82bfc09aae8c88f428c8df825d479b0df4f78ec0a0c2e0d86aedc089d1ebd8c8

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d248dfa288fc41e339233a8acc8e971_JaffaCakes118.html
Size

75KB
MD5

5d248dfa288fc41e339233a8acc8e971
SHA1

4dc9b1225ffe216f21c86fbde62b2ff5941248ad
SHA256

82bfc09aae8c88f428c8df825d479b0df4f78ec0a0c2e0d86aedc089d1ebd8c8
SHA512

385b37f078f22e6d1e4000f0c8fc1c318ec8683a6d1b7d84c322facaa1eef40511ee777ec8e5d66a28f103ca792860c79895aaee01a78051093fa3f09f57e660
SSDEEP

1536:uwgr8VSeO33BsFquMctnmiaS6cgRrmt9hp:QeO33BsFRnm3gt9hp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
2044	msedge.exe
2044	msedge.exe
800	identity_helper.exe
800	identity_helper.exe
5932	msedge.exe
5932	msedge.exe
5932	msedge.exe
5932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4504	2044	msedge.exe	84
PID 2044 wrote to memory of 4504	2044	msedge.exe	84
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 2284	2044	msedge.exe	85
PID 2044 wrote to memory of 5056	2044	msedge.exe	86
PID 2044 wrote to memory of 5056	2044	msedge.exe	86
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87
PID 2044 wrote to memory of 380	2044	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5d248dfa288fc41e339233a8acc8e971_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8ec646f8,0x7ffd8ec64708,0x7ffd8ec64718
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7816437368056058757,11234420897507888498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d35b3f9-41bc-41d8-a559-3310af1797fb.tmp

Filesize
1KB

MD5
918c11c972e5d2e7a8a3b73b6dc070ff

SHA1
6a7dfa325e438a5789f5ab7ad2adc5f518ccc76d

SHA256
e36b1b048d1220afe0cf98852a93ecb7a2856228a524ec9952314c77aa70d3f8

SHA512
1633636dc2145adb97b0267737e4514458e147c3af8157ec2a4b0ae7c17fbacea8717bc2260207d8e2b7b723299a27b4797e3923035b0e183cd2d173571e9fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
23KB

MD5
beda68c7227c7a5a9f974b1c74d257a0

SHA1
8a03576d27c23e9612bcbb5b9e758e4535ee4c81

SHA256
e9b270df7c8655f05f8336e4897debbf71a38a69c3030f33031376b4257addb2

SHA512
4e178897f5ae13f1cbb2b374918e22b5b281a78e3362fd6125701776c8826956c06153147840b52aaf4316bc8078059f83ee4758d84cde70190bde8f1f36e619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
30KB

MD5
e99f1712e9ab2361d5bdeb29f499183c

SHA1
aa1ad85ed4ca152a807101ebfbf7636c49495236

SHA256
9d34a303f8c67d6d63830ae852e3368ec97c8237e82672fa2a144352d1ce9460

SHA512
686620842f086366ae8132128c7fd2e7037d2a319d975d5f633ba0160143567d10880e11027df2da4dbecb150991680c14a2773ba810c1560d69742344fa0e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
25KB

MD5
651759109c0101a3622ce3e8d4c98be5

SHA1
aa1838164412bbad08112a0895754c54ffd132d7

SHA256
01318a80813fcbf44ef73a52bdd7c85b69bef8edda8d63a247bf6db8e2068a06

SHA512
6313df038c265f147a5954d2ed69ea61431795e005cbf25dda05128adbe668a194c73322727c65201ccfda5ba2252fe9f6cee88b96485b85940b83254d0220e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
75KB

MD5
d0423d1926f9891582cb2d7a92d128df

SHA1
3fbc2ca2ab9f4550f0d1e71bb84f0c2fc883eb57

SHA256
8025cb16b5862fb9bed473a55155ed7e28018060548b106d001f921c63af9375

SHA512
4db6a4f730523cff0cfc3a11fd9b2ef6d4cb59b4812fe43b15d287ba68e24a477e8223f8d28a1caf964a6e1363f46f8a71a247a230818c84f47e9c64c0711cd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
115KB

