Overview
overview
3Static
static
1documentat...x.html
windows7-x64
1documentat...x.html
windows10-2004-x64
1documentat...6.4.js
windows7-x64
3documentat...6.4.js
windows10-2004-x64
3documentat...ing.js
windows7-x64
3documentat...ing.js
windows10-2004-x64
3documentat...min.js
windows7-x64
3documentat...min.js
windows10-2004-x64
3documentat...ipt.js
windows7-x64
3documentat...ipt.js
windows10-2004-x64
3everybody/...api.js
windows7-x64
3everybody/...api.js
windows10-2004-x64
3everybody/...ons.js
windows7-x64
3everybody/...ons.js
windows10-2004-x64
3everybody/...dia.js
windows7-x64
3everybody/...dia.js
windows10-2004-x64
3everybody/...mbs.js
windows7-x64
3everybody/...mbs.js
windows10-2004-x64
3everybody/...box.js
windows7-x64
3everybody/...box.js
windows10-2004-x64
3everybody/...ack.js
windows7-x64
3everybody/...ack.js
windows10-2004-x64
3everybody/...ons.js
windows7-x64
3everybody/...ons.js
windows10-2004-x64
3everybody/...min.js
windows7-x64
3everybody/...min.js
windows10-2004-x64
3everybody/...min.js
windows7-x64
3everybody/...min.js
windows10-2004-x64
3everybody/...min.js
windows7-x64
3everybody/...min.js
windows10-2004-x64
3everybody/...min.js
windows7-x64
3everybody/...min.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
04/05/2024, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
documentation/index.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
documentation/index.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
documentation/js/jquery.1.6.4.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
documentation/js/jquery.1.6.4.js
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
documentation/js/jquery.easing.js
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
documentation/js/jquery.easing.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
documentation/js/jquery.scrollTo-1.4.2-min.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
documentation/js/jquery.scrollTo-1.4.2-min.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
documentation/js/script.js
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
documentation/js/script.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
everybody/class-wp-twitter-api.js
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
everybody/class-wp-twitter-api.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
everybody/fancybox/source/helpers/jquery.fancybox-buttons.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
everybody/fancybox/source/helpers/jquery.fancybox-buttons.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
everybody/fancybox/source/helpers/jquery.fancybox-media.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
everybody/fancybox/source/helpers/jquery.fancybox-media.js
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
everybody/fancybox/source/helpers/jquery.fancybox-thumbs.js
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
everybody/fancybox/source/helpers/jquery.fancybox-thumbs.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
everybody/fancybox/source/jquery.fancybox.js
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
everybody/fancybox/source/jquery.fancybox.js
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
everybody/fancybox/source/jquery.fancybox.pack.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
everybody/fancybox/source/jquery.fancybox.pack.js
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
everybody/js/animations.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
everybody/js/animations.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
everybody/js/background-check.min.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
everybody/js/background-check.min.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
everybody/js/bootstrap.min.js
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
everybody/js/bootstrap.min.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
everybody/js/customSelect.jquery.min.js
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
everybody/js/customSelect.jquery.min.js
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
everybody/js/idangerous.swiper.min.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
everybody/js/idangerous.swiper.min.js
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target documentation/index.html
- Size 52KB
- Sample240504-hraldahf42
- SHA256 cd67add8322e3c8efe2b981ee4726dbf223793e9cbdddc9b74c6a5f72b731647
- MD5 5974daf3b2ecd098f23e161a05cdea1c
- SHA1 78fa15080819657eab17bf0073bfcf8deaef3937
- SHA512 99a216edc30fc4ee98565823f3d25bfe132e075c5d086c3c789c0f1a9c9fafd9a5b4225ea78384db505c26893566b3f698941baee062051a0870335644c568b3
- SSDEEP 1536:EzLt1S1X+TiRNH77SKJIvguk1fnDawxsVvYS3:ic+/0fnfsVgS3
