7b229b284e726a270320fb5671765b147cc698a0b2fa9f2dbb1f84fbcdb49942

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc194a2b502e42b68b058bbd401b723b_JaffaCakes118.html
Size 58KB
Sample241209-3115xa1mfl
SHA256 7b229b284e726a270320fb5671765b147cc698a0b2fa9f2dbb1f84fbcdb49942
MD5 dc194a2b502e42b68b058bbd401b723b
SHA1 d7bb1751a8433eeec9232ec50ea3aa0b63f14a34
SHA512 21f13f394e816180f2ab8ad84a9c09fca933e99dcd2adea3065ce3d5c92150f7614fed2ee61eb1e2fcaa5cf518ce1186c9146c73de681c2e61f863eaa6690172
SSDEEP 1536:Hswgr8VSeO3x7WFPvOi/tLaS6cgRrhFtCaYG:KeO3x7gOetynFtCaYG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
3296	msedge.exe
3296	msedge.exe
3664	identity_helper.exe
3664	identity_helper.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4152	3296	msedge.exe	82
PID 3296 wrote to memory of 4152	3296	msedge.exe	82
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1700	3296	msedge.exe	84
PID 3296 wrote to memory of 1700	3296	msedge.exe	84
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\dc194a2b502e42b68b058bbd401b723b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2046f8,0x7ffa5c204708,0x7ffa5c204718
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:6088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 71KB
SHA256 726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b
MD5 da52e38c98b0f2047abeb07609608ab5
SHA1 da1210caff36df73e49a0c271ff7d573c2d20d02
SHA512 35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b
SSDEEP 1536:ntQRw6S6yzj9mN0hBcdYzdFONVzN7pPMJhJLY3T+2z9ANKokoV:ntQRw9BX9i0hBqSFuFp05LY3K25ANKo3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 61KB
SHA256 ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6
MD5 468446a7240461af44b59ebb2047c231
SHA1 47b7c525dc91bece99df0c414960b9490b986ba8
SHA512 ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8
SSDEEP 1536:8b3HAMT093crXTgJRNAZYBmuhSeIUQUYaoxMaagTEwL:G+WXTy8u0eiaoWJggwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 35KB
SHA256 efdcf4b39ba18c96804ff82a6ee1533cb789958de5a533a261d2d078bee4a1a8
MD5 aeeedfb5c652fe157e093e3bf5bbdd10
SHA1 549e91287fd28e50fc3a13c4d32188609404e173
SHA512 a277464695732e7ae94df557c9eefa1544df9ec233786ba83386f52021995848d24f255ff49920e50e403d9e3400fba28e69be6f4d8b631473a99647162a8693
SSDEEP 768:VgNHeSPq+SpHHGZtvJdKixaOO2oUFWsy6IOxp8reP43mcxUi:svC+Spny7xXoUFuO/TE8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 23KB
SHA256 b60890e621ee1f1885e164572c092e6dfcaca3d7c7e2b6cbf65b5acbfeb6a998
MD5 1ff53dae34c4555156d935d6455b5e8e
SHA1 7b0d480ae156810635d33de2750d7de405c41c62
SHA512 103de10e245e4eeddd8611d30f62a74b16b364b5aa90c866c1d239649363e42cce013d83520b7e3fe2c17ca709421168f78736477e124dfa841dc021f512bd1f
SSDEEP 384:3ZHeuBAYC60CroMGQJqiMFQFosFCxcJlDbs7BFjzXQ9OThAmks:3ZbAL60bMGbQFos8OJlnm3nXqO1J
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 52KB
SHA256 6361410ddce0fe1600ec899648c8f731095850ce6f6a49c08b1558016308dc1c
MD5 15cd09b43a09f2b52c56d9b83ec576c9
SHA1 c85a6ec788bf291348cd2c89eef346b68c12d38b
SHA512 a00c2e1ad5ef5a52ea75804b3226873a9ee20506c475b0ee07d8415561ad19839b4dec31485dc804e514dab5e0c79a8b15df659dec0263699efa0533d9d31016
SSDEEP 1536:VPAvqgad5UYRsQybo/AiNTcUP7upuHOCn:VPAigivG0/bVjyALn
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 690b31080dab6ad1f34029e0b2a93a7fffa03adad6f54f7046071fc04f77ed5a
MD5 6fd95c6dc537a29cd2ec16ddd181d30e
SHA1 833a0f183cdad0d5cc699bb187381189ad67f8e9
SHA512 ba06d1d56875dc033411f0296a60a753e2326a36aa60a07cae1df471e74cc37e7591db78c565bc14be7568958b1c5255a3300b19c3692235c3468cbbe59a953e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 0a34e6da8aee79ea20fe45fbbcb08d1d2e43e752c6c2956921d2724d82ec700a
MD5 614408f7b60b473d6348dca22cd66e92
SHA1 a2c89e2659d9bd7c8ab47dc62a491158ff5f46fd
SHA512 5605ba004b2297f90f165776bae74954d3c70714598dc11685c2e6f5df5110405926757de42f15ed59c4e9c71fac32ab6f6ed8697011390990ded3b260d56910
