a2835ac039c3c94270ebd95f8f228658c2618f5361eb93010d798acd5022fbf2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a3d2bbbb7a682ec3477db1dedfc1b8_JaffaCakes118.html
Size

121KB
MD5

f9a3d2bbbb7a682ec3477db1dedfc1b8
SHA1

1c5cb06d4488bed1a136260289daf3256cc33be3
SHA256

a2835ac039c3c94270ebd95f8f228658c2618f5361eb93010d798acd5022fbf2
SHA512

6e9d0f4b2bb1507772cb14bb03528a78d4086deb2cb62d26baa0feed7d1deb3427f2b6656bfa383d046009919904d19d7219f93c1f58f8efc349ac18d10f01fd
SSDEEP

3072:w78Njz2S81Ep2sxbQFY21yyVleByTPBXJ27/P7UHeaA2lM1pd:W8Ri1VkL/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
2764	msedge.exe
2764	msedge.exe
1572	identity_helper.exe
1572	identity_helper.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 4384	2764	msedge.exe	83
PID 2764 wrote to memory of 4384	2764	msedge.exe	83
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 4708	2764	msedge.exe	84
PID 2764 wrote to memory of 1940	2764	msedge.exe	85
PID 2764 wrote to memory of 1940	2764	msedge.exe	85
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f9a3d2bbbb7a682ec3477db1dedfc1b8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:772

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ac 0x524
1⤵
PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\03a0dbfd-7fb4-4243-aa09-aff4d3cdebc4.tmp

Filesize
1KB

MD5
300c18970935aabc2766f731344efc9a

SHA1
672599e880c7777ab62c645825b5c54e936f65fa

SHA256
7fe5c97eae527540590227a005bd46ed5bc8402aae62427d27201faf76e68064

SHA512
b9cede7ecddd95cbd0fbf1064d18d995a15305d8827b07e10750a4ba28223c6a2e1d5e6df7acc1e0c23188ce43571e8fd731db295cdd2c6e7f439ffa888de380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
2ebfdbd309ee762211b4a2ac39708c4d

SHA1
b002922c672dbe1dd4caa02af24d0b1e7da616af

SHA256
54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797

SHA512
d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
49KB

MD5
7ca090d5f0c1a9e7d42edb60ad4ec5e8

SHA1
7278dcacb472ec8a27af7fbc6f8212b21e191042

SHA256
4039fef5575ba88350a109b2c8d9aa107f583acb6cbe2ac8e609071567c4cc76

SHA512
c4f2d23eacf74f87de8dea6e4532b120253bb9ad356341532f5e1aaf2ce90d137f46b50df7de5250bce4eca1fbfb74da088accd7c626fa853dc524abad7bfe8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
23KB

MD5
facee74c789253ce2d2a63c6d49aeb94

SHA1
79b895ffb82ba8363f8a67f8380cd6f32a5fb907

SHA256
804c9c6d6384db9e246de900d22b3f4d79a7265bf42ba72513d3a060302b3f10

SHA512
4a1078ed20af2a83f3a3f1893f4f1e6c5f94f8608ad85c50ae232aff6b8eb931167c082ce80dc51da4f116e4cff970571b2d51234f9777ead0d5b9a5de4fa8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
b18fc60d3ba5ffd9a6c4d70cc0a1e7ba

SHA1
b08e97268a5705f08bc92ce8ee165b852c820515

SHA256
fb50bbdc28b13716946abb80028ab8565a8c6fa3b0cedc1b78677386eab17d7e

SHA512
c00b65139c0377012f79b021e48fc88ab2297b639310011278903b20bac42ba5b8e46776c8ddacb6db7a0a8517a933097050757cb49711e119f95b1fe236b198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
9c68337799db8e068e9ddffefa241f5d

SHA1
eb15a1a7ac64e51ab0ad429dc09fcafb0d7c40b6

SHA256
03ec7a82ecc0caed532c40131b5baae6b83afe27a16680b2e0c215bd22fc16fc

SHA512
a3f5e3b22f93daa3838e4ace9c449f0cda5854437b704839841c74592170dc77ba657b5e443d35f9f7e5b94622299ccbed7bc5830b577345ff498ecc5b4f7599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
2091bfb124e86a39302a4fe321d2aa11

SHA1
801db57d61d9d259c16e7214bafcfc329d3fadca

SHA256
f5ebaa95bec11ab0dbdb9ac4b637d7286332814a592d43703c571464262b07a6

SHA512
f89d81ba5a5c495c08b70f88950bae791ef925ece58ddca758aacc7e5497483c43c82f5c61cac951a11b59799a4607903eb6b92c5bd896f6b592ed12b993d47e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
53dba2e33389eb9219055bff210e371c

