06291a72a9afc31a7d21479bd03a7adb7eb25d9de070fb6284e7850c73df4830

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70afd700699206f7f44a8452a0d16cf5_JaffaCakes118.html
Size

151KB
MD5

70afd700699206f7f44a8452a0d16cf5
SHA1

524de28e8e9e57ab44036aef255922ebf045bac7
SHA256

06291a72a9afc31a7d21479bd03a7adb7eb25d9de070fb6284e7850c73df4830
SHA512

b24dbd910ffe6d40c511c10d1631976ac36cc604f07c3ef75552ffdaf07da0bdaf9ff1f51e23f58a62ac0d15fa9a4ea8029771b9af304656ba298b6a42e6113b
SSDEEP

3072:HkclVIcYuHt7YJp+N18lW+S/CSEsvMgqodPheNPt92tNTi:Hkcla1uN7YJwj8zkCsGBMi

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
1200	msedge.exe
1200	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 3732	1200	msedge.exe	84
PID 1200 wrote to memory of 3732	1200	msedge.exe	84
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 1484	1200	msedge.exe	85
PID 1200 wrote to memory of 708	1200	msedge.exe	86
PID 1200 wrote to memory of 708	1200	msedge.exe	86
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87
PID 1200 wrote to memory of 800	1200	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\70afd700699206f7f44a8452a0d16cf5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a7b946f8,0x7ff9a7b94708,0x7ff9a7b94718
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8348 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9120 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,5131771763606304187,10062977877095335495,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
6867eb222ba088e772f65c5322f6a0af

SHA1
1c274f6993649ea3142b558832b230af19a6afc4

SHA256
358c479aca4bc979612041dcba1817e2f4c3811d7a18b1de26216b5a25b379cd

SHA512
e16443d08634533ba75fc60d463d2f6b87084f52a91747fa85e892acb444ecb8ece258e3c3c05f057f41e022961b7f154ccdc8c43c6965ab087321cd20eb152a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
29fc2f21d86c97558902ffebe94e9b4e

SHA1
320dc2f1392ada2d82883a72223b06982d89bd03

SHA256
9b1ebb96b606b9f65f46ecc89b1c0274d837da852fd63ba0ae612f4e282c1ef0

SHA512
f6597cdc2ca850aa2e3d38bdf764045c90aac76a5f7224de51f406b29dc2b78a848bdd71186af9b7baa499530729852835be42cbfa1fe9604381864761f7c659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4d0eda74bb289200cdf2cfa2694633fa

SHA1
1ad33af734f4963804f6f9fb95368f3e6fd02999

SHA256
3121213f8547b09c431d698055c413d8f821285feaf6e59b2febcbc24df4a8bd

SHA512
d0b24a5116efdc38a932c48492e7702832993da684de0612ade08e75cb8ace1747225f384569b2cde5cd0f775ce1febaa09598fc5480015805155a55dfebbfc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d0411317b7a92ded34642f90bd10f03c

SHA1
2859fe412e1563074eb1ab6b3fa93a12317ba16f

SHA256
9fdf33100d1ea10165b98faaa4e25dbecd17440ba3cafbe4516d2f8104a833fe

SHA512
01b562066ff856dc2935ce8fbd40cd503a8917ec86cd50d70a5a2ea8d252057679ca16f355594f5fd28149fa0d8aa6932dbaea1dc3b55c1de29d1d4b67a59bec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
be433fceccd7e1520dd9adfc518dcb96

SHA1
8d935c34b22453f90b0b1bb2a5657bc02b26b20c

SHA256
2144f78f9f10277732bc7f0e9c3b92453f0754ed5b5ae495896653cfab12f228

SHA512
098337eae698352aca9cd6171432ebd9cda2bd628ac7fe76324d0de64c084f9db3d263f3147dea2c02140c153f49ac2cb41c7fca432515a1a1bcf64f151c5ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d6c934c86902d8a148aaa306ae28ac99

