b2188b23797f59e37174cac4eb9cb7f6b555d390076cfaae52651018175cae61

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41853b7150abb914c80eeeebce9a2f1c_JaffaCakes118.html
Size

172KB
MD5

41853b7150abb914c80eeeebce9a2f1c
SHA1

86376c8ec1b0c5af897395e82f897f685e16d258
SHA256

b2188b23797f59e37174cac4eb9cb7f6b555d390076cfaae52651018175cae61
SHA512

d6835c8cf8e3b2467bf9683efb6d663f45fd506835492c7c810b7d6cadb16aa121059ee7d9941e0fa91c60b3b504fcb88b879265866e1731df13097dcf6b9dc9
SSDEEP

3072:14/0gOS+BOtnXM07odYhMFH+BjXIPzkEdF+48EnBG1mxq7seV/6mG0sJ80V9o5xk:148gDVtnXMX+BM2wIJ6HYrfNwZ8a

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
88	sites.google.com
128	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3212	msedge.exe
3212	msedge.exe
1096	identity_helper.exe
1096	identity_helper.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3596	3212	msedge.exe	85
PID 3212 wrote to memory of 3596	3212	msedge.exe	85
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3112	3212	msedge.exe	86
PID 3212 wrote to memory of 3016	3212	msedge.exe	87
PID 3212 wrote to memory of 3016	3212	msedge.exe	87
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88
PID 3212 wrote to memory of 2364	3212	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\41853b7150abb914c80eeeebce9a2f1c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcff346f8,0x7ffdcff34708,0x7ffdcff34718
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7568 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,18037498519200032984,14841657396653416176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
df05658feb2ffe1547b79564ad8cd180

SHA1
1404243df6ff4073d8e8070d6bed214b59a229ed

SHA256
12cdd2aab35a6c816563532558c5050103fb8cd3b2574d03b3b5a0d2226db501

SHA512
081fe3be61aac4853dca997e407645e42c33efc7a0f16f7904513ea517d1607e6432bc42acdf8f05541187d4a99701beff4e0158b33c1b737ef95df9401914bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
12b47a754e7d505df17b2fae8f9ada51

SHA1
f542a3e239fa243374c102e39ae9139d6f3fd838

SHA256
951cab9cd499233a72262e1d8089285cbcc4ca756c5607d923c3de05cab22d2d

SHA512
c717903c3d0ce51c7655dd5ae75a12e308be9c35fbf45c53c32759fbeeb004fbc2639582f7fffad471dec90f25f9df0793c2380879277b47e1269e2b571ace01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e1023d45e803054c53fe723a1d94e45a

SHA1
7c5b1b0d8a08759f8aabceb7a70963a17705a1d3

SHA256
4e537c0125c39ba2b3b4ef65ca46d22b0401b55d16e23b68d8d102de14ebb465

SHA512
5807a819f166b6d2e0b369b5f849ee7930955cc00e6539fd2766e45ebe0fa429f67d0fd3d0403732d1aa503e482d710b1b93754c478cc2051272d5405d82d38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aaa28e7f651c41aa40884b50f6e70224

SHA1
4b5ce3b241b0d350ac84f8e6b387cdf8c8f35cfd

SHA256
bc2e8f496c0316761b306ff3ff7ae1e573b007345bd9235ca84ce4753b0109c6

SHA512
83047e2496564550c1c0664d8e96b731a326b8da71d76ab2e2445ccab509e543dea0bd4fe3532aa81881af8164c1186e00bf45b94e61476d6c06bd5925e1bd29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7f78e16ab8c8d46c34ec0c09cb76ea41

SHA1
dfa269dc314cb2f3d7c8c8530ea94b918428799a

SHA256
bfb4d601557b78d1aec3a2e846c2020cfd9a13b11b068b632a91c762590335f0

SHA512
502690fdac38551ed9591e75991605dd027eb4a13ce7c05db93ae2f755c168a3cc9f445157c576792c4ed9be31a812f445487e4252c2c1c1857b1389f2f5e8db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6113933ee9aa20ae488aa1753ff9c07b

SHA1
7d3c91465be99b6e6883ca09af5d77184f7726d1

SHA256
de84fd7752699b7e9ba59bc29a3dca3aadc4003abb778648144fc76f4ee4e9ed

SHA512
77f794ee1048bf5a78cba08b43fd80e3635f8154ab5f019d3f9f60259f57f57f46df1e8d55ca2e165bfaac0e944e27215641ba0304361fec1d2e426c86a8bfed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a5d748000f851f1cbdecf0c5cca6224c

SHA1
c6ea942e7039a794752e57a17126de7027a15bc3

SHA256
b178218d6cb71ae472379c663c9c7447b05c8ad321157cb2ffa13807ab243269

SHA512
ed01511b95f635a8e2df6fa702a967aeb9f55fc42dbcdbafb9a6f4ef5424b260c2452f8b7342ab87cfaeaafdd24225b0f5183d3b34b0f5e418e89a9ae3d3312a

Download Submit