8d4c2b008518d71de7106048012827d155119feacdb61ea649425ce4c55a891b

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
095ecd8f65bb58c49d373e26a3706316_JaffaCakes118.html
Size 75KB
Sample241002-hgcyrawbra
SHA256 8d4c2b008518d71de7106048012827d155119feacdb61ea649425ce4c55a891b
MD5 095ecd8f65bb58c49d373e26a3706316
SHA1 f0f81cc8f0f4ef0f5f2d0d134244561f0f6b964e
SHA512 2f518190101ac076a446d43258b7f5444a155a6f78c86cb478d94f9cf5e2b21c59060b12b705a59a0c7acd8702de95f5a69bd2aeca90f0d89565e2c683d7a265
SSDEEP 1536:uwgr8VSeO33BsFquMctnmiaS6cgRrmt9Xp:QeO33BsFRnm3gt9Xp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
1256	msedge.exe
1256	msedge.exe
4116	identity_helper.exe
4116	identity_helper.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1216	1256	msedge.exe	83
PID 1256 wrote to memory of 1216	1256	msedge.exe	83
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 2748	1256	msedge.exe	84
PID 1256 wrote to memory of 4572	1256	msedge.exe	85
PID 1256 wrote to memory of 4572	1256	msedge.exe	85
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86
PID 1256 wrote to memory of 4192	1256	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\095ecd8f65bb58c49d373e26a3706316_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff26d146f8,0x7fff26d14708,0x7fff26d14718
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15916135844568886582,5731448935953194952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814
MD5 7006aacd11b992cd29fca21e619e86ea
SHA1 f224b726a114d4c73d7379236739d5fbb8e7f7b7
SHA512 6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1
MD5 b80cf20d9e8cf6a579981bfaab1bdce2
SHA1 171a886be3a882bd04206295ce7f1db5b8b7035e
SHA512 0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 71KB
SHA256 726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b
MD5 da52e38c98b0f2047abeb07609608ab5
SHA1 da1210caff36df73e49a0c271ff7d573c2d20d02
SHA512 35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b
SSDEEP 1536:ntQRw6S6yzj9mN0hBcdYzdFONVzN7pPMJhJLY3T+2z9ANKokoV:ntQRw9BX9i0hBqSFuFp05LY3K25ANKo3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 61KB
SHA256 ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6
MD5 468446a7240461af44b59ebb2047c231
SHA1 47b7c525dc91bece99df0c414960b9490b986ba8
SHA512 ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8
SSDEEP 1536:8b3HAMT093crXTgJRNAZYBmuhSeIUQUYaoxMaagTEwL:G+WXTy8u0eiaoWJggwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 30KB
SHA256 9d34a303f8c67d6d63830ae852e3368ec97c8237e82672fa2a144352d1ce9460
MD5 e99f1712e9ab2361d5bdeb29f499183c
SHA1 aa1ad85ed4ca152a807101ebfbf7636c49495236
SHA512 686620842f086366ae8132128c7fd2e7037d2a319d975d5f633ba0160143567d10880e11027df2da4dbecb150991680c14a2773ba810c1560d69742344fa0e8b
SSDEEP 768:y+7qfTpOQV4431krgjan94Zxg25+HHhH1/aeV8/D2TicNxBdhEx:dufTAEPkrgWnZTH3yea/DmxLhEx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 25KB
SHA256 01318a80813fcbf44ef73a52bdd7c85b69bef8edda8d63a247bf6db8e2068a06
MD5 651759109c0101a3622ce3e8d4c98be5
SHA1 aa1838164412bbad08112a0895754c54ffd132d7
SHA512 6313df038c265f147a5954d2ed69ea61431795e005cbf25dda05128adbe668a194c73322727c65201ccfda5ba2252fe9f6cee88b96485b85940b83254d0220e4
SSDEEP 384:bswsBP+mBM1T5uGulJytKkD3USkm9zob5jRHm9DaE5Wwiy8/Ms9XO8HW9XicT5yD:wml9ulJydnHoBRGIEh8/D2RicNxBdbE5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 23KB
SHA256 7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc
MD5 c897f8479da25ec570027594f1b4db24
