Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
fcfc0891e383dd78bea0b738b2771643
-
SHA1
2d6e58beac2275d8f23d5cdcec08af3b82123376
-
SHA256
c6af10736db72c425555f5e62b2b954fceb9d541aa8dd593bb0f1ca91c9a9b52
-
SHA512
6c617c3c519580ca79841139ba85864d0a8339251cf8b75654effc71dbbc2ac42be76df8fe809ff8f52a65254495b6a69f157b7a5029192c53d034973e89dbcc
-
SSDEEP
49152:ch+ZkldoPKi2a9D5SOgTjjhKQVHoF/uY:N2cPKi15SThPVIF
Malware Config
Extracted
njrat
0.7d
soft
googlyoutuob.ddns.net:1177
5e9d00b3a9bfb0f9311b1d29c32b918a
-
reg_key
5e9d00b3a9bfb0f9311b1d29c32b918a
-
splitter
|'|'|
Signatures
-
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1052-0-0x0000000000DF0000-0x0000000000ED1000-memory.dmp autoit_exe behavioral2/memory/1052-1-0x0000000000DF0000-0x0000000000ED1000-memory.dmp autoit_exe behavioral2/memory/1052-2-0x0000000000DF0000-0x0000000000ED1000-memory.dmp autoit_exe behavioral2/memory/1052-3-0x0000000000DF0000-0x0000000000ED1000-memory.dmp autoit_exe behavioral2/memory/1052-5-0x0000000000DF0000-0x0000000000ED1000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exefcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exedescription pid process target process PID 1704 set thread context of 1052 1704 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1052 set thread context of 3964 1052 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe 3668 msedge.exe 3668 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exefcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exefcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exemsedge.exedescription pid process target process PID 1704 wrote to memory of 1052 1704 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1704 wrote to memory of 1052 1704 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1704 wrote to memory of 1052 1704 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1704 wrote to memory of 1052 1704 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1704 wrote to memory of 1052 1704 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1052 wrote to memory of 3964 1052 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1052 wrote to memory of 3964 1052 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1052 wrote to memory of 3964 1052 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1052 wrote to memory of 3964 1052 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 1052 wrote to memory of 3964 1052 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe PID 3964 wrote to memory of 3668 3964 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe msedge.exe PID 3964 wrote to memory of 3668 3964 fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe msedge.exe PID 3668 wrote to memory of 2244 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 2244 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3168 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3468 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 3468 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 724 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 724 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 724 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 724 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 724 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 724 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 724 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 724 3668 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8fc646f8,0x7ffe8fc64708,0x7ffe8fc647185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8260334517305407486,432391372104103219,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4204 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8fc646f8,0x7ffe8fc64708,0x7ffe8fc647185⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b533661b945a612876de1e58ce73d065
SHA1d93286945efeb7f33b49f8e594cdb264884c827e
SHA256e5480b47432d7b0ca972afe477fac49f5fc1e8e82aaeab6401de99045949bd65