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2288 msedge.exe 2288 msedge.exe 1348 msedge.exe 1348 msedge.exe 3096 identity_helper.exe 3096 identity_helper.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1460 1348 msedge.exe 84 PID 1348 wrote to memory of 1460 1348 msedge.exe 84 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 1744 1348 msedge.exe 85 PID 1348 wrote to memory of 2288 1348 msedge.exe 86 PID 1348 wrote to memory of 2288 1348 msedge.exe 86 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87 PID 1348 wrote to memory of 2452 1348 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\documentation\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe39bd46f8,0x7ffe39bd4708,0x7ffe39bd47182⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:22⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:12⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:12⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:82⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:12⤵PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5001667251483566721,12127430662744962513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:3912
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1604
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1200
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
- MD5 8b2290ca03b4ca5fe52d82550c7e7d69
- SHA1 20583a7851a906444204ce8ba4fa51153e6cd494
- SHA512 704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
- MD5 919c29d42fb6034fee2f5de14d573c63
- SHA1 24a2e1042347b3853344157239bde3ed699047a8
- SHA512 bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\282291c6-1545-46d5-a32b-36db2892f398.tmp
- Size 2KB
- SHA256 e84550090381be936db302e02b9e7ef828fe5ce9251645f20a78c16f702027d6
- MD5 f33129330d1cfee238e4500c0a9a5caa
- SHA1 0f8c9d10b4c3ab025ed72b34502e4a5a5b3179f7
- SHA512 631b49bee1b1c67699e63389a0056d1c665ea5777a40ce735ee48dd67edbafae8d189b84fde6c93c9943cb183fd3d7111ea389b765c594a52223d34f61367702
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
- Size 32KB
- SHA256 6031816aca7ea5570e205613e1d9ca27f99dafad04dfaa478b78b7127acbb637
- MD5 eda13c6b6a5166489f77c8d20050d7eb
- SHA1 83d1706bc1bb4b7e491045b945c3b50db09f58dd
- SHA512 b8cf001a29d1c1a1d9d075e7e695cd913d946ab657b77ef1e23bcb452cf301f7c6a7d7c6da921e49b56108e7794ec974ce44c0fe058180aa5c9e7771f2906357
- SSDEEP 768:nQHylgc6VM0sGd3eXVonzlOpNuHzUyY+hYOD3:nQSlgjM0sG5INuTUyY+SOD3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 216B
- SHA256 a877a7c2aa87e95510da1c68812e412e829fe55c141fe4004a0f30c1920c4ea6
- MD5 aa9d453aba02d3874593ce0921358236
- SHA1 b407fdaa639dce86cdaaf7a359ff8815606bad1f
- SHA512 658f266b9d38576f8fe137a524a2077bbbbea309d57480055952a2e6b33fbb050cde66212bb6b41953d2ae25616cbdd9f34501179048880a43ebde4d860586f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 b7adb105054e18898f952dc38e31dc999857f1fa4f73494439389495cc5d8173
- MD5 ae20bb7b2320084c76865201363ce99b
- SHA1 e3767d29774d6c42de3d6491f740638246caa987
- SHA512 a3a927625edef784fcb28776ebc2506ac59010a751e5502d68dca562c1295258e0dadb011656e39629c7570b0ce4710c3197267f7e01e4a748ddb7e22d4d3429
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 a3a962bdf757050f710b0960d2272862cb8fcedf545538d4a7bf7f21365bad7b
- MD5 5a268efe31bbd3fcc2d5b3dc30f9dd0d
- SHA1 31ea105bad7c160330f932dd449621689862d243
- SHA512 c1248ba44ab857a9671401d6aa0627b2cf10a61d2343308a1e713826ed5c73263f0d9aa9cbf49f98c4cff6efc8c43181834624c4f282e7cf15028264c062d014
- SSDEEP 96:n3kho14j12wpvWMoiVmdeHuwuFk+UWQyV+VDCziEwb:n3k2KEGWMXFgk+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d65e9d8d302adfb275821ef6af1654c30d3f399a9067a337fe0c413486aabe2f
- MD5 f636dfeaa03d32b09fc176eac73a597f
- SHA1 5521d61d8bc4fdc653f08b206bf309d02d6c8d6b
- SHA512 ec973b6d31ae5c572d5bb464d65a03169c9e2b8f9ff2afb2db44b16c5ee94d6540b15ae30a28def765089dab0916ec3c9db742047106332ee1278f840fe37de9
- SSDEEP 96:n3kso14z12wpvWMoiVmdeatzEiCErdZfeU2uwuFk+UWQyV+VDCAiEwb:n3kdKUGWM8YiCErdZfeU2Fgk+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb0f2676-9ce7-484e-a4d6-825e6399a42e.tmp
- Size 7KB
- SHA256 b462d2f4920bfc0a7bac8af80ebc2256f1e5336c3ad88455920df65eb43712e6
- MD5 b925e503d52aa16998719040a27f86db
- SHA1 ddf92ad9a1b39a874c454ad1a641dbb358905018
- SHA512 3bfc57382de1b2adfe913f2232f961b07599a4f8a60012969b818c1ed4d155df948b40bddc0a792cb189d222dddad8f84183b4b27fd1f15b802c425b823c59e0
- SSDEEP 96:n3kVo14z12wpvWMoiVmdeatzEiCErdZfeU2uwEqkxyWQyV+VD7AiEwb:n3kCKUGWM8YiCErdZfeU2FVkxlg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d60954f87184daa32cdc1b46af307b8ff19569ef8019b867c76c89c15ce36cf6
- MD5 2789b2c37d67f73d6593c90879ee926f
- SHA1 44b4b4ee2cc632983ebe4d3ee31b90ada80c752c
- SHA512 44d761292c829d8d738dbb82ed3a3340c95c5dda7e82327da4ad699f9aad3e89d7baf3e59b55694497294d4fbfdcc48950eea9c38683adbb8e74c85b164f16a7
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupU7ge2RU5Izx+OblfBhDaaa:A9iIxuERzA83h09RZxYU7+tx/XDafEBa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 12KB
- SHA256 95b3c62919076db03ac67d0d2f68847ac6ea4c6e5e8433426870c36cd3c3b23b
- MD5 d4e03d8c5d08c2c2fe55fc8b5602676d
- SHA1 680e22f43f7b4d612ccd33e05112b90dd0ce54fd
- SHA512 893214d75bb054a25aedcf3f02c58457da0345d0a1e086a736dc20b1156989cf5bdf46048af5bdc833846a30467637ce5ae4e0b63677e4fc108701909261975f
- SSDEEP 384:w9iIxuERzA83h09RZxY37ykq//XDafEBFU:7IxuERzA83h09RZxS7jq//XDa83U
- MD5 SHA1 SHA512 SSDEEP