b547ba91fb524aaf5be58209eef23c50582446f23ab8c5be89e94f85f8086680

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54ae2df5613cf2c93f7bdb249095251f_JaffaCakes118.html
Size

136KB
MD5

54ae2df5613cf2c93f7bdb249095251f
SHA1

e53f05a8168e26cd4540449c2d27d54a30bed545
SHA256

b547ba91fb524aaf5be58209eef23c50582446f23ab8c5be89e94f85f8086680
SHA512

3e956f83dc22d9f5e21e96e96843eb89348c26838d61afc69acca043cc2739d940f941eea90965c053498dc13696337d838a01b5c53c2b309fc8d177d733a515
SSDEEP

3072:wl8Njz2S81Ep2sqbWsB21TvSVleByTPBXJ27/P7UHeaA2KT1Pu:y8Rh1T0kLq

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
4420	msedge.exe
4420	msedge.exe
2304	identity_helper.exe
2304	identity_helper.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4416	4420	msedge.exe	84
PID 4420 wrote to memory of 4416	4420	msedge.exe	84
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 4008	4420	msedge.exe	85
PID 4420 wrote to memory of 5000	4420	msedge.exe	86
PID 4420 wrote to memory of 5000	4420	msedge.exe	86
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87
PID 4420 wrote to memory of 3560	4420	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\54ae2df5613cf2c93f7bdb249095251f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb397546f8,0x7ffb39754708,0x7ffb39754718
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,51475075263279382,12333619099510597546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x378 0x408
1⤵
PID:4232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
32ce8571cb2f03106c16e66bcbbd052b

SHA1
c8e2e91bb19a76c3164a167ac13b73535b171c51

SHA256
e10b8205545e9991d2a5b3aa4a6529923b5c176ebb690e908236a2d847deeb99

SHA512
69d82eacb7830c02c21e3adfc00ba6f478e698ee5055d9572a88e400a8fb35621efadebf170c9464710df4d0a3d450c2b28d5a2b026c68783bd098ef7658f197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
013df0f149815a079d8f9e0cb763ddad

SHA1
83a747d139f7a9c1e80e5d72abbbd213c562fbe5

SHA256
5bf7e6f422c5c379b164bc46c2835193b15b79f7c35bca6b5d58d74446e38cfe

SHA512
31ca1d9c8bbefdd87be071e05ed17a8f1335560559b68468a4ccb23bceba2a1065abc7eac079c8a50ffaa719ab47bcee4908759d62826344483b9f368ec565b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fe31cf958f5ceeb25c4df552e6c9d826

SHA1
d25ed99b9063b2d0f286047c4d4d97b5e0472cab

SHA256
5f5f902f8b20df2238a2344b317a90ef8f412d884083dd07dcdd693c4d9346c9

SHA512
c3b1057406d1c91732e0280e5e5a7bc30db79096e2691f64c061d26531f5d5ccca2583603679315724f4daec9b54eb14e9c84bd582bb9730d339161ce5021e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
506ed74c2be3e145996de4a602b9c2ee

SHA1
8c6ca4339ab8900ff29c3ab51fc7c5d5f7fb3262

SHA256
e0f823e51b44631b241c39135cd798c73766db857eb711e1eb28a50a4ccc632e

SHA512
4d4a485e825e3af7ca906812db177eda5c7b514da6b2a82da8621396831ce37d17f0eaba4bcea4ad204c9cd00e17432d6ce6bb5e4c6c492702da9ac8716a1aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
30f13c41e0af0ddf2010f79f8f92827b

SHA1
cb448463780e08cb6a0ceb13e74e50d1f7ae49be

SHA256
5311152a37519e7e6dbe24f9016b0bbf14035461b9d189da4e109d3c151977c2

SHA512
46b7e62393bdc24971decdc60a4fde49cdea8fbd2d0cd792c02b9cb3fd5575d281aba69a3284663fa1e75b193bf29d9c66e7db3e9fc7c96f38913d57e17f7a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
3c4f231f8a3ab4357c2235f6178e1c57

SHA1
42376772a4bb8e10a0250f38ad0ccf9ce95286c5

SHA256
2febba6bf30d6cd56b66c55e21820dfd6eddd820a5a33021b51b533985632c57

SHA512
dc44db2307751f651917f7416a2f779355648e2f977c1198a82f633e702e37acd4b8f55f352724ccdf064cd23e5e11a2e1dadcac3a20738c039377ac17b7298e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0a84959a159ca4863f47cb54541ea96b

