177b92b70ab6fa95f88ff233424479001d1321a51acfaeba747d2583a009299d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_177b92b70ab6fa95f88ff233424479001d1321a51acfaeba747d2583a009299d.html
Size 64KB
Sample260913-g6rmrssgle
SHA256 177b92b70ab6fa95f88ff233424479001d1321a51acfaeba747d2583a009299d
MD5 d8d1aba3c1c20ba374a9a26349217504
SHA1 a2903695e77be0c3d5f5436301bcb67f65c5bd4c
SHA512 a5fd0e52e9381a2159b6f4ab387f713ec2e9269d337e2b2df9a52390363c6b161bdff3c3d057d16ef88eb80cf229407208afcab21806e32e2b4121d0030f626b
SSDEEP 768:1sKQPzKNFP7URNv+f5AfpUxnHeob4f1u0eJwO0H+UJFdIaPAM0jShKyKeKwK0/K1:Xze6n+2uATPF9yFq
TLSH
T18B53E97365A23E0D92334C1CB8C5BAC87718C453C40759EDD9BAA62DC3CBDC69172B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1992	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337543262567713"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{1B13DCA5-5232-48E2-BCB5-712B179E3D3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2212	404	msedge.exe	90
PID 404 wrote to memory of 1992	404	msedge.exe	91
PID 404 wrote to memory of 2284	404	msedge.exe	93
PID 404 wrote to memory of 2284	404	msedge.exe	93
PID 404 wrote to memory of 2748	404	msedge.exe	92
PID 404 wrote to memory of 2748	404	msedge.exe	92
PID 404 wrote to memory of 2748	404	msedge.exe	92
PID 404 wrote to memory of 916	404	msedge.exe	95
PID 404 wrote to memory of 916	404	msedge.exe	95
PID 404 wrote to memory of 916	404	msedge.exe	95
PID 404 wrote to memory of 1580	404	msedge.exe	96
PID 404 wrote to memory of 1580	404	msedge.exe	96
PID 404 wrote to memory of 1580	404	msedge.exe	96
PID 404 wrote to memory of 2944	404	msedge.exe	98
PID 404 wrote to memory of 2944	404	msedge.exe	98
PID 404 wrote to memory of 2944	404	msedge.exe	98
PID 404 wrote to memory of 5892	404	msedge.exe	97
PID 404 wrote to memory of 5892	404	msedge.exe	97
PID 404 wrote to memory of 5892	404	msedge.exe	97
PID 404 wrote to memory of 5856	404	msedge.exe	99
PID 404 wrote to memory of 5856	404	msedge.exe	99
PID 404 wrote to memory of 5856	404	msedge.exe	99
PID 404 wrote to memory of 3604	404	msedge.exe	100
PID 404 wrote to memory of 3604	404	msedge.exe	100
PID 404 wrote to memory of 3604	404	msedge.exe	100
PID 404 wrote to memory of 3416	404	msedge.exe	102
PID 404 wrote to memory of 3416	404	msedge.exe	102
PID 404 wrote to memory of 3416	404	msedge.exe	102
PID 404 wrote to memory of 3468	404	msedge.exe	104
PID 404 wrote to memory of 5844	404	msedge.exe	105
PID 404 wrote to memory of 5844	404	msedge.exe	105
PID 404 wrote to memory of 1352	404	msedge.exe	106
PID 404 wrote to memory of 1352	404	msedge.exe	106
PID 404 wrote to memory of 4524	404	msedge.exe	109
PID 404 wrote to memory of 4524	404	msedge.exe	109
PID 404 wrote to memory of 4524	404	msedge.exe	109
PID 404 wrote to memory of 5732	404	msedge.exe	111
PID 404 wrote to memory of 724	404	msedge.exe	112
PID 404 wrote to memory of 4872	404	msedge.exe	113
PID 404 wrote to memory of 3316	404	msedge.exe	114
PID 404 wrote to memory of 3316	404	msedge.exe	114
PID 404 wrote to memory of 1152	404	msedge.exe	115
PID 404 wrote to memory of 1152	404	msedge.exe	115
PID 404 wrote to memory of 1152	404	msedge.exe	115
PID 404 wrote to memory of 1816	404	msedge.exe	116
PID 404 wrote to memory of 1816	404	msedge.exe	116
PID 404 wrote to memory of 1420	404	msedge.exe	118
PID 404 wrote to memory of 1420	404	msedge.exe	118
PID 404 wrote to memory of 1420	404	msedge.exe	118
PID 404 wrote to memory of 3468	404	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_177b92b70ab6fa95f88ff233424479001d1321a51acfaeba747d2583a009299d.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x240,0x288,0x7ff8216ec188,0x7ff8216ec194,0x7ff8216ec1a0
