53fc7929246510223b3b017841a1dbdf45666e45342bc40e728cf8904e025350

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b3e435707172f7227f7e0cc676c56272.html
Size

96KB
MD5

b3e435707172f7227f7e0cc676c56272
SHA1

60b0f2311de0c435aae24d2cf595dd24e94dfdf5
SHA256

53fc7929246510223b3b017841a1dbdf45666e45342bc40e728cf8904e025350
SHA512

0246e9fedbc35cefb8cec0046cecdffa3ef4ac3db5946ae887adea2c7531c04677f739fabeda1b8d494ba15f5b94921beab4e1f2c4a4f2688d758a927e0dd18c
SSDEEP

3072:SyY8Njz2S81Ep2wvbe9FNa+l/eDkwlXJ2l/esRDyh42sN1rM:48RAp1g9

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4636	msedge.exe
4636	msedge.exe
1892	identity_helper.exe
1892	identity_helper.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3024	4636	msedge.exe	83
PID 4636 wrote to memory of 3024	4636	msedge.exe	83
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4344	4636	msedge.exe	84
PID 4636 wrote to memory of 4260	4636	msedge.exe	85
PID 4636 wrote to memory of 4260	4636	msedge.exe	85
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86
PID 4636 wrote to memory of 2284	4636	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b3e435707172f7227f7e0cc676c56272.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7dda46f8,0x7ffc7dda4708,0x7ffc7dda4718
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13112870919343761004,10514400991937833874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x494
1⤵
PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
57KB

MD5
2b5b5e31c8cae7a87bd2212d04dfb2c4

SHA1
6753096c4c808970acb4a59eace93e4f777b6792

SHA256
7fb5e0939c5fce8e0d8d1440c7f8487331ec6958675ce2562f2f68a61656b96f

SHA512
d6c739df4d749beb16d9e9ef42f3e331922ca910a9176b5709ebc2f8da929b4c9dc9996956250e79470e6073edb2a40a8e609ebb618f3e93abee0b156acd6495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
5ab6a25b5e96133b59eeae0dce1344d1

SHA1
4d4016c794cb58ab68d9ca3ca8c042d2ca67ab1d

SHA256
dc9af889eaa320aebf3945c460b6ebbf15e0f196bc3e9d85d30059a3064f92c5

SHA512
654cdf6a6ea1e257a172e7f83ead09aa4de23297320a4c229c30aa8bc451935689161fee453afb18d73d58aaa7c2abd9419f4f9c60fa3b712d16c266995ba21a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f8fff4c93484e381c332134369427686

SHA1
73af457ea1423e404c2499c159f30e322dc0ee9f

SHA256
4ca45f9e3e29ea750f83f8fc51df2261f8bc31afb718a804e7b407122c375805

SHA512
7dc8664b6ecc866e482010f1d45d2773cd7b69f1b82c78542a02cd318a2754fd01bbf191f9e87c53c2cc17d187b01f4490bfb318f23817e3ec1c08ed15aefe9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
05ea68ca20247a4fc3c7f684ceacdfa2

SHA1
9eeac3bd0a6c95f2508e2d0dcf1870e6c2c6421c

SHA256
5071b655e6d0372617bb5a3900f13f613669133273b0110677429140a6f2eb39

SHA512
9645c32554df4c344741a603a418468766cb03c44a3c721d4963d83b47f3a08d991c3fa8f212ddc043df8800987edcc4052ac1bd9501c1d0c090eb556edea495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f779c77b9e2806f4f6448fbb6d9402a

SHA1
0a3b8403162910e52e7d10a60c235f498aa64cbd

SHA256
254f7f2c23da4df23ed2cd163dcfb2aad7f46f8697eb4114a7a4ba27a124170c

SHA512
e1ceb51e6490f3870a781ef92f5d5225be5a7d2da9e256c392345625e9d5facfe408cc1df3f90340f51f1306b5542aaf53d01df45f67b2b6e66bef23019fdf21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f403953008b5aa05a14cebd07f33446b