SHA1 81a3ff06cf35a87e697fc4733966dffc270ad06b
SHA512 b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10
SSDEEP 384:tU+gw6ZANCOehcIFLQp1N7sYfDUPbBGbouF/Ufk+/mc6522rk1l+vTZp4UMIoXAE:tUW6qNBeaIRQjfDDbouF/Uf+c6kh1l+6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 45KB
SHA256 c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051
MD5 ede70f717200a59b4cb831635de913a1
SHA1 d4d6e893ac192b5df087e924ab3356852f8a7bc0
SHA512 b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672
SSDEEP 768:aOX/jdsn7ZRu0lXLWWpFfQVGUF/swJ6olJezvFZ7jQVgoGuGQEPaa1A6X48r:9X/q7uQFcGes06OJQ8Vg5QEa+zXHr
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 46KB
SHA256 6adbb177af58766eb53bae18db69049baf92820f0a4bdc37ca00a170140087b2
MD5 59c7a88d610aff90ce92d0c02e8450b6
SHA1 8edc5501be9f901edbac2969ffcf0beb05a62a65
SHA512 91d70e41ae738a03889deb202e2750c8f0740e3e57de4d9295077d5c44a6c2a461a4584d5348129ce2ef541314c2ca9e8f4be0171d48b7e55ff5b9421660622e
SSDEEP 768:MTmOam69LhPWDUxMR5LZtLevOJotdRIKTmOam69LhPWDUxMR5LZtLevOJotdhw:MSVdNWDUS5L3Le22LVSVdNWDUS5L3LeM
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 61ff443c59e8b4f68759a50e7ff89002961750e9ee894f0d3bb855970b22d864
MD5 2a045d9f6174bd37c1b08e7021c4c23b
SHA1 31422f22f4f7f15901fd335974ce1518d62c3dfd
SHA512 0c97f58da6ba4b126b7f58982e1815eab91d0e8e9657ae84175bcdf96b57f43cd81f984135515d69a3a916aa51003bc00b6ce10366c6e32953a2794771050311
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 2cd163b3a1433bf66fda2d5df2d6a99274be958f70830b532a22ceccca737751
MD5 a39ccb00ff61338afb974a8bb5b91756
SHA1 f30564dd10e90f888a7f76b67281ea3f5fb1036d
SHA512 fc4a7f452af2c1996a318d4daa0edf164ae9fb67f86dc77a5c803d3220da67cb2eb9b6dd8ce69ceb283b47b4301ea553f83a5aaeff8c1691e867f6b2ef93921a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 866d02c7758772d82ef81147b24ca7dce9ba2eac9797020dce67ef04d9a6ae06
MD5 aab8dcf1454d1a64dc0dcf9fa2d86d57
SHA1 d6db0fe5bd68b045fe1dd510a0afb2426e92b06d
SHA512 e0fca896c0bcb7f8c5bb4e5548ca9fe3efc031642a077ef101914bb54bb46993adcda5bb87999a442338e5a5a6bf33aaf025c85a0f95d05ed3597586143955e6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1017B
SHA256 c5e82698de5c15fbf85b1e7400be041b20ac4460938d4eaff2159cccf3ae1b3c
MD5 006187a49331726d3cf18a21d1ce3738
SHA1 c6deee8cb3c158bb201295941d1dde1672d34476
SHA512 9856fb151f9c905afc1b9e82b4be1185a514d3719bba8c7c1ec919f04fc0b796e867d0dd4b6254bbfde1d27851794f729cbe582945d87748862c243079d30e56
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5555269ecc1e4d65f5f6f78011f95220fa6457490827dbd4e548fcee1e832c79
MD5 c65fb6c2dc7d4279fc0cf2d21640b9ea
SHA1 e411682099ae6609678edd80c3cddfbe2f5f19f5
SHA512 5c79b23944c6a51b190dc3da7c6830603a42a08465bf61789ca0b433c89f8c27582afa99302f503b7fd1717f689c1fdc1a98e04d3828385125452e796c94395f
SSDEEP 96:nfkJA1mL08wpvWMoiVmdeHdpomouUWQyV+VDCziEwb:nfkuH8GWMX4Ruro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b7c2d3db768c197a8ca14bcfe70a25fbbc356a596b00cdb81c5e235e2fcb5a11
MD5 7db0994b7e80dc4bb69a6593db0265c2
SHA1 ab3fd93d9470dfa885a58235810378b39fed1f72
SHA512 cc0fa9a8dfbe1a35eef79249bf671fd2f8544261985d11867ff1ea241d2895fdfa8bc6cb28a3bbb201034c64a51ec067e1c176e9f01269cad2526676a818338b
SSDEEP 96:nfk1A1mL0MwpvWMoiVmde4T89jl2dpomouUWQyV+VD7AiEwb:nfkyHMGWMIT89jl24Rurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fc9d44bd001a86f41dd8cd7c0b9afe73758ffb1cd8533abe27280b3f8fc0cb44
MD5 28a038e90e190b212b1beb16c4aecd14
SHA1 66af1a6c3729e445c3e08d146bdd46b8de85d5c4