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,8772480111372188754,7446381851192940825,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,3744597616436335162,8187202702998171335,262144 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,4442685299007496016,17687418195121547889,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,8060550170406265569,1130762095561965375,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,15035307900255531168,955891801436056475,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,1458557988799084031,15212316170741094978,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,722788074841467203,586129299109488736,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3672,i,1248230931301136616,5581148745867857412,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3936,i,20109394156071218,5123226316389585317,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5220,i,2193912787615466706,14302571277955877906,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,4451772229140432341,8389693051366622538,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,4451772229140432341,8389693051366622538,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,16059643274014854890,5595111876640779271,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,6022149109523730682,16893529212101371213,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6556,i,14052960045772521358,5623520415180124948,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,2542272389623288835,15395794299475631489,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,16099171889063117940,11620310900319369132,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,4886714749872005173,14457424404083708956,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,10942022227965899423,14440138890074749087,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6100,i,15660688705220248594,4172905974326220103,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,4268576756831171854,6730543988493615991,524288 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6540,i,6606463887535835622,1514912998836280569,2097152 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6104,i,14813838089537889214,11787388766776759716,262144 --field-trial-handle=2476,i,2263673586110150326,11088805580203816282,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 269180d792c9d50248b9a82744cd25e105d4337cffd9670382b4e3c886bd6b38
MD5 e63d848ae75d56bd6bd23af000a05eb6
SHA1 0ef2bedc6b09abaab6181e3a1438a1fd56376c91
SHA512 4a5d72491366ee55d5490281ca9d2532aefacfeb65b441cc80f51537524d907f57e5e5a56877c4624c56fbeacc54a7dc31b062324676150ddb8825abd9cc0a91
TLSH
T18F514060A194C072FF9E04B8D8DF5E823970EE8FDC832F515698C57958C6267CB8C359
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b481.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b481.TMP
Size 3KB
SHA256 875c58ed18a47e64ad18b9aa5ffc2d3566c61fa41b23b9f251a1ac7954a4a5e6
MD5 79d99baa18eb76166a1e8d1a2043a07c
SHA1 ae6bd7b2e9257fe72ae3afb2863c99345fb6e57e
SHA512 236c762d721fd52cb7db1b3b1ff08a474a5db85388bfcfeb520cf3e3f07cb4506fde0b484f1361f2336e8fbd551062d13f892bc1a0977d7b50549b8cf58c8111
TLSH
T16B515260A194C072FF9E04B8D8DF5E823970EE8FDC832F515698C53958C6267CB8C359
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2479f45add0454bfa2fe06715e90fd0625c1ceab6fdf9a4c48c915a49f514431
MD5 7f88668f765397a30ba9af47784db3db
SHA1 c00dc5b91f454726eff3c0a4277668732c73b99d
SHA512 15cd19f9b7e10874fdff682cded7116dac94fc8a233025bf07658238219d89fea876ca57379a81255584a9067b87a2d7ea0c2756f665e99a4fd589567a4237e7
TLSH
T1BE519CF7C3E8867D891156F4AB146E1BCE1D0916432C3C56C9E4AE2BA3F24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 548cfeb8b22c677b62649dd2baaaf0244abcd002d441041fa5adb8f80739b55a
MD5 6448b9f0ef2a0086cca20b78633a948c
SHA1 d8fe2440645d30c5ffbff4406dc7a8eaea5cafdc
SHA512 d498cd843ce3eac47dab5d7fc38e3c2b9ffd9732b963e2849eaeb1173884bfb524ae6f5479fa652eae54276d2a1e483d0bf4906cdcde467897c7eee49512e9f3
