e20fde82672c4061013ad517559586485e523b279d52cd8fe14b423e2a446347

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd93215273eef04ca81c585094fc368d_JaffaCakes118.html
Size

241KB
MD5

fd93215273eef04ca81c585094fc368d
SHA1

90a5d87c295d82f5aba9349298f6e5654c9e0e31
SHA256

e20fde82672c4061013ad517559586485e523b279d52cd8fe14b423e2a446347
SHA512

6b8da4ab44b8597c4190d9e0cf320a0efcfb8070f76da5df3b491511c876938c2834633bc9fd102b1b12edbfe223ef8636372acd94f76a0cc1d26d9a04389e7e
SSDEEP

3072:14N0gOS+COr6eFodNhMFK+rjXIPzpjmaLH9ZCroYna3vZSP5ZbI0ty/derD8f9uD:14igDUr63+/MEax9YDPngfNwZ8U

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
156	sites.google.com
148	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
3688	msedge.exe
3688	msedge.exe
5788	identity_helper.exe
5788	identity_helper.exe
5744	msedge.exe
5744	msedge.exe
5744	msedge.exe
5744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3204	3688	msedge.exe	84
PID 3688 wrote to memory of 3204	3688	msedge.exe	84
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 736	3688	msedge.exe	85
PID 3688 wrote to memory of 1496	3688	msedge.exe	86
PID 3688 wrote to memory of 1496	3688	msedge.exe	86
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87
PID 3688 wrote to memory of 3216	3688	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd93215273eef04ca81c585094fc368d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff956e046f8,0x7ff956e04708,0x7ff956e04718
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7964 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7622214803207483099,846224373025764516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
64836d9ed0fa36504e81806dfddba79d

SHA1
ce09ebf37aebaf90664fcf7f20d9361c7473a372

SHA256
ca4ff89e62d8fa19b959aee20a3eb90a032317329e392dc4e455dc7720651cb3

SHA512
99debdc52571e358b1da6c4086d085f818d5a27b8cddecf68aeff0aa4600d9952277d4578c5d411d4cc4024c54704f5f4583d2b8d2146aef00c031b1ebad412e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f89eacc173016441580a1298f148d46e

SHA1
7e27c79728f54be41984235f7bfdd8a0bdcd3a54

SHA256
68bc2993e25bb9f44bdd514acb1ad122806ffba33f21730a201ccc347f496625

SHA512
8c966c08f3decb560b58816dcc8115f927eb58b96e3acfc2b7cc512654479fda45a3de77f9d4639713c8bbce65f202696613bdc66bb33444e9b5451f6cd7481b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
7256aea9aaf8f004d2065ec458a0d3d8

SHA1
34c0240de594bd0f696be791a1d9510c17806052

SHA256
9afbf9d1851acc82c1ef2ac5a27fd55051d34939648af6273b38920f82630464

SHA512
5a320022380c9bc026a3d94ecbf0830c1e9abcdcdd232dc347aa5c82865e94044b315f1ce4cba87f6e8af2250ab2e356dcb8e8e52d11de76e3ff55956cce0f09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d1db14b73fcc9220e19e34ddb69cc334

SHA1
75fd573d3643ef03c803c890723a3d6a0404ded7

SHA256
3e51509624ec4690be81e3b63ca3b0af818e02d1cc1122cf9c738280b4182b6f

SHA512
c264323d16e20c24c7fc3b8e7d27f926824c0e09c51af19b067e8a0dcfa407294cd43016ea51ee1e5df72447294b1e59a626441cb6f342ba5cf2147d8adb262f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09b65e9d69d807d25aab0a3768038ad4

SHA1
558f850044d32a5b9a0c4048c6c3cff5aaaaa4d5

SHA256
c8557de67459fbb5ef252f6ed4541616f2a56ed92ce1ce463ce0891df13f6a47

SHA512
1d5d317973d355542f1076087dd3cc189997505c0d0e69e9f82d8fdf0bf578b69cbb8eeec8827a34e0b10d1d081107c96c3e875503cd3ca301d140e276884968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3fd8073d33f3b92bcbafa62e07093f23

SHA1
23c4993cf8d681d000264e842ba023cb43681015

SHA256
15e7d448c848e89ced91072000d5a1e17f3025852bfa1f11bc8714fdd1c87137

SHA512
219261c131a450a89a2f9cc446887fd85f3d088b8b6e4af0528520d0b3c80193c589aa1aefb971a15c3f2a5cd46315045aceb1b8978a5d6736c05ff18df27d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d4be2dd7cafa2cb329c2a2892eb53f38

SHA1
6ffb098ff10847dab6ce06b9edbcac58090cfcf2

SHA256
8a5d53f7be894c9c8f93451a71adf0d0123c38e084bcdfb8231bd7dba83d3ecf

SHA512
1e684e90f04d0f714715c1dd18d94037c282552078c0e169402a7bf8ba3dcd21d32022de518d46dc0a538c85c61c39dbe63af890b13bc55e194e8935f088d63b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
be056baa7546ae6e166d272bcf972ff9

SHA1
16c8b7ef2993219525f301c0851fd99fc7f785a0

SHA256
8ef52f06b47e8adebf03e21da0e289f56b424742bbd9529c7f466ce7ffd10531

SHA512
5828ef5bb93c8f88ba6254c15aa35a5b4e5949dccbadb4f084c3c1909df8fb42c689ee5b034c9dd0af23b5014b3925e41fdf4cb99227a16a1eac7818cf810dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e5f9bd32aae6854212a031b6e300523

SHA1
cc8669258e1434751286afd57da411a05c9998db

SHA256
25750dcc8a27581ee9b900318146ab470cc1b7c57fb483eba9133cf44de6414d

SHA512
c32061bf863417242b480540c28fcda97cca5cc0d16d72d2d1523a35a087a7479d74ef9f871ae0e328c378af07e58eb1a6d17aa3cd1c41d426a61bb6a02b27a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
14c7764995a0b9c8455e62155dd630eb

SHA1
7b82f3a1545d6c5bbf39f80a9c3eb4a0b1902de1

SHA256
8710326f2225a54724a6b91237cd822f1df37bd07e9e56474fa2b0cad42fd1ae

SHA512
e259ed395f1d6904a08b7220e6a94c280b8cbc209189baaae811a25b884d84e7b491d71cea63f857f9b0c0d97794efc4a854d303cbae26daa39deb9b758de2c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585445.TMP

Filesize
1KB

MD5
aed9f5f3305653b0ab6f96c9159ea65c

SHA1
1f06a972c5e525630ab44ed6f33a337b935e0d77

SHA256
33fd50dd31d77415aa7bbf1fc057ebf0f36e24bfc0c4ac51aed9d9b9d735628e

SHA512
9b444bd1c97301623d8f0b68857ae86d1694d9e9965c6e68d65ab2262311eee39f0124596f45880b0b5143d20c9f6d0d13afb4d322e7387a1aa67727d2ed2c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
18f8a6a882a78bcdaafaaae0ab517cbc

SHA1
d941c70d28a66f6c25abeb2fb39d5119bd47d121

SHA256
399be5d955ae20cc10e3c7d72c8501f8de514549c59fb6db522f6e2da00fb63f

SHA512
e312b3fa576161cacb30c58204b8a4e69441fb6f0c54cca9924419e75b69cd04eabd5442bb8a16a0f541b03febbb06e6239286522244ae97d3be676697d1a7db

Download Submit