d6d212bda352cb32391f575410a6b1d1f853542bfa934486e0eaf226d8daf9a0

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d6d212bda352cb32391f575410a6b1d1f853542bfa934486e0eaf226d8daf9a0.html
Size 7KB
Sample260913-b9ws1azcmd
SHA256 d6d212bda352cb32391f575410a6b1d1f853542bfa934486e0eaf226d8daf9a0
MD5 72cb2a84f5ec992c39489f69b1959448
SHA1 ae264184b5197fb3a77fd691517f0fc22b582d54
SHA512 eba441a12624e7de189731946d95c4e4be02cd8a74a7e846b11f2d7f96e7f7222100acad15f26d92e65ae4254b47e2c783560766047e79109b795b6652895a5c
SSDEEP 192:MDioRkVIGQr8MD4R434L+4jDH0+I7dRkQfshqcpllLE4RbiEzCNMg:MDioRkVpMD4R434L+4jDHGEdllA4VCN/
TLSH
T18FF1D8C36879E0B51FA0DDCFF424FA08F64BA856D984FCD0E4E85A552748FE2A445FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338212522256488"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{1276B1C3-C286-4244-BA32-ACCA330A6C2A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 2436	5420	msedge.exe	89
PID 5420 wrote to memory of 1804	5420	msedge.exe	91
PID 5420 wrote to memory of 5612	5420	msedge.exe	92
PID 5420 wrote to memory of 5612	5420	msedge.exe	92
PID 5420 wrote to memory of 5612	5420	msedge.exe	92
PID 5420 wrote to memory of 5812	5420	msedge.exe	93
PID 5420 wrote to memory of 5812	5420	msedge.exe	93
PID 5420 wrote to memory of 5548	5420	msedge.exe	94
PID 5420 wrote to memory of 5548	5420	msedge.exe	94
PID 5420 wrote to memory of 5548	5420	msedge.exe	94
PID 5420 wrote to memory of 3356	5420	msedge.exe	95
PID 5420 wrote to memory of 3356	5420	msedge.exe	95
PID 5420 wrote to memory of 3356	5420	msedge.exe	95
PID 5420 wrote to memory of 5716	5420	msedge.exe	97
PID 5420 wrote to memory of 5716	5420	msedge.exe	97
PID 5420 wrote to memory of 5716	5420	msedge.exe	97
PID 5420 wrote to memory of 5064	5420	msedge.exe	98
PID 5420 wrote to memory of 5064	5420	msedge.exe	98
PID 5420 wrote to memory of 5064	5420	msedge.exe	98
PID 5420 wrote to memory of 368	5420	msedge.exe	99
PID 5420 wrote to memory of 368	5420	msedge.exe	99
PID 5420 wrote to memory of 368	5420	msedge.exe	99
PID 5420 wrote to memory of 2976	5420	msedge.exe	100
PID 5420 wrote to memory of 1692	5420	msedge.exe	101
PID 5420 wrote to memory of 2976	5420	msedge.exe	100
PID 5420 wrote to memory of 1692	5420	msedge.exe	101
PID 5420 wrote to memory of 3160	5420	msedge.exe	103
PID 5420 wrote to memory of 3852	5420	msedge.exe	109
PID 5420 wrote to memory of 2208	5420	msedge.exe	110
PID 5420 wrote to memory of 2024	5420	msedge.exe	111
PID 5420 wrote to memory of 3476	5420	msedge.exe	113
PID 5420 wrote to memory of 3476	5420	msedge.exe	113
PID 5420 wrote to memory of 3476	5420	msedge.exe	113
PID 5420 wrote to memory of 4388	5420	msedge.exe	115
PID 5420 wrote to memory of 4388	5420	msedge.exe	115
PID 5420 wrote to memory of 1184	5420	msedge.exe	116
PID 5420 wrote to memory of 1184	5420	msedge.exe	116
PID 5420 wrote to memory of 1184	5420	msedge.exe	116
PID 5420 wrote to memory of 4476	5420	msedge.exe	117
PID 5420 wrote to memory of 4476	5420	msedge.exe	117
PID 5420 wrote to memory of 4476	5420	msedge.exe	117
PID 5420 wrote to memory of 1112	5420	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d6d212bda352cb32391f575410a6b1d1f853542bfa934486e0eaf226d8daf9a0.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffe55d3c188,0x7ffe55d3c194,0x7ffe55d3c1a0