SSDEEP 192:sxRdRLbn/f4s6MZbmzoA8p40B/g6+WNIYU2R3RNG5IgIJ:sxRdhn/f4sRZbbt/5Ihs
TLSH
T1323296156E68A93B8CCBD21EBB65BF53D2F91132A0D51E48F6FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 383823195e9238489219d7dfc41e63939b4b69f9542856b385194e513b129050
MD5 a055e0e42c8706c85e35c2117bb46f59
SHA1 db640fa5ea7e3002e8f3f7d35fcc8b25104dca41
SHA512 3abb1afc04aa35c296c072084c4668856e0ea2cdb74f690ce3946bec05d72c3f22277ae6a38466e585605f9af03c58a3878cae5f84ea1338bfe0c98b1219daa1
SSDEEP 192:sxRqRLbn/f4sxMDbmzoA8p40B/g6+WNIYU2RVRNG5IgDvJ:sxRqhn/f4sqDbbt/5ItN
TLSH
T15632C715AE68A93B9CCBD21EFB557F53E2F91032A0D51E48B6FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ec7fcb2c6926941e8c109a008dd965050414d197b2e68c2a531bc4f976313a12
MD5 3c8e8960af2586d390a1b02069dae3d9
SHA1 765d4605253c680a302e0d404ea75f77d4ac9c52
SHA512 167cf628be4c155a2fb77a058d81d43dc5243cf719dde9a6e4eea834bb2db9620a2377f75f314b6d5ecc7f388b7b3c9b431033b3bd878341ce3e865ba38f2bbb
SSDEEP 192:sxRqRLbn/f4sxMZbmzoA8p40B/g6+WNIYU2R3RNG5IgDJJ:sxRqhn/f4sqZbbt/5Ihf
TLSH
T12632A615AE68A93B8CCBD21EFB55BF53D2F91132A0D51E48A6FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b82e96939a7e434aaf01c94b9b9fdffc22949ef589dd3c3c253ff176cfbf3915
MD5 f4332419fa8bb90384a57e6980996972
SHA1 766de5248d60f71c0a3e47c8087826046df13cda
SHA512 8e34b8027b3ba6cfd1d0f4b02808d98912c7a85b074636f956772967d9d50599db229bc201b35a995727b566af5328dffe55b136abe4abc7e1df8e264b5eda85
SSDEEP 384:64qajXwfCtgmcFfsO7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRutroM:6JajXKWgm0fsO7n8F1+UoAYDCx9Tuqh0
TLSH
T104B2CA3F640DCB7F5FD00AAD9C19AE976D9802CB96588D4047FE984C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 cfd76091108585db86bf246693276ef4b757a0c40f89c4bba3a9f4544e152165
MD5 cca6da116382792a992971f6154a0598
SHA1 6500cc7cd2e041380fe103780ad6878ec39d46cf
SHA512 c56c5373a6145c518eb0e9fb53770c4a676e58c6d8e55c968554faed6f82fbb9cba980e124b59864b044584884fea5604f346bc5e9d372fcc6ecdf6a90ca2d0e
SSDEEP 768:9G3pjwzTUK/lGE57Y0GZxJsXBdK8ZWcTRvi:9G3dwt70/JsXf7scTRvi
TLSH
T106F2BF30A8E09E775DBBC2957A063643AEF446F3C6C94E54D9EDAB0D058B5AE0303C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d5e90d642beca80916a70d0071847897ecbfc8bddd3b1674c24dff3b31591809
MD5 08f836303044b83535555a9d42ba337f
SHA1 bbe48aaf0fbd68cfe08afea05b894b73b001efb0
SHA512 5523a8bd4c7f6924867b83e4cdc13c1cbb3600ac7b6f9160e663c5b4a523d43719d70847b741bcfe46d45320f739733091ee0cb5ffdbbcd7710b7f8ed5f2139a
SSDEEP 768:qd3MjwzTUK/ltE57Y0GZxJsXBdK8ZWcTRvi:qd3+wE70/JsXf7scTRvi
TLSH
T174F2BF30A8E09E775DBBD3957A063643AEF446F382C94E54D9EDBB0D058B5AE1303C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0616bb3e9b36a17eb677d39f84c5ab420456c2e39967c024ff0711a7c87e0a88
MD5 9ecebf9c1c6aa091384ba2501f7a476a
SHA1 b01e42603016424ca4a57947ee9f96541d986110
SHA512 904cfbfbf2565f7eeca6fc4c20d3155e28f0a9571981db63e2e4604ef532ee764dde2a8f65eae0d7658b48ddc319b6fd328e909273354e5b19f369a9365a9080
SSDEEP 768:R/UxvxjgC+H3Kjw7TUK/lGE57Y0GZxJsXBdK8ZWcTRnB:kZj3+H3EwF70/JsXf7scTRnB
TLSH
T17713C030A8E49D275DBBD295360A3397EEF44AF381C54D6499EDAF0D05CB5AD1303C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 1b62aec9086c3e8ec94fbfeef8312c88fd96a5a3e8bddfed378e7d60c2677fec
MD5 2149147dfbdee13793d60e7ab3df80d6
SHA1 10bf81c35979f603a78f83e593efc209b6a77644
SHA512 d25eaccdb437cba0472030ed7a99889843ff701fa61eec426358b28fa098ddfad161ed23edd75ce22248e179f313cd9a0e97abb5e6f4b84971734eb03727f083
SSDEEP 768:A/UxvxjgC+I3umK/VE57Y0GZxJsXBdK8liSHUPpMs:tZj3+I3L70/JsXf7oSfs
TLSH
T19E03C034E8919D735DFB9394360A7397EEF446B3C5C54EA48AED6B0D028B26D030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd2534d1-59a9-48cc-9de8-829914b6c134.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fd2534d1-59a9-48cc-9de8-829914b6c134.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download