SHA1
7dcff60c1f4b8e476d1d56fab208940a9037d7d3

SHA256
74d16f20e6efcacb698c643ba3d376ea9e53a693fd75a2d4e78368405b1906ef

SHA512
b3c4f5b47f3a134c3d132b41cf2b529b9c4c34af9cd5d7c34227fb087b11f855409b5459d21f86d96da8942556687ff4e62d58d5df9dd6c42369aa3937c726a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
467579e1e1c17e08829ad10e2379e43d

SHA1
56e727a6ce5e45055bbbd41cc1a919616881f22e

SHA256
a59f862988fbf0611b5ef0e7c8136a7c7e2b939b51667d4b334dfaadebd62839

SHA512
386accf830ad315d73fcfe6b48181319ae2849da0b252ba863b5c2dfe1943a0a44a1dfd47f635f1067d577a0215a3ab79155744f15b57df741ad9313ae112f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
adc09896b08426e3ebb790b0841b0141

SHA1
7ab633514de6c079736dc386658bded3e5f682ed

SHA256
109b467e968c0dbaa3cb197f803f6b24d819d13b6e914bf363ea0209dab208c5

SHA512
c5975da00769bb1543234d40087dda97d2c4f430ceb48bbd7bca31ac2a63199d3c5371024b3369d1e545097b5ef2ed7bbf5c4f058da35ab03d6c6be7e7f589f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
986bc6c5e5832d8fb0dd77ee284de892

SHA1
55f671628ed4956929e9946933979cfedf74f8c4

SHA256
6fc9edbb59b760aa053c7fac17234d36199c5aabb09e79eee6acc029e8b8166b

SHA512
f7e734548e66855941686ae882c397463f0e5dc8e2ae2b23e0584d0b1c3e3c76cd7304fbb31c7c269e00bab80d6e1214877ad1ef1df027aded0ae49a56229715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d210af9edca45d62eb5e40ddeaddd832

SHA1
7b00aa8c1ddabdf2df81b5462bbe849407197985

SHA256
899054cf2659d888e45980cdb62248521662218c8e61cf8826df608260492c17

SHA512
17940ca6b996394c5a035916f840daf2c2ffaa9ffc1d17300929273f1454c43f48049e2e8b7308d39e1cd2395b5368b54a32966422d3aec3c28f565bd57fcb0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
136ceb069f535a4fa5470dd089a182db

SHA1
6f41d92f353d3d21a84d7176fe482d2ba3ca429e

SHA256
0fdf9c0e83af9e281a639c39e61be55e9878ffb1c12bde0164ad57b3f1d3c36a

SHA512
7ada6d5dd30e5a3ff11cb9355f9422ff7cf7d668002ae0cc7fc9d9eeed48484b9702b703e52cdd7974e128e308c2ce3e561c9c97740ab67a3a21e6d990a5babd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585cb1.TMP

Filesize
873B

MD5
e774e2509b1fdd3067c2352c2ebf5018

SHA1
13da83c1c7bf7acf8c65eaa3ff3948f265dd4a42

SHA256
356fd0551f1c4b2545bc047f14c6a5f7b98271ae87e9e54f6a2b311d607d9728

SHA512
fd8895fffe43aee91ff8e2fd80e23a95beb0b53882263f62c290a33e9fe9685260b1c79f25a7ab090fece7f359eac00c48fa6b308c23844f26ae4ead5b7b9572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
069f70b0de2962fe54e7d9632456557a

SHA1
ad25ef1dfff9adeb73b446e6e751c2074bfae3d4

SHA256
12dbc23a3f100c629880993c39c4f61a6f83e53c1fc2e92f01555032e65e19f1

SHA512
194f5fbac3946a6702e0a312d29c59e201121de91bbd795ec2f91f1989e45199ad23290cdfe782c32c669604390b1d1dc8a6003edfa15bfddfeda39336b6a875

Download Submit