b46fc12acb79b45a2d5fcefc3c542315c831c214ff5f1fbd0858b7f5e17c172a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce9c3c320b8e249fcae2f7e57106c294_JaffaCakes118.html
Size 124KB
Sample240906-enh7kavflp
SHA256 b46fc12acb79b45a2d5fcefc3c542315c831c214ff5f1fbd0858b7f5e17c172a
MD5 ce9c3c320b8e249fcae2f7e57106c294
SHA1 9381c3811ad2b8361ab2f28cc59ff58250259099
SHA512 66c3a4ea39de21929f41dfdbdf1d1e7d80477d2855177de0fc21b1cf8e9d5fb3ea33599e656df3516886bc7ab28e5b6ecc3783d269b0554014232773faa54528
SSDEEP 3072:R1o8Njz2S81Ep2+U0vC78T9aVlo9YtPBXJ27/P7UHeaA2I7lUe:g8RpvZTaALn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
2164	msedge.exe
2164	msedge.exe
4500	identity_helper.exe
4500	identity_helper.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4768	2164	msedge.exe	85
PID 2164 wrote to memory of 4768	2164	msedge.exe	85
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4608	2164	msedge.exe	86
PID 2164 wrote to memory of 4776	2164	msedge.exe	87
PID 2164 wrote to memory of 4776	2164	msedge.exe	87
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88
PID 2164 wrote to memory of 2144	2164	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce9c3c320b8e249fcae2f7e57106c294_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa06a46f8,0x7ffaa06a4708,0x7ffaa06a4718
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6602597778526670622,5489618486977166761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x2f8
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 23KB
SHA256 1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4
MD5 33a83c16527e4531fbfca2631f653674
SHA1 87a63514c262ba4bffc52d2ceebb3ca14353507a
SHA512 f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3
SSDEEP 384:fmkqzlgw4CtpJByzHvyMPn0cdWgrlF1xUQNaASTJJlqC3Ix7RQLSKYfkXZzauNEp:ftqirs1yZP0yVn1+QNliJJlqnx7epD2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 45KB
SHA256 02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a
MD5 aa6a698d1c7fc6d35265b10af5570e9c
SHA1 00da372ad4964a5d5b8afff7fe1b207ff284f232
SHA512 f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b
SSDEEP 768:aAW22hCNc8zQk/uhLH3Eh3GOAQ4/V5YjDdt8ln7afnMYJNIyQfPLNAZNZYo/6v:aAWbw+k/uh639Q68l7aBJ/6BAvyv
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 86eabbaa61156f965776f4c3e1ae3cb1d50278aeeaca6a202cd47ba0458b9bc0
MD5 fecd6162785b9f69db9a921460709c8d
SHA1 651e6bfcc7731e5c43bcc7516a378e7ad38c9ed9
SHA512 93f597ca5e421aff868c2a7303bc2865d55b90100095328a362058d2d360a137e752ce5c63ec97ce8b8ea737129c373882a2ce07901ffe00cb63ecc7d7cd6cca
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 877d6a59decda836b3fab68934490036d59c6c86d97091836ff9a0de7817da86
MD5 5235907e013976676ed82e2c0b978662
SHA1 bf7f7a14cc40bfdfdae04234a9c4d7baed85cdca
