7c7e19279608c821f644ed1968b115690fc8c
SHA256

2145d0962376235bde6ba0b0ba6fa8c87f2864a03133e8dff605a20e3bf178e6
SHA512

18e74e2a387fc85248d719e4692dfdf05a68dc356744f9c5a46539b2b0a847c1484153ed0244ccc301711518de33e319d4fda1e5610b1ded9d95ddccb4a0d888
SSDEEP

3072:9Snpywl9Nv3c49nSMhMwM00usnxWPVRCWJdsnzMtuxG+:9oywl9NorMOVL

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
89	sites.google.com
90	sites.google.com
91	sites.google.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1155735226\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1155735226\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1155735226\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1599038709\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1599038709\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_362788689\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_362788689\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1155735226\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1155735226\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1599038709\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_362788689\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869185025785769"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{08FAF0F5-5C5A-4F4C-AD65-97285E4BA95A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 5224	5236	msedge.exe	85
PID 5236 wrote to memory of 5224	5236	msedge.exe	85
PID 5236 wrote to memory of 5364	5236	msedge.exe	86
PID 5236 wrote to memory of 5364	5236	msedge.exe	86
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 1532	5236	msedge.exe	87
PID 5236 wrote to memory of 4384	5236	msedge.exe	88
PID 5236 wrote to memory of 4384	5236	msedge.exe	88
PID 5236 wrote to memory of 4384	5236	msedge.exe	88
PID 5236 wrote to memory of 4384	5236	msedge.exe	88
PID 5236 wrote to memory of 4384	5236	msedge.exe	88
PID 5236 wrote to memory of 4384	5236	msedge.exe	88
PID 5236 wrote to memory of 4384	5236	msedge.exe	88
PID 5236 wrote to memory of 4384	5236	msedge.exe	88
PID 5236 wrote to memory of 4384	5236	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81533f27a70adf424716ab27711446e1.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffd8343f208,0x7ffd8343f214,0x7ffd8343f220
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1972,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2144,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2592,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2988,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3516,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5208,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5176,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5168,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5156,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5360,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5464,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5632,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5812,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6556,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6452,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6608,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6348,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7196,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7196,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7072,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6632,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6312,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7136,i,12953750509826590098,11745545195591652632,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x514
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1155735226\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1599038709\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1599038709\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5236_362788689\manifest.json

Filesize
118B

MD5
1c86577f2cd4d32c2a66df8ea2688d85

SHA1
35a17132f6e9fa4cf9f7cfb307870eef46b697f7

SHA256
312e962260bb133a4c811348a75396477d2bc284701393137cbdad971317578c

SHA512
ab8583a6c1e0f34f937296d12b9c045c99a8d5eb61fb36e797940cb0bd65f952eb99cfcd44c56ae45d6d14ff330bde0bfbd9cf5c18fb8296bf68a64b38ef7594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
65044109d1beb8ed8d59560642cbc519

SHA1
0084485b0aa26069232fab51ee603682e8edfd17

SHA256
a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d

SHA512
96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c

Filesize
106KB

MD5
4716c34831223261850822c9fd66512b

SHA1
ec68a7f6110e531b2080fdf642246a6e956d4fcf

SHA256
48b847d630702a82a1d8b0a27f8282ea7373f0bb5d160848465fdd2fb087f1b6

SHA512
b7ca5b95c0ec106ad07e30e960aa0ff28a8ecb0e1ab79bda6f6a5af93b5132c7b9e73d6a24179508e8037a5eca4af1e3eb858dec56e2fc70077b5e62a0804d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a6592ad919a52eb61bd000f193804d1b

SHA1
c52a0ef2842fa1c1e43a1dd998d50971a55e874f

SHA256
60a97671e0f56f8bbcfd391b12b01936e7070cf410acdbe88c05f4d6554fc2af

SHA512
bfa741dd0daee1bbd3a2d2f2a9e7d47a392dc0bcbbb06b6433e6770b4d1b407084aa37247a47f8fe34d68fd5236cf00deb6e53849a63b28375bb03fc9d09d295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5841d6.TMP