SHA1
761ab926dd772aa9e90a19b1c6df940b9a5a6bd2

SHA256
899aa507d9b103d2b23b316bcec4d18f41cbdb44b046468c939d2d929a09b835

SHA512
1ae67fcddbdae802afd0e28d7d156dc25356edbddc098f42837d70fb062a47454be52d37679aedbe661a2f781becbad811e96389bbc672b7f6c29f405cf6e3c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3a68f0bd9439219940ec027edb1b48c6

SHA1
4607cad9c03bc1a280a15465d309a66a25427aa9

SHA256
21dc014fbf0a62180090071cc3c62cb5af4dea08a3aacf43ecf73eb350bc6ab7

SHA512
dba204e9e4c75e44bc03af069390556b9037b46621ba9eb1a61df56c3fd3767c03812f5d390f4d577d1b05d70860024f810dec2544c70ea473eebd6e99dc49d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a0a5eee7cf6a5a9b912abd123671d2df

SHA1
5e76cbd3ad1367fd55c75caa9a4d618dfcc2ec52

SHA256
8948f3f8519a978564689be9c4fc2f07befd2cb28e48e6892da7484fb17042ee

SHA512
24d8efbd63965285d10cb7f56a88807eb850dc84b348bf21b36f774f0b43f5488d8cb7eb4a33af760e0bbb38ce6b0b00abf8205826358421856016ce0f6712ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8448df35601dc7d4b3b3400d34592f88

SHA1
46ce3330bd456d30adf9f93c63859f4fa8a7bd1e

SHA256
08c475420363fd5f47e7f52c20f89c349cf78b7c54f641fa729c530355f875db

SHA512
4d5e0ef12fc1d8925eda888890e068291c3079c7948fb790e1b040f5443f58812a9c72cc535752720c7c8b4e73f3f4de9c82de624b2e5dfce8d74d2684b03e39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
0cf4ee0735196256a0645a7716fd4bd9

SHA1
eaea3f27fee0908bc6160c4e90d3c8fb21619287

SHA256
a55282ff8fca38299cbdaefe3e97adfcc0049bdc46340e7a5a115f1c97d25765

SHA512
649630b6e90f6908e0b69a80240e00e44720186a98e9834bba4ac15903a94c305be5f1e69a2633e62981c5bd464af9bb4fc7415a78308fd4c298ac6934f2b807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48c084fe5ae8af356013af9e3313a766

SHA1
a1aacbb8a3f46005b6b6cd42a16642b76c5eb93e

SHA256
660f3ae4c0e3ab3ee6bb8628f7115bfc2eade4a2a5a5f309b038730e0c4efc64

SHA512
6746da3e7a656a7abfdc8efdd3b3e309b9c18362338355576aea7c920537c934b8bd96e8fea4eedc50af35ef065c2d55eedcfdc0146fffe6022b8dae39990ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3945c4edcdfe20392745a26340fa9280

SHA1
b48cf5c6117bb9f8e31d419e8d10af516e9101d7

SHA256
84ff7d2e4fe7c56d633039feb8f83511319181d8e53cccfbec703d1e8a32138e

SHA512
9c1bfc317ba2bd957dcd94dc66ae1070439c162c5aa6e277bfd20e63f1b1830dbede8ecb23920e9a760160956ff571afb001e5f9877464864fe57f245ee63095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a15902ff0250e2ffc8484f7284908b3

SHA1
5d87f9c92841340fd287da950bbf3ae7b7d76438

SHA256
e3847963b3f3dca8e2895ce9bc3ba0fad373c36f92f88ae1110cbc52dcbf2b3e

SHA512
0ba3b20a7db889b5f6b3e2fc65a23506a22f6497d0ad6504b910d0210abeaa588fdcf3a53d808df73af389138c9fccf19c77fd9f10c94fe362d531a3f6e7d927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582556.TMP

Filesize
203B

MD5
ac7e8ae5f575538bd4a0e8b646c7c4ce

SHA1
6949715d7164eababd3d870b0f4fb70abd7d2aa1

SHA256
bf5bef3db38d71be06aae58f568d18b9f8f62e1cb7a77c4c716af14388183abf

SHA512
40311a104c55a498346ba3b88b750bde39e88d62b705ea9bd95655611c2af5b4a2e6ef9b2b2d6990cd0d17b988d65d006df484b08418f97ee2fad82657562e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d8a5a337f778999513c8d4ef93e69edb

SHA1
419c78b8f4085f8202c5a7a8f169e646e70cb860

SHA256
d3ba80439524189cffbb4b738729138a2a6ae20f4fe998d8a542943da3d41960

SHA512
b7866465664167d42d3e894bf22cdbdfd3618aff55203d64d275578627a8f26914ea9c0599a1b2b8454f2e63a74f45258482d107ca07279b2e45576eb26e6122

Download Submit