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,15588895410854237652,10747907081629333845,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,4848569951682200473,4272945094136893842,262144 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,5304977175308963453,10447635590667498872,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,16709176708446645932,12324237140698631712,2097152 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3324,i,9774278650909935530,14171845982070651882,2097152 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5008,i,4430355029876760227,17762675051122844340,2097152 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4856,i,16069284223234612891,7259501584489551388,2097152 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3716,i,6749178851268565306,12054588006029283834,2097152 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,14047394340613712481,4247123189249002778,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,1117793429613985547,7085429623564310886,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,11909485015243635652,8696084448677730234,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,11909485015243635652,8696084448677730234,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,16500504465754646082,8305544767183528415,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,15547218091748453716,8271468723818395553,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,16047199837946879803,8323393738913212068,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3608,i,17947392638997618684,2714986742106395048,2097152 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,18181452248426010512,18284818980843951675,524288 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3464,i,13857894969151179369,3149244442177880724,2097152 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=1856,i,13224239049185335774,10689990271095129018,2097152 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3724,i,7582720248293366463,3431194866280045197,262144 --field-trial-handle=2324,i,5080493347828410202,7146792160707096549,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

08a1c0bb-fc66-4275-86f7-797f423a34a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08a1c0bb-fc66-4275-86f7-797f423a34a8.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c4e4e1b5035641d55c6a7d2c4822bafae4c7de167fccbcef9f631f576471cf64
MD5 bca2ff3e92a7a3efd0b8349a50bd6a84
SHA1 b2fb424c1ed36598c197cf74f31f7a0c813068b6
SHA512 7eb43e2e29ea4eaec9f28b6054bbb7ee2cfcf196142085adb813b5d1893506b2daf68b65c8c9d06f684116348d7f432ec35622aba7a09ccb684784de6f752ea7
TLSH
T1D24180F3C3E8866EC90156F0AB28AE1BCE1D0955432C3D5AC9E4AF1B97E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0cebc8c226e9e71e3f6366156fec0fa89b07b3d1149a14ce1fde3eb5873ed40f
MD5 6cd3ca8c6a6208b4ceeefdf903db9410
SHA1 96415bbe7253bc23febd354d9be2e836f723dd74
SHA512 1d226700924a20ce03a2d5c1faef592bf384af0b0e46310e21575de16be6b95a6290670b438523318806bf5ecd408aff5f835748d16ac10c61cc9ce24536d887
SSDEEP 192:sxZxRXki/fCsnaQZLl8rzodpH8xHW6+WNGYoW2SC2IgjtUAJ:sxZxOi/fCsaOewqHbGJS/jtZ
TLSH
T1EF32C6556E28A93B8CC7E219FB157F53E3FD103290911E48AAFC8A2C15E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9e3cb23c5c23900b7cd4404c28fee647a68a4b390352f375188e917d0dc421f9
MD5 4fdbe9e131f83c79faf8b8fbcca0cb37
SHA1 57681272fc7eb868cf38533bbe8aaae55ad35da7
SHA512 1ae99c93f6955d4fdb888a1924e59c4fd342674dab92573d085404f2375b8cbacfada2d5bc3360fdfaf1ff321c15f9c2a0824e4f319525a9bdc6a435960a6812
SSDEEP 192:sxZxRXki/fCs1QZLl8rzodpH8V2HW6+WNGYo32SCYIg5VtUAJ:sxZxOi/fCs1Oew1HbGQSvPtZ
TLSH
T1BE42C7556D28A93B8CCBD619FB557F53E6FD103290910E48ABFC8A2C15E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 596463ecd2aee8d96c23540ad1e648343749dc9ded359e8afdee5419f79f63d4
