bc5ed33dbff0b09a26428e214489e1872d7b2f7a4c3529913a306ac8cc887c80

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
29/07/2024, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37cf2b6026469a0345cc785a05141606_JaffaCakes118.html
Size 7KB
Sample240729-erc5qasfpp
SHA256 bc5ed33dbff0b09a26428e214489e1872d7b2f7a4c3529913a306ac8cc887c80
MD5 37cf2b6026469a0345cc785a05141606
SHA1 d605b248d844a7a016620f2e29b4e2960d8af42c
SHA512 47c07ac94c81f565a1b148e6315a176d82de31e8fe63e9cef86e352fbad885e9e13197b5d36e93657e7abfc15a8e233380cde2e89d5a05510e0f823a75fa0e2c
SSDEEP 96:odTVAFGuVrkthrqZMW98IM6Wfe6bpa/9G83T+UxlL/1uZ:odSFGmksj8Z6Wm6bpaZBNuZ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-195445723-368091294-1661186673-1000\{E97CD6E7-3B58-4C4E-A0BC-5B88D4CAC05B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3552	msedge.exe
3552	msedge.exe
4284	identity_helper.exe
4284	identity_helper.exe
828	msedge.exe
1600	msedge.exe
1600	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 1712	3552	msedge.exe	81
PID 3552 wrote to memory of 1712	3552	msedge.exe	81
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 2904	3552	msedge.exe	82
PID 3552 wrote to memory of 3196	3552	msedge.exe	83
PID 3552 wrote to memory of 3196	3552	msedge.exe	83
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84
PID 3552 wrote to memory of 2292	3552	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37cf2b6026469a0345cc785a05141606_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2f8646f8,0x7ffe2f864708,0x7ffe2f864718
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7206945806149383999,11716411737663299872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4b1ef876e1d4f2c9726b7b966222c336d0be026c588178ad40ab476be4d353ec
MD5 0dc31145339977b457eec605c4e1a567
SHA1 deb6ff8183afdaafd849858c821af52f93936e1c
SHA512 ef095404247530ade966bae7d6920f0ff060852e3dfb545f4bbca384f88d0e2a4622b55e4b856ab63f6e6c56196a8ad1257711b53a2fcdd89962d1252b6c4e17
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7e0833f04bdc7ed7a88940d793f110d199368d7c2ca55eabb154de84a355d7cf
MD5 31f5155eeaa8631c1c80614efb4e73cd
SHA1 aac054ba3a9bd71bb2644cc541aad11a5f119017
SHA512 94c43c4e59ae3745fee5157852c279110de2f89dd1562c47627ef960a70790db0b713155817ac7ac636e43f0218f73d35c915f9de61df019ba65c09730a21452
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 210KB
SHA256 b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7
MD5 5ac828ee8e3812a5b225161caf6c61da
SHA1 86e65f22356c55c21147ce97903f5dbdf363649f
SHA512 87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6
SSDEEP 3072:VPjy61QwpL6y2f60/fSWAOZC3jQuYaSBeAtl7qU6Mh3Ijw0O9YK+rOCpeGMrqD4/:ZeX+L6M0/qW5pBdtlVr3Is0O9JG09nAY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 f500f49bb2e618fea63f653a34deec37a7d9012069ed0efdad5fde0993750e82
MD5 f3923f3c881a50dee5746d64a38b0b96
SHA1 3c897af781e49e245f15bba8d65e06f57a8eb202
SHA512 94038feaf8db9e84908a1f987524561f49d83ba18bb88f60f4ac9d38efd73991094ae9db391a366c0048ce946b1dedc6b84f34ceefc3919a01863bec0e694a85
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 bcc08435e2c87841876a2533808939d4f8c00a5f74a38c0b6cc289da795dbe0a
MD5 52ad952e3a4e4659f5835e4eeff30d9f
SHA1 13097510b7efd4ff7dd9ddc8bba0384a88ceba3b
SHA512 871d0641c9c0428be5b15718d78330ab383fe3550a6dd2fde5bed6c826976549885ddbdd21b4941aac712478a2e2ce1589211c6d6fb86a13ab8869c25bfb5bf2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1749c328a22c0f996497c028a285832f440011dea67c28901d4d60645aa5735c
MD5 e2aa1271206329a1d957b76c2ea1caf3
SHA1 69c65d837abbfc494124eb1b86c6db5cd4ee4e9d
SHA512 bc5d6425b8292ca55ead589e5fa29c9047111e154f506cdc4816591dae948c942e11f8a384f20f365ab84916184406f266db027b88b4b2fc514a61bdbf53661c
SSDEEP 96:nLkI7a1fUd8/tawpvWMoiVmdeHxU6JUWQyV+VDCziEwb:nLkbJUd8FaGWMXxlro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c4642208928a32db47a326cce4e5a13deffac3ad21507d8d5d4fbc75be84898d
MD5 8043544873884a0bbc5854f6edb3f9a5
SHA1 a259d80b71a98861aad8e9e515f277d472d193f8
SHA512 ae746f1471c9047d6412414df16c303685a100e9b2dafa50b8da85c8bd53104bf78c35830a99d1b85af4a495d43a1f6738d1025bd52ecf200febf67a36fa5237
SSDEEP 96:nLkO7a1fwd8/tawpz1WMoiVmdep1ff2xU6JUWQyV+VD7AiEwb:nLkBJwd8FaE1WM51H2xlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 202be13f774929d3eaa7e99efcd9a6e9a7dc30f3ea025caa2ec00306d33259fe
MD5 fefd2a0edbddebcfbfde225813a70842
SHA1 f1526e8f00b337c1c47653c5c8b1d696a54b6e8f
SHA512 574a1513a1930de779341fe7ed254cb97b3585467efcc79437f76ca1ed0a3c2ed44e030095ce3c0565fe92956f1d1262b91be63e7c35a9352baae47fd0c0baf7
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57fcbf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fcbf.TMP
Size 1KB
SHA256 ec0f9d6ab360891fc3cc85f81a95745f756de239d4d7ec6b184e961519a97be3
MD5 66e7ff06869238def759c0d129606d2c
SHA1 038b4469146a018313dd8483414fd2cebce44db7
SHA512 5575d6a0de1c74a9920f624487c24ed19eb2d61620504b1a317262e0a45b6ba55b95d5462c1d4aead0ee3fdfe1c317db0cb5076935264bcf8d1b0309396e5568
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a524c545a83074057b383596ffa3b90c5ba5276b67e8c5bd016e3990b157577d
MD5 f66e7f902884c8889c9efb61b265cb22
SHA1 e8d3660c947e5a4d745377d7c49acadf70dd0295
SHA512 cfb843c8810dd4d661c84b88a75a4fcf2cb54d76f69a98faffec116f62919028767b4dd556c1746f09aa8d4a7150c5fa7813dba908feda9b8bb06e41781ae2ff
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupge2RU2S2YcD88HqrSEfC+C:A9iIxuERzA83h09RZxY+gcD7qrHIlcA/
MD5 SHA1 SHA512 SSDEEP

Submit Download