5106c512bc2f2da6d1626ba16ad92bc800d4c81bd3e37c3fa537d819ab29d1f4

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e4e7cb7088468554cf74cd6d8397c84_JaffaCakes118.html
Size

23KB
MD5

6e4e7cb7088468554cf74cd6d8397c84
SHA1

7b3ed48ef865aa6eaeaad2703a45a01a984a9520
SHA256

5106c512bc2f2da6d1626ba16ad92bc800d4c81bd3e37c3fa537d819ab29d1f4
SHA512

28725a327e22528e42508bc2dc2c106a86ec4f98492748c9ee6c50cddecadd9dbff649ecbfbb2a0cb9cf0a215b6c789db70eedc851ecd956cf32e5aca75529b3
SSDEEP

384:gNYJqrVl7L1Ajbgf7wh8fnyAcQ4Hqq651AmhdEmpEwYulTpU5g/32Oag4Yb:CNLm3gf7K8fpcQwqqdINU5I32Oag4w

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

82 http://btc2016.atw.hu/index.php?welcome

flow	ioc
82	http://btc2016.atw.hu/index.php?welcome

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1496	msedge.exe
1496	msedge.exe
1552	msedge.exe
1552	msedge.exe
2588	identity_helper.exe
2588	identity_helper.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

Processes:

msedge.exe

pid	process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1552 wrote to memory of 532	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 532	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1080	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1496	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1496	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe
PID 1552 wrote to memory of 1636	1552	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6e4e7cb7088468554cf74cd6d8397c84_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92c546f8,0x7ffd92c54708,0x7ffd92c54718
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8168 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8176 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8860 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9004 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12658871651705696996,897579544501010117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
64KB

MD5
d84862513956cbe61aeb4ebbfdd3355a

SHA1
14ab269df17cb0333b1556ce120d587324479f6b

SHA256
a18b26912ab9e034923cc64fbfdb59d682500f2c556456930e480b6bd69e33b5

SHA512
d04ca96d72595f1e291a6ce96f092c1707064800103cde733512a186c1b22e089b63690a0c53965c97248dd782731b22fa2d27b8ee3ae112647382f1c06d1a9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b94509db08f9570a1ad7b13174a2ce5f

SHA1
63d3fea93c7b72431b996cee647007e8f5dda9eb

SHA256
12a8e63f645bfb8762771ea898594972601f09a6ec05293ab82ebf2fbe246b78

SHA512
5b54ddf8f200f68586ea6b521eb6205363ca7dbf17706a848f6c9be5a54ad3ac0f142312bd759603afe3cec73d713654c24d6cc0b913e2d247625a8c5ba24b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8136ac091b060f957a8183d2ae3cfe85

SHA1
74636b484685a85969d4f641c565db2a55e3b6c9

SHA256
48f442e384be08ac221a067bbed5adcf5d5f4ffe853d4a09ec8e897add11ad56

SHA512
bde2135aa8c97456b5b5e558731bc9e43b8c6c6595c5ab932a56123e0facbb8a80a52e0270815be6212c2da0cf5dab6ac86cc36774208957c56139125867089e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5c4318dce4d41139a6b55622e26278c

SHA1
279b9bb0a9c98ed5851d38d9d245289b7a529db1

SHA256
2e0887da531dca37b019df3ccc7e1e43d1a608c6e5e51d0645f29d649885957f

SHA512
fbb447edc6c29576cd6113d1ed581703d57391760a63bb37e54163851ade31e2fa39b9dd72cad8da07e45aaaa931cd935c400bcd779ac07892f8e8ac67f5f08c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4a8520eef9d6a7b73cc34058af7e4ddf

SHA1
f97242134d671059e990d03dfa6e20a2e6360d77

SHA256
e0451e61bbe5a2c2e5e79a46ad2556fb5656c07348732d86174a26857b6d3fcc

SHA512
d6495f7f1de691c3372972dc01bdba43901401f63e267b655bb7444692e614d1eb1ff70b708ec92c6ebfa0f35f23a226cf4cd50ad83876cb9dc161452e108889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ee874bbb33d6ed44f33b0de11c4b0e9

SHA1
c9f49c873aba0e7e76130716c7353d431c285f60

SHA256
36a099821f2d55ec95150c5c423f49fb13b9e7c0c855c63dbf41318b5c47b44a

SHA512
66911c513a178c221b515152af0b5e3f9fada6dc6c6b165bd0fcd9aa60e6286b7a6312c607401e3ef041525384cd97edb7ebaff7eb53d88d5d1869882b701a87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
befab27be17832b482242b7f9b30eae6

SHA1
27a901e3dc9c1c3e16346533f5c93ac1be0e0a88

SHA256
ac03d4fd0e23558a68c6bf4f8c7e5ce5002907118e82f4f247f7014d57fd2e68

SHA512
fead5e35ded7083066589cf487fb3cc497f6e8f82b3382a925d352fd4c6025d1b459c5fb3d3117e8fa851d61220c56a40f4f9fab99347f3fba5d9efea74d0fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3132e982cfb23b2cbe4bfc2b6923382f

SHA1
98d118f132125493a55e5986d0f86e07ddfebd3d

SHA256
ec7f31b0d95bc15884fe8bc7876b8412ea5f2738f3c5602dcbef8a90f5839b67

SHA512
af809f329b03cfe40c4d9567d958d630dd8c17ae30e78022e183cc0aa79ec30ceda32d1d2117a67572e4d91590a58ff4f9853846a72df515db1426c50e8733af

Download Submit
\??\pipe\LOCAL\crashpad_1552_OHTKTMMZZVRNFBLY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit