6a8d7fc518982fc77d45524d952eca72c4a244d06e5eb8faace426daea5baec4

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed505301b8905fbde63c6390a7bfc988_JaffaCakes118.html
Size

135KB
MD5

ed505301b8905fbde63c6390a7bfc988
SHA1

ef2e14c4d311177efaae8b30210d61c6cc9ac360
SHA256

6a8d7fc518982fc77d45524d952eca72c4a244d06e5eb8faace426daea5baec4
SHA512

a426670404cceed93231750d5afcdfb2f9730bb38c897df811892e64a0cbca0402ab5adbd1bf89e622fefc976cb6f000005c2eb2981c3f410616f6de252188dc
SSDEEP

3072:edY8Njz2S81Ep2avb2oH9FNa+lkeDkwlXJ2l/esRDyh42bC1IG:n8RooPpUgy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
4760	msedge.exe
4760	msedge.exe
1916	identity_helper.exe
1916	identity_helper.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4500	4760	msedge.exe	82
PID 4760 wrote to memory of 4500	4760	msedge.exe	82
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3232	4760	msedge.exe	83
PID 4760 wrote to memory of 3920	4760	msedge.exe	84
PID 4760 wrote to memory of 3920	4760	msedge.exe	84
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85
PID 4760 wrote to memory of 1072	4760	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ed505301b8905fbde63c6390a7bfc988_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa380546f8,0x7ffa38054708,0x7ffa38054718
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x4b4
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
41KB

MD5
1da8deabd421929fa1a865599f43aad8

SHA1
88af7573c39022643333f85b523a329cb6448675

SHA256
07b01330c36ae322ea1f1e2ea70e60b629b292b3f7ee7aae5a9968dcf341e685

SHA512
0be3f8d02397c3cc32164b116c807115c42a310fd70c72c94b3b523732422ea2b222d8762e81d91ef0c36a8328df4f7ae8e4570c4bc46ab94cbed5131389ea3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a2db36881fc9ad8d682d9a64c359defe

SHA1
e7739e5b4a6e2709a82259416bb1cfea11901ee2

SHA256
f056825f7713404fc1313de9d051fd71163fa96334ef3c928103081f681602db

SHA512
feb38e2a2e3e188d9480e4aa397e4629152a466fcba1258a91855bc8711123e1e62d06b2b9383af387f85abc8df24423991f4252edf47d723875772428b244ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
910b975a95b66e5719af044a99569d40

SHA1
3dd87ee4769e1acaafdd157a96d89334711c3771

SHA256
f5ad9833cdef3c6b2bb57f12b2068703cc034d415b5ea1978cb8a248e0b4ef3c

SHA512
a80e3998c7a2525ba2994582e4c36093560afc463c55729c17453710c9c97615ea786f2a7284b5f41468f9328cf8b8b7339c7925fbd5574cb28e36fed3a6da4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b543eb7fde132947226c3daa57c0ec47

SHA1
d1ba3439939e37928707b5232ea54607b7781acc

SHA256
359a913914ad1f7dd8c61eadc40c34f99bbfae025816d78c48e5f852e4efd111

SHA512
b85e4caa0a7d4cf87a871e1c690f813a607502f8990b032d93b11801074c370177adbae5dfa3924565b1351b5cb1bbd34c5f424c3afc30e84cd9638e1c5f0e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8ba93be5bf115c8735b325fd8445dbd9

SHA1
824191123d334e2091d7276ddbb9d1201bfa49fc

SHA256
b19794ff2999fe505bc71cb0e4838e23eac95a39736b18085849e9a362da33e9

SHA512
1d3d4660169a663be251e5ec6cf8d122825a559b70a09e1fc0f51feb3b7a9b81b9e33e5d4afeb2dda0e4aed5dab332845c5c174920704963578f2e6929e185ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
699e55f9883f462df81306f720b700e8

SHA1
bd0d662991ec9cf30e5e497c115c0b316ca44a07

SHA256
21e53d3dada68e4d1fcc8f4dcd51d88cdcf832b3714474e8f62a1d6d815af0b5

SHA512
9ec10a74e82c032a29f1e264122454f150cdb949f9eabc9d5b5a5475abbd86063930f349371e74ebeb68a9370efde9ca5d943ab7e815be1ade3247678a2e94f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
631dba93b87e18394df80c2bce768034

SHA1
ea7f88d3b1dac706c033c1c46d5147892739743b

SHA256
129ca4727594403ca376ea78cfdb222fbf1520a4e7ae206a496a3fae222dd2e6

SHA512
248a8cb67f345302a346decd37105c4964add718d086195ba938f98c5c22041a228e97bc4e3532ff15ffd640aa0512dca5605b7ad9067ede76ddc7fb82b4b3a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
00be650237b3b6b7bb0fdfa5574eb971

SHA1
e62a83ef077b3d33e4c02cf3b503858aabfca13a

SHA256
7e235414e04da34f24d8520abc26384ab6bbca75504e82329868670431d87c7f

SHA512
f8371f40dbbcce2232b2c4efb70e22c8c36977de7f9ad84d470b139edb92ecfd648bc7ee117c776705f0c04d5bb607e3f097601dba7280ebec15aca03ae16b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
daf4456bbd3a332cb0b55cfd9101047b

SHA1
4e9094bacf82497d40c3310110d123589390707a

SHA256
8f3c3cc370ea1ca71329eee7b24aaf1f6391f6055d35fae01c437777d27a9571

SHA512
2ceba26ececbb4c98e76b26e5e656020d5903bbaf0e76aa4c7474be47ef6648c43ad156816e1a6de57c2d7ceb546b8e81599f7c8c9f57c26ee55842d15ecaf88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d7681d32884fb505bb30f05c239db621

SHA1
1daeef0ef2bb676488fefaed1c7c6423e96e16e0

SHA256
20c4eeb04572a2895fe26f6663f8da8469463af336dc795a6dbe62837c8b597e

SHA512
cf9560faaea4625c0b86ccbb5e51ce7aa600580b52429bda75dbf3c1ce17884390414b308e0aeac529f7028b4acd1f2fc79ed5189468e9a166b1de05106af573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
918f218da8b9beb733beacbcd67245cd

SHA1
355cd81addddc986f72b4e8d738005a51f932021

SHA256
352009a5f98e48b3f7a7e139be24a30b4339b61d80bb477ca4752d561ed1ee42

SHA512
1c4db75def933b16b1d2a9211f0038b362b549a76c7f79a15950845e4b71c972cad84524ba526cfda12e309f8c1659a313d9c52e2861cc65d870269aa9b916d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582a76.TMP

Filesize
203B

MD5
cb57ac384323b0254fd6f8b653d24f3d

SHA1
959a1a786a7a350cf11e23392c4050b544fe7a24

SHA256
9a8bd09fe4ee43e64beba45ce18cfee25096607fcf0db118662cc2d812b75868

SHA512
7643190b8bee6ce1019ad3e4f2ffc37a0c60a38782d3d858328b5bd2c6a1c876e2fa8fdbd31e5fad543bee2cc2bcd4b6af7a7185c6a48f946e4b8fd20042327a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8c0a6361961fe94578e6cd7662358b1e

SHA1
4d01dca8179c5cad1af6ab806bf653928f64cfee

SHA256
c0f4efad15bdcfde45e9740c3f7776976258dd68f833d70130975411209bd214

SHA512
e90704ea18b1577bb08eb5f24c84d67e897d9a37f2a54601ba901afa350614e32b8693b7e9c59189e00491e13e66dc066be9a1d03d70e742d2a5f156fc5246e5

Download Submit