Filesize
3KB

MD5
5a450576636b3bd57afa4ec6a7ae2967

SHA1
b85dbf50ad97ced7c84911bee454c30c65b61e3f

SHA256
ffc8f9530d0099221b87f288f8d473f0c6d9320b60ac12a9aa903e48fc2c3f7a

SHA512
a3aaba18d1bec8e0a4c75abf40d5c686101aef43b32cedaa0a5aa643c3a757519fdafebc69b10a19963b48178debc6628cbf142e88408a0ba1cc17fbe6afe16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
df0fd78aaecc54a5b2a73b9b6f8b9f8e

SHA1
08ed3a8c2bcc15d095c796a5106f2a1a76982424

SHA256
4f21bf811d037fe249846f2415fd3d553244aba1fe504d014d1ce3122a202033

SHA512
5614aacbc77fe769710d0492fed0cc86d86a8bb2278120110288cc35e6aec34b380dd6afb67715986dc4d70ddd9fb9d60b6a52cf1ece92d20c0cb97deaf6da03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
0d2b23fe05e0fc897ad4878490cd621d

SHA1
d89e287a32cf0db9de4b0ebb167aa85049628f17

SHA256
920903a4446e8dfbb18dc1c7cc14a63c1cbb88f5ca82afee7ae7cbe6b5b4f44e

SHA512
6a4baeec80e695b563ed11450af51e0abab5d373b7df2d6236cf4aaebc2ab2acd54a5b57a303f97329d1dd7bfd681e345ddd0e7451469ba6b342698534fbe80f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
1e4017c81141ff7484649fa47a02984c

SHA1
0be9439144e8729c1300baebca66d471d989a326

SHA256
b25a821367a47d98e7c2edcb4ac067bf8d2903b7343bac8438e612c340d2435d

SHA512
5abd7a8116c642dab4af409c930042ba2eb09958687f36aa58563bfa5f9f40046f5cc56bce8b2c7e4e1ed220bb1ee70172219444a3e1595bc62664217879115c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
72757c76588d4779484adf3da71f4c1d

SHA1
0026cb1c7ffb27957b653428e5048d76c0ea31ba

SHA256
698159b0b16c8718daae9715588c2ae8841938d59d1ad675608e5515983cd1db

SHA512
83e1b230211a56b822e76992de6bffa2a531010566a6d61eb00b43a22d90b071a8db772614f7cb432296484181cecee7b9a050df59c512e16d9b2f79f0a7ffe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
495cf85553a19c8bc3bac36250541baf

SHA1
6ef4bb3f5941a9de0c84873c214518e22f77e411

SHA256
e3b5584957226d58e6a7d694df0aafe11f30e30936142850951c6971769783c1

SHA512
2ec0965ae0e638ce3ac41ea8989697725d468a63ee31d8261e890ec74cecd2b1c984a1801a1b5ed8bc245253b79b9d7c094919eb301c958ba3e8b3873f6edd0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
c1244b6a2a2a3947668642a838c88465

SHA1
190042b438f81787d1d7de0c1b67d4455b92ad94

SHA256
ee478c6a3bd7bebacad8a7cf0d6ec2e853f4847f7e33bc2823657bd2866feb4a

SHA512
3247e80c15bb9d75b92da8865f85b90ed854d7234ca38630a646159a774ed44100c734e65734cd619129462f5858b4ac52fb3cb12b970b7ba9b14e1545530eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
b9856cbe42680f23b1deebfec62ae5d5

SHA1
9fe9fbd548d4b32280676070d518c1f78e6310c9

SHA256
61c9eab1f3c1ac02ad873c54d4a0b5d5e96db05c1a69906d0b5d188a924d96f7

SHA512
7be14e2bdba47c092a74c212929deedf8402962dabae1944171e180547fbef90b9cf433a1b75fa309ce594dcdd884dc84e8d089a429d8c91e1879ae2f538849b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
beee38ec2d1081818d2d2d351eb772de