SHA512672bc0f694e763a8597eebcce7728716a09515ad17854fae58d1f8df8aefca152eaabfd637bbaf8acae8e7936309809525a9f058a990148964a58c831d96dc4a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58f38951143ede15b2f00d3352e458d47
SHA11130065985230474657d5f744e99312f22c69485
SHA2563a559763ad1634ef40108700025a909cc76ca8c66d6c77f41a07e2ced4c9ff65
SHA5125376e21235d1b828a0d04e35d26154a1e52db3fe02690fa272ba982da55b88bb0ab7473e6b2031fe8d19798abefec072e22542132b175912b31279cda6f15f57
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
264B
MD50fbe1fbfa80fb3aa3fe7f79f1794a05e
SHA144cc7d3e8c679c14e3a8240695dc4af48662033d
SHA256634498d0f2dbac7e0763c79c2716f125d72324f6b0b7c447dad20b208d07e24e
SHA512af981285750243e8b7a3625937daf65d11d9df3a10a061405ec791dee2626bd6355c0c11a02ed3a4fac7c220a40b120aceae689f485d23724bbe853a9822159f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
437B
MD505592d6b429a6209d372dba7629ce97c
SHA1b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA2563aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5985563a0e8bc8dc5cc415f53e53d3b26
SHA1139b8e0a403ee8079a75f3c87ae9743b6f95d951
SHA25655fea22feb323e4f71de3798e539840b5d9f80d92bf80b4fd2caf58fa2003c1c
SHA512292addc9c22d2b512b90be3f2e69258bc497b1b3335e353a27fb63a8371d303203070562ad58112b0892f9312a714835b7b21518a00ae3602c05530d6c902877
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5cd2ff36ce68c5c85a0be6638907fba60
SHA1e4fd23c01269c3130b5a5cee3e999586f05ea307
SHA2560d256fa6aae2e37ebf61c2eac1d7c03145d2552b25386999201899374ddbd4f5
SHA512e4f29434deb58dca467efdc022befb22d366c6980cf80d3de95a90052a52d317025885ad128fe42782e018e4a173e39e09927311928aa67d54207e9b3bd9ee2a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5291344878b18d0ba07dd25bee8bdeb03
SHA1181ca9935808a107a86f2d815e71fca7a0225eeb
SHA256cdc890e00d9fe9f2dbedc05800b5dcfe6499f3cfc888e149c1e104acf4b1f94f
SHA512d33a866bc2ca2108cae07963788f0094820ed90346821847f7650aef3c21c6e803c0875997cec33c4e7afaba76233435a61d566ea345936f39907f9cced060d3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5eba8517f3652641367e901d3a54f7581
SHA1fea9f4fd8d38fa53f21cebbc148d48fb07fe13c6
SHA2562d7c268095e786a3e6c729a4503a10709df851a8899197637e6d42aa11fce388
SHA512da857ea24ab0a1f4e1eae0a23c1b50e86c5e4c5781f9cff94eaa20127671ed5b1ed681c9b626366f155ec89e767ca11554a77f0f4c3a42c44cf821654b483517
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
371B
MD5cb437a9c2e3c9f9be8071567ed08a15a
SHA15e9fe601d601775d835064a73a3be298279db208
SHA25676e424c003aff8545e536a3d476e4dbf2d368d2d5325710384b89958c59f4b36
SHA512147b5dc81ccaadfe7567dc364129d0e58fe9cf56bfc779657bb52f1277c10c52da74fc9ef40e8ea37855f9eabf64fd15bbed0479bc56bce610f50cbc747d7d45
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c6b6.TMPFilesize
371B
MD5149beca3ccd7a80734cac6f8baef8227
SHA1665b98ac6dbb65e0be5a801c55343808f75ef0ca
SHA256cad0a1ca9e1c198175794a820967145b32dc223f0f824bbf899e758d13fd6ee4
SHA51248319695dd3d8ad5a22d92f075529df2063bd257d91cf0cf91bd8815afe028d0fd59a752aa2aa1479f5352d912ead91ca49dc580628cafff0ebe32a0cc984f7e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD54cf9a485f82b72cf65e80e040527468e
SHA1067a7d2acc14f62e9ce5e1f43c537b64265d67ba
SHA256ec3d10e3cbd1d7ebf9eb12b2a75c55495487028cf9cac60ef8e4436088e08f6d
SHA5120e9307da41fe6bdd282d321060843a58bd2e3e7b00d6de1ce0ce1e79b57f54699b243152dd4c6a3164d4011e8acbd15721cf435877b0ff20a79cc34e4dc61471
-
\??\pipe\LOCAL\crashpad_3668_YSLCQBIIJSOYMLXYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1052-0-0x0000000000DF0000-0x0000000000ED1000-memory.dmpFilesize
900KB
-
memory/1052-5-0x0000000000DF0000-0x0000000000ED1000-memory.dmpFilesize
900KB
-
memory/1052-3-0x0000000000DF0000-0x0000000000ED1000-memory.dmpFilesize
900KB
-
memory/1052-2-0x0000000000DF0000-0x0000000000ED1000-memory.dmpFilesize
900KB
-
memory/1052-1-0x0000000000DF0000-0x0000000000ED1000-memory.dmpFilesize
900KB
-
memory/3964-4-0x00000000009E0000-0x00000000009EC000-memory.dmpFilesize
48KB