12f9df610a7b2b18570be7a1a7778b20a9f82f5022c6db47ae21c4e06ece3177

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbf1960edbf0aa6e36c718f6546a7428_JaffaCakes118.html
Size

71KB
MD5

fbf1960edbf0aa6e36c718f6546a7428
SHA1

07f686c10ee2da1acc0fd9360c76c16240106248
SHA256

12f9df610a7b2b18570be7a1a7778b20a9f82f5022c6db47ae21c4e06ece3177
SHA512

bf7a0c30118d1175f271de3ba3a40292cee09791427f101d947adc7546362c1c690b0efed78a6f86424d00efec3652799bf582ee2f67826f7474ab5d06b0b432
SSDEEP

1536:LC3FvKRpuNrrEFtaE76/DXaM2wSmrd++0i84SDfDAb1PDGN6o9syOZ:4VnXp2wSQcfDAbxD06o9U

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
960	msedge.exe
960	msedge.exe
4004	msedge.exe
4004	msedge.exe
4988	identity_helper.exe
4988	identity_helper.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1848	4004	msedge.exe	82
PID 4004 wrote to memory of 1848	4004	msedge.exe	82
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 1092	4004	msedge.exe	83
PID 4004 wrote to memory of 960	4004	msedge.exe	84
PID 4004 wrote to memory of 960	4004	msedge.exe	84
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85
PID 4004 wrote to memory of 4452	4004	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fbf1960edbf0aa6e36c718f6546a7428_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3f7f46f8,0x7ffa3f7f4708,0x7ffa3f7f4718
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,8553757632412630134,5057571712896827814,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
25KB

MD5
9d66068882978e0e14462832f9c9fa81

SHA1
dffdf34805c21e944a7d8cc10d5fdb059c22ca83

SHA256
9f995b1c42942ededcce16bba381a19d3b30e0e75a36e0ea956f6a54e040dffe

SHA512
1807fbcb929589e25107359e7abec56d73ae67f93a9544dc1fc02bb59f8a62486dbb9dffa0e931644f0d8104b541c47536a2bae0f8567b37d69cd93dd234f34d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
e21eebb4d8bcee4fd117596f5c8733e0

SHA1
c116cd717417180978706139eed4fcfd4f35401f

SHA256
f7d31ccc9eca5ad5406e1844f167416b4509e2a5cd440525f7f79f461ae68db9

SHA512
4ae68ff43a853507b95227de0fd3b627a9c06a379b9eb0384855e573df587d5509093949c8e072d26891ec39ab4f1614554809e0f4a9c2c4ca8276e4010c3e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
d6826eac12149d3bf7e840f1c54ccca1

SHA1
ef635b5b39428e9ab4f8fe803096d5a3f00fd2a8

SHA256
1d4c56fb02a6d826e1ea7d205d46102f3e3ff718799dcf663aee668c2c8fd148

SHA512
137bb88cb64470710a27901f43b6f87b702127782c51a6e63858efcf76c8fce5325954cff4bb6b78aa630e4ba7e7b11c2f5e217c79fb34865937961d3a1660cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
bec4e0833d552faeb3704647245507ad

SHA1
401277b6e171646c3d7a92e97f8775d709ec880e

SHA256
6ef31fda23b7d9b665d6cb98d68a069693c2733f171fb6009352ba7b7b137f1a

SHA512
b4148911d249ff134a951ff73da718813f2fce078ed28649d736385a19cd33335b478424810a29cd955be3b6eb742bc5b21ac9e2fe25acca6aca61760d6edbcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
75174189334b093c0eb28f4b39a87a92

SHA1
03e94f4c3841f699ed1c8c2796b0ca7be5c06657

SHA256
39f351fa0cb6a28dc3359924824168601171d9e085a05e846822f39d60b16ab2

SHA512
b550399175097221dd5202456961f8c961052d6836fe4cca1554587cb07e7467ca85ab358c51c5abcd610f83a469dc4046eb935450b37221c1813dd56f9d1a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
1fbb904050cc0245be9b472ea9570348