SHA512 615a224530aa649f63c6938137e00e85560e55d7c24b88ff465a1a34bc5c1aedda363a896acfdca6a9b152b725f80c3dfaa77a0380f82e041cdfb02d17efdc5a
SSDEEP 96:nfkBA1mLQKwpvWMoiVmde4TwoYUMdpoMJXouUWQyV+VD7AiEwb:nfk2LKGWMITwoYUM4IYurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9086e26571048017f5290985f9499997b7f3e4166ca377f4b94b4440e8ae4e9c
MD5 864f862a00797da4c7c54b6a2f279cea
SHA1 4db7ecec3bfcf3967f21cfad9fb57b4163eb0f98
SHA512 ba9d7e5150ba3b5100562701c0c14244cf67810a005104c45b4dc2190d2c33c38e12d302ba202ce12b8419ca558d88856a531ecd0b1e2ccd6e71ad1381c26afe
SSDEEP 96:nfkBA1mLQdwpvWMoiVmde4TLUqh39dpoMJXouUWQyV+VD7AiEwb:nfk2LdGWMITLPh394IYurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d7a37ebdccd1f70510943eb822a0a8ab18f6859b66a1085fb5aed93286796394
MD5 f9b96fb262b9f46930b51b6938c5aff3
SHA1 a30952a2f578780cdb66d7ca97d53197d550ff67
SHA512 f3dcee37f7e79a14dda7dcef9eb15fcd19fc19c27f5cbc8ee8f1cb1df9d344e773b8588b07d023818640529468f8306baa0d67fd0bfa663b07c3295220d0f280
SSDEEP 96:nfk8A1mLQLwpvWMoiVmde4T3d6pOdkbdpoMJXouUWQyV+VD7AiEwb:nfkZLLGWMIT3d6pOdkb4IYurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1c4201c51aa3b73d971d47eb6a3916c6bda8413fbacafb2dc6226d2243ca2ba8
MD5 9551f81233ec93fddf3bafcff9b57b45
SHA1 7e3a19090a0e28376bfda43fc6dafa131fe56da9
SHA512 653111af8b73528ddfb55a71e7da719825a250037be467a1e443732928037691242cbd7829df225dd7a9160deb5a9ba323cd40a53c12cc266663e3dbe7932156
SSDEEP 96:nfkBA1mL0MwpvWMoiVmde4T89jl2dpomouUWQyV+VDCAiEwb:nfk2HMGWMIT89jl24RurV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 cca02da6010f6145de7fea0d5b236027646aa7c4a341519c9ff41be4dea6668d
MD5 a549a43b377d5eab1cd63d5266409bc9
SHA1 112fe9f4bfd91689bb09f385e9a02108a5cf66cb
SHA512 5df9da5c5be913a77185e98cbcda6f8b39f44c371d7d641f1606fbc8d39a7ffa05c12f06a52cafbb4b47d21c70abc0221438e2ba35183e615ae1a101df7d70c3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 4e1cd66e02e553409ef0258e0ed77071ac1938eddf8036e03aa9bd1e2fd02d27
MD5 8fe72b9d9c1511f71a046b312d7463a3
SHA1 b3c3a040cdc0b5331b00e98a07169ad2be296e0d
SHA512 8fec96594fbcede9efea4c806d0029799ac8ac47b099eaeb013e293c47d94b40c1bb917bc784884f4f2b23ade4c65cbcdcda67a61b65c37d4e0b3d4a5ef79e26
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 199B
SHA256 f25ac327c7ba89c854270987fb3f1338bd106401cf638e0462caeb0bbc10e7ae
MD5 789d88147b2722d806043e236a72cceb
SHA1 4eb17baddb58db297871106a0f0da93323482409
SHA512 75a650006591adcdcd41f8c1fefd840488bcf35f62d50c20f7adca53dc58cfc4879f8826116aa0cb192ee150dce1b858ba614744159d8bd429063a65af3a2211
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe588558.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588558.TMP
Size 203B
SHA256 fcaee5f6ee6b940dfda59a560e5929baa8d2d8f025425b15dba0cbc627c440f8
MD5 47438fd97089342b4f6451dd80bda2fd
SHA1 15e0c1b6493b1fa2f1d524d8a23086b444e7e12c
SHA512 2bd88466a66bfc19771514a5dba9d2456aeaae530b22c19ec2d6c5d84390726dae3d3d4f6179e4cfeb3aba9938c3488f737005db67d8bc45c4a3d8e8fdaaf5e6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ffd637b37b5c5b6037b2fe9744a258e2a53bc0f401eae41cf9b5f5ed33b54f18
MD5 4bf0fb44a5cdcdcc1a9f609dccb3b191
SHA1 444c252687af06e3fec728651debf2cbd632a2ef
SHA512 8d33cbf99db2b84541c21cef728e6df96a4297f9b404002ad8df4e3fa2042f28d808a09399dec2b2bb6b24c0d40474be74deff555750bc41b69f13a37cc330c0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFye2RUw6vHSuidy0TSpu:A9iIxuERzA83h09RZxYFMeHT02pu
MD5 SHA1 SHA512 SSDEEP

Submit Download