SHA512 f65b05bca57ffd47f903d0a300ebc5e230186265450c31be7ed9d651595a904baf5e807a8b1df01ad2c9403a4fd950c9e402e16a2a42a88ab995d86fd0d8fe65
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 7ff9b8d34880977860c7cec705b98bfafcc2bff8aaa053b7ed4307e5637edd26
MD5 50a09c8c0992afcfc83912facdf2453e
SHA1 2dcb56a67eb794aa02e77a8fa7467974affc89ab
SHA512 c33d48b0938b582134b458d3e3fc5b87a2e3848172f04cb0cd850b5d79e81a4dad5356eb7120d0bb543d0876c19248467af1728cbb07db0a6b177e1e42cd241a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 11c39c8cb0c8b56b7bc3d1cf7f7722a9b0656ceb2ac6cd58be0332b47e92948d
MD5 f4280e9b7168ac69a22f8fafabc8d1f6
SHA1 4af420463af628043d93aa5d34a68a84b1644168
SHA512 39b272d7b0f8c6f6e07c88ee150a62a2b2088143288a8660511bebe8563e44434e0c730855963e66e367cc39c2b66610885026a11b373af79614f1f32d20acfe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 004991b83108b0f8c38647e560a2d08fd25ed30bf5747e6dcb61277760fc3dee
MD5 4f248eeb47837c3eeaeef6f7c9da3eb0
SHA1 bdd79ccbeffce02de219f0c3da975c23b455ca12
SHA512 58c188e9da0f0fe929fe9a1799467f5692bb50cf0c4d7904a5036086e0b77430b651d9da5961207cd67d58c9ec8e23c7ea1d7f391380e5aef520d77e23afdc28
SSDEEP 96:OTtiyClYOvnEGbKhG3GgrQ5GAGk9abktG/GSGNzd1GXGD3W:OTtdClYOvnEAkSZrQ57h9ektCrezd1Sd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 acd4ad937016440cace68ca561636866bfa6dd9acc4b2382a63a1e7d28c3229b
MD5 43e16e3911d1c3aea3b61ee1dd74ed51
SHA1 420ac656a5fe46e4c788a83140e92b765c9cf1ac
SHA512 718d8735fe065efd735c95974c329e04c67f8730a242c592fa32f194f048c9adad8ec758c7d55106cd5a7f409c68154e96ba5ce3557b9a078d41057cab4a7688
SSDEEP 192:n2kzVgUBGWMJxpegivl6VgY3Dlw8VF+ndDH2QrV:n2QgUkWkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 20adfd8a59d4007528a92e2ecf1c87ab4746a3612fc3c56aa3bd4af333b8c2c1
MD5 caec78c9634c671e68fee496e114a58a
SHA1 ab48382de53bf1b3c0e4bbeab1e1b19fb0c6d830
SHA512 d3ab1198dfc2a0d4553e25c1455e11a285f9ba6bff11009168ca001056fa10da7e45d3cbcb71c13127751920023152c9d15331a118a42605b0665e97bf6f1670
SSDEEP 192:n2kzggwBGWMJxpegivl6VgY3k86dNiFoXdOcnkwdb/+gzEr0EA8VEqeX892Qrg:n25gwkWkiurJ4/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1ff002881a170efefac534357425cb3153a2e1cb22caafda665c1101b13af40b
MD5 cf41e35248160ac5f9888c461cb02285
SHA1 93d20975ce74a2b659daf27065afb79ae49d80c0
SHA512 9ee82978b364823a125b145378f81f5f593643d477fcbf73a26812c0d9cfb867bf83c62868242f62f37745e9b98d71e1d3e8445559bec43031cda574fec934ac
SSDEEP 192:n2kzhgwBGWMJxpegivl6VgY3Dj6drXdOcnkwdb+gzeX892Qrg:n2YgwkWkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d2df86252eb7156239c6a677c40dda405560e2f6afcc34892e56e2c40f66a31c
MD5 eee919d3ae120a55b85ae099caaecafe
SHA1 db9f3b5bbb232f2c422ef5146d55312c9ea57055
SHA512 c1138efa143546a9f69e87b37572ef5515510b4f52803721b45d3d7b0e200a5e5e6605b3f59348c11b88b9180744703c1c720e14286c07bdbc4c52b6a479d9cc