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9c05ee3cb79c94f5aea89ac82f1ebd502fe73987cc5d0e9c0241b6b7b9cfaa98
MD5 d1b699e64cca2d8a629d753869eeff37
SHA1 633bd398bbabecdf427b147e16280e1a1f596ce1
SHA512 9fe950301364fc820bd2fe64170a2298772e18c602a1f35e2bfa397923ce735a383d7fa4cfa669cde0bd9e7a5b7f3898645b093b027fad170567ead4133df3b9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1018B
SHA256 bb8f8cd346e142bfc5767e867cc5ab650fc3a38f764f5d7d84b3b92dba2bed3f
MD5 f78cdf9415994bcbb76cf6437b70fd36
SHA1 1342a3ac86dd5c0155e031ed78c6effc12c446ce
SHA512 2ca3d0f25b942e451c22f3279fe66fa60a9664c805c0eca83bc937dad5c4a3db77ee2f4a5f9ec9027302a79c9ba56b39931d3c8dac3e4558be803fccb00b3a8f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f4179029a5f668503c49a1716cb4afa1a235bd251dfbba12b78813398b1bb6dd
MD5 b89679a0aa4c81b43629ef12d43afb17
SHA1 612185d1aae4a7051a796e1487d870f383a7459d
SHA512 7ec4346e19e1578dd34312d61ffc906c9fe16bca85946e045f05582a99cf11b9db3240413474b6b60b5f997509d0dfe76a7cadfb1a33093eef43fff43aad8540
SSDEEP 96:nvkYN1EEaSwpvWMoiVmdeA6O7t9Bj6XQUWQyV+VD7AiEwb:nvkE2EBGWMw6O7t9BFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ec405ee208923b822bc6b256e2507a16d3fea0ccac6e828f6d4d364231bab7b0
MD5 6339863e13f7a7646085b2dae06d7f34
SHA1 0a5c6b091b8a1eb9de1f588d51458ebdb665c276
SHA512 c0d7a1b1c9764002d05992db0ef292030c4497707eb7e4a0871105d0d7b7757fce114a4a4d39672b8fe526838de572a8c9b5d1fe5408d4515f17140e25379784
SSDEEP 96:nvkgN1EHQaSwpvWMoiVmdeHBjsQUWQyV+VDCziEwb:nvkc2wBGWMXBJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a980ec59fde0398d2402555f7d7005678d2544e1dc83dd7aa0eda4e100749cf8
MD5 8a3fec02aa4de02a95e2a8a11ec49569
SHA1 dfac1dbd6d652bad6030b01f37615d7cb7163817
SHA512 04550613cac22dff077d1f47f58308f17a93e168a7c2695efcc8c2bc26ddef9af45c43d5c95afa11fce5635b47a14ae16a75fa08fb09e0529f67de6b468e251d
SSDEEP 96:nvk6N1EHQaSwpvWMoiVmdeAatxL2BjsQUWQyV+VD7AiEwb:nvk62wBGWMwatxL2BJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fe49255a8d1c2e70a3890db7789ba801cf6ca65458c9af8329ed80c8f1f15691
MD5 8ddb3ef72a219e4ea5b3199b549885dd
SHA1 d8cee82192818679efeac94d58addba8c5ab6d10
SHA512 e52e7a3eef3ee56c5216a9b29ebda93766296bf5b336bfc159dcc59fd5d7927e8ce9263216d4c1c75e77caf7954aea1f6491a472eed831ed03d327ecbb400fd7
SSDEEP 96:nvkSN1EHQaSwpvWMoiVmdeAatxL2BjsQUWQyV+VDCAiEwb:nvki2wBGWMwatxL2BJrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 a7d51a993e1519563c3fcc7e2129b181131873d6789afc8856df62acaacd43cf
MD5 77722a8aae30533ca211083673de1bcb
SHA1 10922e914e4f4882c64e9f5731038ba8edb606f0
SHA512 7dca886f9109b5899e0274e72b3d96cf44be253df40bd379223d0c862148f61fe1076b068c5d804868848e68ae36f96a83cf904044663b9950e3b3e94b8f8cbb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 9d9dd9f08f317adaa60f365730528bc516deccd976c93181e0318e2bc262d742
MD5 15cce0f6160a7791d5447a6eb2a5f063
SHA1 21e15fecba5d0ce1c69370830be79d69b0e680f0
SHA512 95e0fea34809da8413239a55cbeeae5efb128d4657f77beebc649993475c6e0b82551441f7a9b73d1532435985712dbf9189a99da0654dff4315a31bf1733420
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58752b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58752b.TMP
Size 203B
SHA256 76ea8b1caf9cc0872fdbc65e716e0c21fed08e7c2de667170b22bcbcb68c3812
MD5 11ecd0bff018819572e5b7bbd207d3c3
SHA1 ec76c072bc3f632cfe9956f68dceb83e73412fdf
SHA512 b4bec24501ee44b185af4ca0181064e77a7dc149360a0b7e1ed5e159d8b45b75634bcdf2f68ec0f697e9e41a18a9a58ed65bd7bbdd1ac9e8086db663812687d0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8b238cb747bde1d0b573d355219142fc8477540bf219b73915d1a25f6093d92f
MD5 808464f68d6653e5cede65f8a8b97ef9
SHA1 7579638bb877297d195ff293400668ba8766aab8
SHA512 9c3c3f1da437a523a1d244b3eaa68f08db0f005c6c99777910e4ea83052414941a57a87a34de6ceddbbce67ceb2bb4d5f28fcb731313e03ec0f86202d6fedc1d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKe2RUGch3YdF980JQwUHZe:A9iIxuERzA83h09RZxYEc3Yi0YNu
MD5 SHA1 SHA512 SSDEEP

Submit Download