94e89589836aad5f140b608cb55d44147a1860b289a9a85b2c93012b586ff34a

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99da8f736c5714c12eb23ed8f432d912_JaffaCakes118.html
Size

73KB
MD5

99da8f736c5714c12eb23ed8f432d912
SHA1

3f8996b089e76e0a0e9f494b0213dc5acc96fd3c
SHA256

94e89589836aad5f140b608cb55d44147a1860b289a9a85b2c93012b586ff34a
SHA512

5f86876eb51f36c99af4d02fe46482b9645026de713ef7f34b30254778f930bde9adfc54107f5b44a1682ba900d0c6bbf3fad356649d120dbad54629d1d57934
SSDEEP

1536:ACspD3WvjEVdeVUDDk0OQChHejyymXhs7/:ACspD3W7nQC2chs7/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{D5E476E9-355B-4055-9A02-EBBD563CF99F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
5044	msedge.exe
5044	msedge.exe
1436	msedge.exe
4412	msedge.exe
4412	msedge.exe
5576	identity_helper.exe
5576	identity_helper.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3252	5044	msedge.exe	84
PID 5044 wrote to memory of 3252	5044	msedge.exe	84
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 4756	5044	msedge.exe	85
PID 5044 wrote to memory of 552	5044	msedge.exe	86
PID 5044 wrote to memory of 552	5044	msedge.exe	86
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87
PID 5044 wrote to memory of 900	5044	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\99da8f736c5714c12eb23ed8f432d912_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f4718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2096 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,5393179131569157682,1956107345471073837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
2e5cf962e617cb20376b4160ad553c29

SHA1
22dac546e58654bf378ad6466b77de9c64928830

SHA256
12ccf0003f03046f3ddd57f5b1fdc5a9bc9708190206a67365bf12691fd0e73e

SHA512
1506dfd3b870ebae00b652f1d8e06a8c65c2ce839ec597695091a760a5aa8358e92c8dcf0644b169757613380ec50ad2a205f214ceedb078005e09e8d402fd09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
6e6c8b25c3ac57b9b29e1a2b366c2ff2

SHA1
50df80d9c96e62554325e8d90319fa5c30f56d01

SHA256
ed0d5fd17249eb1af2309697d35805586578621e477d0e59829036d0186116b6

SHA512
f150870b42667c2ffecbacf232bc08eb7d8f4edc5440744b613be7baff6d746fab2e8b18f0874aaed049d7bc2ce476b5635d8698b9dea1c0b208823eab682b2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e91c49fec0f2e33daaca7d985672bdf8

SHA1
3950537a4d7a6fd8d6ecfe744f80dd826f4da633

SHA256
4cfa4299e85211b9cdb2a6751b954525db9441ac9da2a064386d1c16364caec2

SHA512
3d7552e30a9de049f971bf16eaff4ed19dcc95c8277a87f4f88eec1219638c6e67a3cb4a3105875f0f11cd730c819443adbcfca3a7cb610a156fb7d82cb2668a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
db51ca532280b951101079f5c92f4121

SHA1
447a27ef32acd7dfd96875ad5cd9491ba8330cbc

SHA256
755e6ec394491f09394a459730cfaf3bc6d12b0d65358945e11bda5ea0b5be01

SHA512
488b5bb3259653d1a281180c39896fcf86ceae9fddac33648b8f15db3a47b83ae89af4bd5d2ff3932f1cd49877a11e43e895dc3256d5119d1d7d9beead57f988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
127f8cef853bdb23d0325f09bd7ab80a

SHA1
43cda6e9c137c9ad093635e7554d587601177a3f

SHA256
722542d9e7c1602a934972390a6d30b49b65b737b159b4569f86941e25da4193

SHA512
a415435ec207e6ba5065bd56b0cb8b6384563b28cf713a0f08ba1056ef16382395f84ea7441a4d9bac12c95bfa88f8ea8e5cc75fd6bb834b8f3f2cf0f20e7cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f3ae36ad53bc83bebb3af063d1c8091

SHA1
88484e3e9ff807d56e790dd92f4a6b17c4b5c7be

SHA256
1a8439ed8f3a2c5664c27839ef1949c81d02d02e6d32797239a0f0d14949398a

SHA512
7419836b57d8aa3908aa7999366bb4080e18ec1bce686cc18e9c7bccdd305b4c1c397f9af4472d4aa7389d833f4da6edae250dba77f438f41ec7402764a582b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4d6228fced48d2ddcca940cd98bb1d93

SHA1
7270f9eb30fdea3951eea8244dbc253182551d56

SHA256
1fd5c5fdac6b4b084e0d4ab0674b927f166b9fbf395238b21640ab7e6034027c

SHA512
0777b519223e8641c645abcd89649796ba829755eb53fa729c0f75c248610a5abd860416e9fb14990e22f48b249739a86d4b980edc7fbf8e4951a2fc8a5c1b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8a919b6-1fe9-4da8-8231-abc1dac161c8.tmp

Filesize
5KB

MD5
8830eb0c72c6cfe268f80b77079e6de2

SHA1
1e04dae2edc1959214a02ff1e2501a7f237725fc

SHA256
d4d677c97ca2c97e81be43e83f54f5f159c31ecb3a1fc0f1d1e948fec33ecf2e

SHA512
d61e8268a3963e1b00d2c72e250ee4c9af7e66e6231d3c8d258a5751fa40b327f360f73685ff139a52221b443cabf2bc278dcd901c519186254997f178419836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d1f581f1d8023af905c22cb0b2cfb454

SHA1
d5892b8d00b2d8bf6f79a9c268df9196e3cc199f

SHA256
7497e2a948a474b62f576c86f162ecd6e4e9a524c2a98132c01ed02419ffa883

SHA512
bb5b3f33fb65d9eaf424654bb80a79b4241293aa531eb909b059fd69fc267ed14ba38e2de3b05086c66e0c6ea1e33437e5f928b59cfa850a07dedd6ccffd4eb4

Download Submit