SHA1
e46749328da8f2a78ac65272a320fb03a53d6a90

SHA256
9f262fff34740a58e8df6b63ea5de52de1d4fdde07f5e24ad41a8fffb64e2054

SHA512
7e6903bc51d3a3a570e20536a3123ccab22c1caae47536837fce2dd785d2b827554093f84e19facecc9b8552fce55e2c58f555a24d1e6b880f77d48ee5b2cb1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7f037f4a7e038071faec7925dd6a5405

SHA1
d142d99374593ad9dd82569eac656b39a8ef6ffc

SHA256
d1bb74c1aa80a1639aaba40baa44fe505d2751cc12d7a954cb4675c5b608a1c7

SHA512
b0fffa9366295595825ccf1c8090f1e48f90a0fa5968dd18880e51c2c2b5dccdf172b05fbcffa82ade08f45d4f689c60468e505c4600079cd60cedf2ce4301c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
71909663d4fff443cb8eb75a940b498f

SHA1
4d67e64f6cc62f2fd901a41459e823bbf7e81388

SHA256
3ee906fa7ffef04dafa76286beee006288feec09c4d4a845d4cfca665f7d0e7d

SHA512
014bb3ff5e7608aa3edbade2a33afe24d31cc2d491b2bd731c0771a6637b5874b902fab9179aabba841f4f3fe9dbeac4bf7a077e9f0927f28cd1e1234b0a5cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
28ae38e3230a2994297e70a832a7cae3

SHA1
862027a1797dae8d3f20f2baff44b334b9139e1f

SHA256
b0e7f9c0ce4e97ef96e199c6a2d3c5080a9a702867e635324b932428060ebde3

SHA512
793668aea92148ba84aa417d8c3d58ac2bb602378e658e2f0edbe44f9cbc2e637a17160554ec9ec9e5f03e43de708a3d64c4f98f0051caea51d437560e353fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
fbaa4686084376d38b25bcbacc2bf3cb

SHA1
eee64c22abf9e69ae0a4d4577f29d179ac3431e3

SHA256
eddac05718a7737a076095a3d5b0fb6797185107b7e5f091819c80cea810564c

SHA512
43f010cba36378f9d22054edeb1bc8b0de93ea9ee1afcd7a0e4c6b220aa0a24e126dc1ccb378d3f3fd4705a38abca97cd9b9d3f219ae006f0444a976428a3351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ba804ff12047e04722e1af38a6e48b9d

SHA1
433719dfe587f1069f30fbe82e8a3dc6824d5db4

SHA256
421b51cf8590b4a7422fff3ac3afdf6cb7951f52497cf1c8ed5787cca7864e40

SHA512
bf9c52d38055bb59ff4f653a47a678ec0ba6e2ccdc953f3ec5e9ff2f0c90f8bb01c762bfd3fe68363bd38802536558d15225f4da1bcfc8a0710277522b86678c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f23f.TMP

Filesize
371B

MD5
7fdab925df35e0e6d38b048220d10f1e

SHA1
2201b37c26d96d40110174089a0eca89ac66ee4e

SHA256
206c3203c8fc21034b8f414903fdb461c541962c00d5b0dff1fff842439dc450

SHA512
aa2510b2c220864cbdac9935f9ac290ff70763f8b8ad3f8709729a8624242942cecaa2062c40690ebb3a78a926388855ab607290262f10d9ac188871651b8c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c7c3734dbbdb13cda5423662075cdeb0

SHA1
e9aa4c9137cb559e1a83598de707613b760e4a7c

SHA256
48b1f5af5e4ed612e8cf3741c54729558fbb0e284ebb9b4f5a27b4c229ee8f14

SHA512
bf1a5604ee1a6d64d122a7c068ce06e470805d66dba737886e941823fae7a90a9b930c3351fd3c194d5959f17a8fcd10608deb59a4fc5143df79dad5e5eb8702

Download Submit