SHA1
a2d120d6feb3a9a4b33cce50f5a8ca9e25d49677

SHA256
dd80b52e2e0c4515d1e4c6e376cdeea1f02d73be253537c4a24efcd4ee7115f6

SHA512
5ff84b8e2702018ef527ef7a9aafa0d2161d3ae67271ae453b9786c3a607aaf988251fae9456677772d2b40ce1208455422338b16a480dc863eb171ffaf8e17b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
c1c7d21d1e8ba22a562256339587c9c3

SHA1
d67ebea2de6d47dc3d2dbde31c9c5c64c6cffa2d

SHA256
32b94c8724acbc7be7dbbb314af6d0680b86b1240a1ef88286cf80429261c04f

SHA512
d5297e21288d48a587b5a2767d2825b3ee8d563b0f0e7305d5e8f9834bc7bc943866c7040d6200d1099f492429a095278abf906dff827b0d1577cb1b24ee417c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
a13b12be48f5b101f0e690940a663516

SHA1
5d83d79187b1a891d9fb7c3fd07f85103bbb649e

SHA256
14e7e7cf68b58864c7d22c1084bb0710720a3b76fc2bb4b4fd0a6572a352db85

SHA512
62df184fc75caa9558fbc1abf4d0a0491f994c5cc9947c1df01e4057a59d9dc006271ed75c5131a467be978b46bfd54e0205b79f1e1945a64fa8559e0318e646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
759affb1f030b522dfff19c755f4c08a

SHA1
7f4655b89c00d5f64d850a2d2a1ec3009bad3b88

SHA256
c03c9e04d14b5b8e66e0171e4d0581b6e7f58144470df5cee51fa7c647061756

SHA512
033b06b35a44f018f80ce46cc5beeaaef99164503640f585c4ed3a2d1492424422635484f8b6a0d873701010ec84caa0af88dd9aaed183693d53284d224f890e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e0c28ec8282eeb038d62cc9e9a76f5b3

SHA1
8ecce7126e3616c17bf43f3e2d9cbca1538e4fd4

SHA256
33655f03f50402bc428ea1e31c0f0c41b5ae9fa0e0fd3dc2cf34e7483b7d1b74

SHA512
69455261e23db88568fa239c906b008625fdbd4e0e8296839a901a88b460c7550cb9ebd1c4266b26718aac15bb519f42e4327512e5e163d113e29f649ced111e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
2ffaf8b6833609e71590dbbd5025b03a

SHA1
4d861357e847296322e9b5a2597ef5ffd50bcf6b

SHA256
7bf8d38dd0b761b34ff38eaf9f6bfe179c2e99da7528394f4670b31462b5142a

SHA512
e9e7eee43d8eb512b89c68a98e63d5ce5aeed21a917ac8ea1db4aa08740e23efaa1886d1ce0e9c20693868be6206334354e2f248e6654be71631d18410858587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.19.1\typosquatting_list.pb

Filesize
638KB

MD5
ca87451145b7744bee71724af1feca21

SHA1
3d99f1ad97326e49ef04904db63c312bd8c64612

SHA256
d03de614aecf8590e013746de46b715605b72445a14702edbda12b5ce2db3df3

SHA512
ef4a47b30b6b03bc73e4c876111af6d08f741998308bde635427d466d4800f8764ea94462f4bd9f13d21c9eff12cc3c2b8ac13433a8cef3f7aa5bc8395c4285f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
7c05f4adb4fdd6cd035c01296f963d08

SHA1
382492ef21d14f2095f6485ad702deaaf9115b51

SHA256
bdbe4dfb394b729cc1a505b4c3f104dcc701ceab6af7c4f6d0bf373e6b1fc460

SHA512
3c48e979b4f88c85fefaba37e1712a53a15b2186abcb5a1a511fb3b6daf5b47c98307421e9616d5d42b55519b879f82dbe478c2832180a3c1c668dc5db2524f0

Download Submit