MD5
425e308bbc7596b08bcc89101e3acea8

SHA1
7234c0d1a14d4dca9b9b83c81a430a593d0d0e52

SHA256
a9181fa533a95e3e4f25b407f54f81190197f25e392ee2c6de85b9bbddf25b32

SHA512
ac63e7d17ee330abc03f434aa846a3a476fbb721a42032ae2c73e036bb7889fbce6eb7e0b567a9ae240f1a080c2f22ad1acd75c033a50fa7383609df075ced22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
42KB

MD5
101f2295c59a6c129b95bb68093aed06

SHA1
12f5843daaf99bdb874dfebaf10660c54ede2120

SHA256
9b59525954d9da17ff56cac0c0cda55bb6c4df6b7550fe68565fe0d24a963ac7

SHA512
f5e54b7609a1884253f1d05d9245def95b3721e1163ddabb6d32f5b31f824a218c60533eef25a6f91d8ae6fa314128ae258fdc341cf9a4f36bf378e874b5277f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
46KB

MD5
ae91cc8712d87a493060eb2ab4f35407

SHA1
2354a6cfde894c74e16dbb2a17251087c9e3a511

SHA256
6b88b2b38e4a655d89371385df5c0601bc137484eeffebe75b0b629f7c1eeaad

SHA512
0ded32e0a4f838cb05751acc8f81c46981cfd6078b24d56565e325aac3d2bcecc5dbe086ec6613e79458659a3161b27d4318245ac2517325712047615dcff610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
159c61b618bbfef84abe3b2fc17ea6e2

SHA1
5c0d45ac6e89c1009d252f80d94e4970f5113bc9

SHA256
3c2e1d5dbfa836dfed43bab927d67b55c09f410aa1661c6888f3602a43675b26

SHA512
4874b1ab15fbd6aa557a0f8acb4523a7219eee7f1490bce23245fb1cdc90481853b05bd4e186dccf06c6c0d553fe772493fc9e21b59671213cd0b14af39543b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
d39ca505c13864be90392661f6731b25

SHA1
11c0a0c8e7a11edade7853032f168cd96a8bf4ee

SHA256
220fba04c59eddb300a833d7b438c4f7f763fda99c75cfed2a271c65742b6b3c

SHA512
2e8dba15a1a2432eadd05f42063772bdc0c4d3452acf89147c51569bb4fa8463b1bda82a6a7bd9c0f580d896f2ca853384814f5bef88f12805bfadb52b4479ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
1d676f03e805ce22695e96060b95312e

SHA1
9dae9af904d8107991c9afd325f373244e5fbfee

SHA256
5e691f183033423d53bc27be85350721dd7a404415af11eb4acce750709fd3e6

SHA512
4036f609517184d0a149442740c64ec23b0fd781cae2536f67843ffedd1b8cb2d01c21cc36642856a4cffbb285b128d33703cf5402076bf175ac912be16a0171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d32415b81d15f484f5f2f22c4c88464

SHA1
adc89c6dc93f8a8b6631a23f666542662ca4789c

SHA256
f725422a4d0e345ba113a80b951ed1999f4718b426b4aa6ecff90bda35c529a1

SHA512
f8b8d4e5e0cfca8d01606de860bcb81a55d5d68d64d31091a613a096aa399b657b4dd61a19a3f51b8eff8a6dcd588bd12b53facce364729dced84ebd0fe266b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5889b8296d44f1508e7f459e0c1f7ee5

SHA1
278b3c8e754f503a852df6aca41cf1f5bd5856c2

SHA256
038b7b49413fbd629089bcd92d8ac2f59f0be9f1805455dc99a67052120a4b41

SHA512
905466bf576fc55f8f6cd74fb432e42c546816f9049c0d8500aa51d54d45ca11acdfb6866fb3799f0be23932741838e5c5fb7b6c518b2c0293b98c76d1981d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2719144913148ed06075bec15fa954b

SHA1
14687993d1b7ac8f385380952c0d1d67417c589f

SHA256
a75fd0fd219b6b50571a92e3d0480e167292c0520e3b473dc9de8cfd4593f772

SHA512
8b584845cd8f6d21c19e58c690a1a24441165c11ea5ecca8cbdcb2876d4b192fb858c4970afacb640951620a0b51ac676edb98f80b7a5da78b6065ed9272b202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9092ff80aea054d79c08c260882b800a

