bc6e40cf14b9209e90a767d439f6aa063ebcaf3e10acaca2117d16e9445be590

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f80f22698f276ffb5413e8714cc7319_JaffaCakes118.html
Size

172KB
MD5

7f80f22698f276ffb5413e8714cc7319
SHA1

d40cc0af88f27dcde0fc4f19087e1cd8d7b8c433
SHA256

bc6e40cf14b9209e90a767d439f6aa063ebcaf3e10acaca2117d16e9445be590
SHA512

b74e493cc95cfccc08b80c35f19a232bd50823f4597bb8d867c34d9aca09b2cef5362dab3ef45706456a15e8e595407f0739f20b797db33d668748b8962a1c9b
SSDEEP

3072:14q0gOS+cO9nKE6uodjhMF4+iIPziEdF+48EnBG1mxq7seV/6mG0sJ80V9o5xm8j:14tgDC9nKE2+N4wIJ6HYrfLwZ81

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
98	sites.google.com
136	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3880	msedge.exe
3880	msedge.exe
5732	identity_helper.exe
5732	identity_helper.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1416	3880	msedge.exe	84
PID 3880 wrote to memory of 1416	3880	msedge.exe	84
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 2008	3880	msedge.exe	85
PID 3880 wrote to memory of 3276	3880	msedge.exe	86
PID 3880 wrote to memory of 3276	3880	msedge.exe	86
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7f80f22698f276ffb5413e8714cc7319_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa586746f8,0x7ffa58674708,0x7ffa58674718
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8112 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6188609702102096248,14676029877475319720,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
45102c3b5138a0c604f5b7a6f1cf3323

SHA1
0fa09d26a7ea9a57a243b7bc9f40eac87bb86fa3

SHA256
aabb2742e5bf41caf5f80ef778dfeacd79fadf90497c936cd46c60b4831178db

SHA512
2bf1c8b21279bb8e13a3b34f74445b98fa602b5cc45e9317d66d031132b33f2f0d35a15ce57ea94a6ef3d7c157cf9d0a44800349d1607bb67f8fdfc69ead7f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
84036d041f504ccf5386c75d73ac9a8d

SHA1
c74afa1d427b9a8fd036765f331d2a4739d9e169

SHA256
8c5e52695187fe1fc4a07f11f913259df097912f83c2f0bd1fafcca7e9c2b37f

SHA512
ec2cc878ac3281582b4afbf4f4a2339330c441c3404c7c76b12cb03e63cc111fa09795c835bb72c3bca647162b8359b7ec5ad652f75b94891bb4df8959a2679e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
76bb3c3b461d9379e70c01907868fa8e

SHA1
777e563d57b89f1094f74c0890e25f5ffc6d6066

SHA256
aad2ec46750c7f174ae70e13c0bfc5a7e3a7263cd2d32bf44304f9324fc2cf88

SHA512
3cc5b30c4489b5bae0868999a9fc2ac74bad71617c4fe28f709e755580d7c14f9f6a72de054137e826b889d4331f35ebeabdc30026b3e526c8ea5ba5ab1ede26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e910602e354909d217ed2376ead122d

SHA1
35a1e27f3d8facdc5882df9252a33237d2a28b26

SHA256
bc8e4a276ffb152ab9311d1194d8e0a0f451df5170432f073d2c57f87a2f3980

SHA512
af1e116e89192bc59d4e0b803471ebee32a202549625510213fe254d1952c7deb0b7a8e85b2041ad3c42710326ead083e8b507610c476b9b869fa0c1684ddc68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bd6939553ad7a1f4bbca1e40235f9189

SHA1
c098246e9e53643a9b9c9645ac22f24fad0e4b9b

SHA256
9ca025e0d3eb56affa9487371ba550430d964e43430ee015c76abb567971fa37

SHA512
6871278480fd5548f5b619ca0e8f552b027c1c7c9a4dc8979c62f2554943063cf8fa4bdd77b761fb8599d79664716ebe0c3a06994a85da2f3c82f83b2f1cdb4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f531715060b616187e96175e6d85d6ac

SHA1
dc85e78469b76f5ed4bc432221a8fb8bfb48dc5d

SHA256
6f8cc3ed932cf681eaab8975f3b4c0bb3de8d913dfbcf292643c93cd407e23e4

SHA512
ca2de1b8631d03cb9118f6ad292c10474e0ab251f55cee69b06d4b119926e0d07c72d04ca76d1918969fd47046f47a5aadb31321ccae145a1434e5116dc98d7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c44fb04aa730c7d66f174e3ca22a051

SHA1
5eec0989c38bb87227c47ffcf31541db419ff20e

SHA256
471aa43e4e14adfe98c09cfe2d8480fc5a9b7ea620a70d60c1dce34354ebf08d

SHA512
e91d0a34a7ac18710883559fafc104a833ee644e10db4836a611ef8cb0f8ea800ad25ad5a7c7efac68c1bdd24980cb58a97199c2ceb6e70361b477295466697c

Download Submit