SHA1
cf5193512587e52524d51b65cbe8f92d8f494f7a

SHA256
b54a19e64e1ba0f63694b572216905f83915524927138edaead71e5e25929ef9

SHA512
0dd7a55af2b3a5f43f47dec09189a4ad24eaa7842a934a2b891486592baf000e89f6ab20b9eba256705d9ab0b1924f125a1f857ac74a4cd7488465f7a4584643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78d7fb6dd93558e67915f77d34e94048

SHA1
e3f85b5095b7f46297da7200ee5fa398d4ed984c

SHA256
e590917f2e671b389515182887d1d3235e0f0ceb657ea7b230949a316e37907e

SHA512
5ccfaf3c973eb01cf24bb96a2d6c47e3ab677b91bf7879c306dfb1dbb73a9cd8c46d1d0b0d69dc9c9a787d4bc16b990dcad14db550bff77e2dc0a527aaee4691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
90456b4656b20086a7707f40a0d745f5

SHA1
450fa55f64d7d800f3c8bbfa2a0dabc9ee7fb341

SHA256
5e9cd14d79c9837aa1101b6375e384793f300915b88ec9e46e427d4c4890c611

SHA512
2e3a4fb802b9196f2524ecd8116657c5280a1d391eabc007c99c2b653a3fb825d724f092a936a97e997ea877c379f892e478932c49129374065c9738a5e0a88a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
7e637b41b4c673b996d0fd7c005cee3c

SHA1
d52779338feac081ff94a5dbf437bbc29fc8e3a7

SHA256
df26a5e93b0291b5133ddf1eaf4fc52116a06f3cb5f004648a88636d4f723468

SHA512
c8c57cdb64c7df8a70ef7b3d12c7d1d021c6b3759d9f774e5a427a0789d8c864a7bc339cb33cf2721ccfa7ff7ef96a6b469603c4c31ebeaba90373964a893a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2ceca06023a816e0b2a1d08c7391eaf8

SHA1
9dd811966e686a4a0eb99a5dabc4f7bbde138e2f

SHA256
5b7df25792c0a57c6a84f2aa1fc8acb066c82077552d12b0e610c1c75e8a303c

SHA512
910f0f42d5afb0818f69ba4cf4a7b1a01b0850e12abdf0dd4597da7e964f023c021c2636c3e2fbf80969bda327dc573c7beabc7a1c6dbecaa7fd8431c52abba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9a4bdff94a57a6246c455febc91b8e34

SHA1
7e4b9e2d9b9aebfd9639595578c607b29e492070

SHA256
847064b6e332ec22d86250eb0bfcf181bafc7d49ca5bee11ecb482ecbd30d38e

SHA512
2360be38d3d986b897c529ff2e301361206ba1290980d07b3dd632d47aead567cd5fd84a695508d35859ecda11f11888ccecce5653c398eea24e2e3d3f70c3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584a81.TMP

Filesize
1KB

MD5
a5d187f8a221239306024be7955581dd

SHA1
1ad1e6769f98bc0b96b5e8b1924a90a6dc51b9be

SHA256
4c793b0420e825f27b966044dd0c4c09d8b0ebc9eb8e5636d8182f8126a961a8

SHA512
a4a786b42c78d97090c329444f1e34fb3260e89d4192de0818871bdf3d53063e57c8f682393114a6c77728c1d0e41731c5e111d0aebaf36ab7efab0e233a3030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e104cf75b2abd6c9da9602bee6231b2

SHA1
0347d023c66c54743699df5c71906b86ac79a9ce

SHA256
0f853698637ca36c93f8b3eee8ef179c85458d34fdad3a3d5dc97908b1903819

SHA512
736fa42418011425b00ee51535f29eff387138f407136e249f9134788ad9593a9b7e3bde406deedf66927f010e73376f042a9e930f672600e4dd5cc01049fee2

Download Submit