SHA1
552f9a69c90dbdcb0c2f13eb3e8d30811ac1b7f3

SHA256
511e2eaf237f6695ab35d276762ce52a29e05881f255cc4d55b19f237c98aae5

SHA512
a112cd1bcec9a102e96254483d0a1c6af15dbf199850001e5e2ab49149870e23765d5359977a7cf63fd0165211ca8494cb193674070458c3e1f802d00bc176ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3d7f86c61373730fc28def2408fcfde

SHA1
9100017672c8c1346f2bdf058a1d80c96ec97b21

SHA256
217926730f29f901a0b2e5e831258b20f017d7dbfaad3e74e46e8ed0aed63a06

SHA512
9d93ff22395f3560395df1b2945815128b57f5ffdf6cb54ce373849e866e59dc1638befa8ae3de3128ce4fc81ca9fc3ee88edbde010c2808689bf5c5591ced4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c32c27ea9f272e24c15311ceb88f944d

SHA1
47c65728cc4353d1227a3e0eba284becabb02a84

SHA256
6780cc77f8bc2a85d12a2250537cbe8170f82942b6dffb33fd08f2ffe1293aa2

SHA512
8ff829a54e7157386daf121cc61904725885b2942e4195dfe3defdedd62cc314918fd5dbd988fb02120062a062a8a2a2db125eb5e4659225d79d77ef5fcbd07f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca411627b9315254aa6e0f92527ff41d

SHA1
faedaede7f063adc278e93e6f9afa49e48ea0354

SHA256
80037edaa3ed2ba96391614b31bf55b68a6c3c2556426519af8fa5004e0913db

SHA512
2acdba86dd6136ca3777b06fe71a05a83a428236c517b420b86a72963b94e00ba0298b7fab35955482b6cf6237fc6bb467289f70091a851f8e5d14ec7ab9ca7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
72c68609d383a9af107e118aff423489

SHA1
f98ab6058d3e838e0fc4005efc1478fc8be3f614

SHA256
d18f810515ea66030490f9dafce9a3bf33c9eb2809b562bf3a88e8c8d55b8b05

SHA512
81ec1a70eec53cba8ce79ab80f0dfd120ef7a4aafa3bf889058775ab0cb19ba1b3d860fbd36e42a631bbe28eabae7fd98b86657902b13f716319e27e1196dc16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
1d3f2ae491c7ebedc5f7360723e57afe

SHA1
7415c03757fb6fd3da1aabec120c45f6aea654f6

SHA256
1ff4d7d5087cd5915853af06a9e22931f80428efcfea0fbb9d648622e5a5fd19

SHA512
e366179b61dc47f563ea61d3558cf00a0d7d98b8bfc9ff14ae71e3ea695207a917c71c609124b5cecb625a7dbf4b3e9a40ead8b6690606511e25668d4bdb8d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
0991b26506c5ba2ca12e252b2cc9262e

SHA1
7e9a8a5c8864db7dc026e867abcae04cf4e6cb56

SHA256
12e19e0eb1535272b6ca85c867172a941056476eab9fa2313570241254c34dbf

SHA512
a34b04737f3b8e07fe867b02874e66704bcce36a50447c6dd0f54cbb4c8e086ad17cad2641c333a38cc08532a8eb15661c79cad44905d981298773d695d6913d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a776.TMP

Filesize
201B

MD5
6df48693efb77a030fe31e6fa9788afd

SHA1
a081846e3ee64551cecc5098890109e2a2653beb

SHA256
5be89796750e66847b391ecbcc0dc7aaa4faede5750401d0be69846776f13aea

SHA512
9b5276805ba1a57e438b26319c25a98887b95eb5e0da5e19f7dbdf459592ee227be806d89cad3c6e32839bcf13d9f005a44eed47110dda8c409da2bd773efee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
730cdc1993f9ba87dc7124d1b5602638

SHA1
3052e50f305dbb7080ec9f5ae3d16845c70343e0

SHA256
147e10a459b579b1add994360199cf4175eeb4637a6642629a93f7c9ad8cbd30

SHA512
5d322cd773101edcacd63119229870a3e3a9c98b6e4c3f09fad56cca2664247b60cc547c373e41b308a4ddc6e9892acbd7672c35fe2115d9621020334044f9f0

Download Submit