MD5 d109d62fab6b9789031b06f7eeb442c5
SHA1 bc320944de294e7809faf58cf9f825e9882b8f24
SHA512 20b77b39c6cb6cfc589a39f9c5f8b5205fb4f0b2ebf9b92a6fffd2cea42992d2588aa0884c14ecd295a29a64dc8bc4425ae0700a773dd395f99a6a3c595a6966
SSDEEP 192:sxZxRXki/fCsZaQZLl8rzodpH8V2HW6+WNGYoW2SCYIg5VtUAJ:sxZxOi/fCsMOew1HbGJSvPtZ
TLSH
T1B942C6556E28A97B8CCBD619FB557F53E6FD103290910E48ABFC8A2C15E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 42163919be052d6a611d307096bc19094e0b7a77d0180f7fa8df44b93c9a9fc0
MD5 0e57f3ae71c740d5ce29601be60c57ee
SHA1 2f4ee65e55722051e64a9594e5b010c123b38930
SHA512 0f47ca870a9bc3080124b9dff3dbdf410361293b75596e7def7e10dca7c88b96d46b5d8d705add60b90e4d01e694eb84e89ba998ecb9d3eb9ecc13bba3271616
SSDEEP 768:SL29ObJffppdNlrtONqq7+agMIdMZWC2Beot6a5g6hCS:SL29ObJffppdNlrtONqq7+agMIdMZWCm
TLSH
T153C2445571BB421038FE295C82B6972E164271733118EA6B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ce7404a42c3cba65227aea387ce85a3ef3380b90d5304185b3b68ed7d2d631bf
MD5 e9bec14f7bfd435ff45721b54df8e413
SHA1 4c6542177f831a0c21f030361f6355d8d85717c4
SHA512 67fe820629f841332ef14fca3713c0506f47df85375ecc0799eb2b40b6d9a0f35ae8e7b93409aa04572974596729b4b511b6a3652c892f729b49384ac853544c
SSDEEP 384:nJiFiZcIWsNp8TUNTUlI4oaKM/lUwzfvBCT40HnzuiE7O6R2FeoAh7UvgL/7IzV6:gFQWgwgwTDBCbKiE7TRPk6
TLSH
T1AEC24A72E8A4D9BBECEA8BD5B74A3603DEF44253898C9AD4D6DD1D1C00979ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cfd03f738530d7b7ad0af23a3c3d79d1caa78161553dc7d7706dfa4fac78f7f1
MD5 95f27f618c9e43720c3f22190c594c98
SHA1 f669f6b4e9adce50937b9d152aac241cd2851393
SHA512 e9f96c1c7f82dc9734f29f2c05bbb71726f8b0a77e8523f7b6b5cabfe533cf557661fdacde5799e69e15eafb13e6612986b42f8ba7424b244a01a62c4e9aa89c
SSDEEP 384:nCiFiZcI63sNp8TUNTUlI44aKMRlUwzfvBCT40HnzuiEsa+VY1wgL/7IzFof:JFQ63gwgStDBCbKiEhgZY
TLSH
T180C24A72E894D9BBECE68BD5B74A3643DEF4426385CCAAD4CADD1D1C009759D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c8555028378c453dc21f023ba36a5aa044b986b7ac881f956331f872765518a5
MD5 74a132f3606417dd84cda583036fc7ed
SHA1 0b7e541e7554cc05da481389ae11ef200a35792b
SHA512 d6dd41d2a6e810d5c9024b940cf4280f961aabdb23f4c4b79da6109d238e58e9106690123faaed010e1faa8cc577eb99ed5e90506d4d8a74c864aca6734d3cb6
SSDEEP 384:nwiFiZcI63sNg8TUNTUlImxaKMih4wzfvBCT40HnuF3sa+VY1wgL/7Izaof:LFQ635wgb6PBCbOF3hguY
TLSH
T183C24A36EC94DABBE8FA8FD5A74A7603DEF4026395DC9AC4CAD91D1D009359D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a24b2c0c57b19ee8fdb7f464ef0f3583de93368e31d0331986a910830e0e4116
MD5 2c1ad01a160ae91e2540698b26d7761d
SHA1 fc7329004b45b73a8088ff2f12948cdc77286a25
SHA512 84d8128825dc7632877cdd6497e9f6945b33c089c93243c28d531cc2c0b1d2984fc193c0046e86cc10cf54620a05d9bf502b091d3b086d5a4700d4c7383c6331
SSDEEP 384:nqiFiZcI1wsNp8TUNTUlI4oaKM/lUwzfvBCT40Hnz/mE7O6R2FeoAh7UvgL/7IzI:hFQCgwgwTDBCbLmE7TRPk6
TLSH
T198C24A72E8A4D9BBECEA8BD5B74A3603DEF442538A8D9AC4D6DD1D1C00979DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2f1c51abb20e850b719c2a5c637b55d20e0d96effbcad9816362851992bd4bea
MD5 ba4cd81a5929a5c3c64e30bb32df7a93
SHA1 8cc2772dd859ea02095eaf5f6a4df9c0fe5ac624
SHA512 c93f0e5b182ca1ad06c9165b7a7e08a37ecd6e2c333ed490cff06a48853db34745620485a199306feae1dd44c44ece9a90c115f2aa77f5f3a1396a7dabac1f6e
TLSH
T14041185CA6F90148B377AF16AFF6A96D487A7D732E06D49D00410E4E4622A00D872737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3160-213-0x0000026C558E0000-0x0000026C568E0000-memory.dmp

Download