SHA1
880d13482f7aa8fb8765ea793d22b197bc2ca601

SHA256
494fe5b73c3a75cf84dd8dfd0b0bdfd384504a8a0ea350b2fd71ba9b112e1fac

SHA512
31bdf914c506b913d53eb9f3d2931c81fbf67aed080da72c9ee6f0257f578cf965bd42dd9d9d910e5bc877a4b773b7bb286f03e00abd9d2f30c98878cd97d06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e627c6652295b66c523a46c0b579bccb

SHA1
63207617612a0956c7cf1854978db945866fd1a0

SHA256
6e4907e8d639c255e71d07f70a0d6aee9ae0b5ce9723df6897873ca9cfbb0e76

SHA512
dc665130c42ef5d933c844950e8775bd202501c87b1acf38e4276f7d6fdd137af3e61211f750762d1001dcf76de8b937571c4830f04b6348c9943b49b9922951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
eee560b5d951295c5e2648d5f0159619

SHA1
2652fec3eaa3ea04cc9c5a938cf43fd5a9a3644a

SHA256
8a841d4ae11eea4f23499039d52970a4e5b2b5842ff7ab842cb9afc9661efde3

SHA512
f63aa2f098d68c31e20f916097e8ae2ccaf603c822d9a915524601a9f64196e04aaefb8c22c458ad0ae6dfffeb3b1ae18e41a0d40f8c857d316c4c6700cb14f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e288b41b8d06e916f57f1e08573d08bd

SHA1
2be68a94906f4c82d824532af77bf01f87959b8e

SHA256
f4a927939426e016ab2366d87fc36464b4062d89409d850d23f8918a6273df69

SHA512
37629cd79a5108e06d65bdfc1f58336f8290f32d3a4509c79f1a91b93d20e8400f32c60bc6a55027aaca0aaa799a60fa0a1b4cd2abfcc20397c530996f9f33c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5721aa1dbea5cda13213b88603c6db3d

SHA1
f39290ceb55eb71416a0b7e3a5b2cae4b78c9e27

SHA256
f3ad36aa582cb5bfca0878aba145646ced9cca6dba5ced0641de6a1dec03d460

SHA512
20079a4f5def56887656c57e0e090a9be4c3dc0533f30f6fe4fe2c153d04054aa270ef34646feaf6e6c7ea0e0e3c36fbc1ccc2d26936366cced80fe2bea45c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3da37c73971fe065561f55bc73fd901b

SHA1
a346ae27925cca084b039035066ae4130fdc352a

SHA256
913ae11c285f7f34e6685b8f4232b2a0393a8bf75f23799f36047aaa7fc5c591

SHA512
2323fd00af5691ac3c5e698234da630816ec1ffb04cbc90aac8faaf04436329dd20fb16d961d527ffee513c149e23521f26cd3a08b84f372fbc3e68b49ed817e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e81d697917ab3648902bbbd8aba0386d

SHA1
58bcf7a5204a97a77dd320d6eff0204d45148114

SHA256
8bdb20b4a5a0bf09b592735750b4981975bbbf11d65b262d7a06864efd91dc52

SHA512
1b399c94c41b3187957ce4c722f776a001df92a13288e17fc1f97cdc86200721748e4ac57f79ad9146a8b93e9631cd73a3f48f00f0d40dc617af6c04dccb6e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
339ce86a0b7dc494b91de3947fc0ed40

SHA1
f30fd4d858b5b289e78f2940c509b1289f28d6fa

SHA256
5cbd6e7d7713deb029ca5b7a45dc09fbedd108cb39b0119f309d6cce32c353a3

SHA512
fb905ad595bd808d31b2248d3005739fefd9f4d5ab63fcab637e6fb652d8872a3107f7dbc3cbee65679de789ab4ae5afb653f07956ecb7e0dbdd3df78aa2531c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583505.TMP

Filesize
371B

MD5
c16565c5e040d99269ee75a2d06f1951

SHA1
2056a6e69128e701921eab779c7ea0aebed1ae1c

SHA256
fbdce47b94fc7e2bb32b03302c4d43bbb25a89b89536fe5af585666a1313f74d

SHA512
c368868d8d4cf92b516aa5f4af432439f7daf79bc4cefe3ceb6987d50ec0d69f2efd7b98e2814a10faede3a945e021d601743bd7f527a6f19aa3b6c13e6cf177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e4de953ca25e87c49f5729da2f427863

SHA1
861e3cc908ed020f04cb0022c35f5345d2050bf9

SHA256
5855b63c80b78564ea65a538ed9502812bb5d02cf7c1d98acde5c4d2412738be

SHA512
34ba6a3938c8bad64d2dfc4528b6a11271a91b5d37ea0c1e042b1eaf3335ccbfabed213fabb5bba070fdf25b06232c3811b410d05a5ff4fe1eb998a02367ce9c

Download Submit