SSDEEP 96:n2kzXd1mURwpvWMoiVmdeHm9+UWQyV+VDCziEwb:n2kzNgURGWMXFro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1660602d6da1247424b4ce6712a5678acd4a583d1eb449d18a4afae29ea149de
MD5 15dcf5adccb2b8f9917887a678c35719
SHA1 3340f66a76bcbad632e9ca8a65f36d515ffc5292
SHA512 c28441f507d2101bfba18eeca46c4e2098740856498ffb72e546f63c31799b9052ae0fd0122b5151c75fa9b5fe6c9701d2e74140422054eacf787d70863a14ff
SSDEEP 96:n2kzPd1mURwpvWMoiVmdeyKegivl9EdVC3BSpVFdH2m9+UWQyV+VDCAiEwb:n2kzVgURGWMJegivl6E3B8VFdH2FrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 bede4aa552e9b5c97d7da53f664de611fa8a6f0fb66822069f58d919ed8b4e1d
MD5 446f361522f411ad2b177b075330d489
SHA1 9f0d14d84768fb53fd8c8f479b7d2aa0f759ae1f
SHA512 606ed0586051d8066559c7deb924d5aa424e5fc847fc72cb30d1afc4e9ee1771dd00085f3d7554faea13fa8f54889f2643026e2583b74904be604a62ffbdedb3
SSDEEP 192:n2kzhgUBGWMJxpegivl6VgY3Dlw8VFB+ndDH2Qrg:n2YgUkWkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f8f76fe98a460fbd0dc6fd82cc5926beda40d28d7a7d6c12137c502357ade445
MD5 c1eae26daf79a0ecb708f17a369ad582
SHA1 1a795660d69501fd2a9b6340409581e146b621cc
SHA512 98258acefe460762acd844358b3c535753bbe49b9240fcfbb999f42fe770afebead3a2da3e3ebd5982e70aeb1f364bab360e21e5a02446f4427648927861459d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f3f7bbea89458a4ba5491e88edcc110e65fd1c65a156e26f18a61a3babe5c82e
MD5 91a5dc6751f9915b3c466b91d446ffa9
SHA1 f7081a4ad1e98aa03fdd1c573c29401a6cea80d8
SHA512 fc79f7402fbc52078ec620995d7430491cd17d24b3780973bcec6d0e3006cbc5036463c4416dd32ed53f9cfb07cef37121ac771cea224c692c8aa800d6792cfd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 7f63b48c16e1c10296dcf77dd344729d5009e45424295528b9f4077d8a70fe50
MD5 05c77bca86b3468f18fa6aa37f9e5a2a
SHA1 d82f2f40569723119b1cc8856a4f5a0d56869717
SHA512 ba35fd51d48f840768ad0f8fcf888556e7c22d7772b60b02e1de7b303baf7b14888d789b73ab938afa9eacaa1982afa3c28d9c6d63547750f0d7a31ee92bcf2e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe585fee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585fee.TMP
Size 201B
SHA256 a128eb4c889561fad0fd23f1cbbfafa04f35f0adbca3d121119e6a6786b54001
MD5 f1589554b4d709ebbdf54ecd9a3694cb
SHA1 cbd756793e7ecee20ae32464f0078ab1ca9d68de
SHA512 7fa6fb981e39edd67475ddd8371cafce15cad622f7813510e547d8df789868eb80a2d865ae2d782a35b1942cbb4f8b47bfdecccf2dc852c383740346dc2bf910
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 75ad8b3eb663fbac9126fb9a1dcea656369915e57adf877cbb47bf11dfb73725
MD5 a0496516cb374b7e40e40863fafcff31
SHA1 f5f9d5ecb9c2f3b2a199354f8b68360aa1a04155
SHA512 316433294a14a9a69364943092b5e0e64b27092e1cfd7dba7f00106a02a5bc7fd3adf7bbc174585c1281e29f791822aabd3dbce23956bef38c5e6e40908fa3de
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUe2RUHlYO/LQOl6feAOR:A9iIxuERzA83h09RZxYaY/SE
MD5 SHA1 SHA512 SSDEEP

Submit Download