079766fbe288e0d0bd9ffd22cb213ab4af7d17a8b8496f762cfb389d40c50822

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_cd7596b6e046ecf107780c555ce310ae.html
Size

69KB
MD5

cd7596b6e046ecf107780c555ce310ae
SHA1

d50a31481f6d044b78fb5e8396928013f6d4cf6b
SHA256

079766fbe288e0d0bd9ffd22cb213ab4af7d17a8b8496f762cfb389d40c50822
SHA512

e5c103f526f2973a66682061c0bdcd4a3c6649b0baf3e78bc69ccac01519538a6ec1d81700f70c24df7298fa87a658ad1eeef71717d78865a44aa760ba79e7ed
SSDEEP

1536:E1wgr8VkeO3/4h5ynsxIKCJJsgQfAaS6cgRr9pZIo:qeO3/4h5ynsxYJVQfJrpZIo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
5088	msedge.exe
5088	msedge.exe
3076	identity_helper.exe
3076	identity_helper.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3100	5088	msedge.exe	82
PID 5088 wrote to memory of 3100	5088	msedge.exe	82
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 3064	5088	msedge.exe	83
PID 5088 wrote to memory of 2528	5088	msedge.exe	84
PID 5088 wrote to memory of 2528	5088	msedge.exe	84
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85
PID 5088 wrote to memory of 3228	5088	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd7596b6e046ecf107780c555ce310ae.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0c6c46f8,0x7ffd0c6c4708,0x7ffd0c6c4718
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9759410939228928330,4349144623018122053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
23KB

MD5
4d0a129f673aa918c6b36f0c6a1b54b3

SHA1
1b5998db0684830f7dd9ca9195ed9b67ae41ae69

SHA256
bcf5af55430e185909efe68a77f35249153e4379b6cb3b5a047b1cd221ae48e9

SHA512
81170ee7b82a75d85ad9df8226d5d9f6f88b8ddc4ddbf4e0c732ee9ba0a49ffa687cc42a91d91b5fd4bb39cebbfe0711f84b0b790457fdef5e9e72b5a2cf04c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
52KB

MD5
f9ad6fffe23fad04422671cf2fa4a661

SHA1
b8366163961f1689411636988a73dbc16d13ff3c

SHA256
f0ca592df98944df58f4c281890809d30fd2117e471b8021ff138314efef5dab

SHA512
e9d95f4f0eeed04413a1d798161d1c20d876f5ea4440c13e9fa356a562e931f98d84b3f6a907d6541cf6bbbd7e84f0e106b48fe2f5fcce77d66f70e114834aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
23KB

MD5
4bf45c37b6fccfe308533e93d46244f1

SHA1
a88ddc0ad11510ff86de30b94dbb63cbdb506d81

SHA256
fe0c5130e81cfd078437cc38fd73d94d4207b47b6ae74d4a16e1dd8281e2a287

SHA512
9620421eebd8496cf4d8feb35d82b3ee016e1908e483e74388442aac179336a4df28806d252f26338988f301a8906db97d1ce190cabc1f6849c30e3e8ae9e6a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
708fe733cccb8d86899606bc03041c30

SHA1
1d05c7ae1609369721a6e442c1a99011416ecfb3

SHA256
878bb155010af1b39802a3ae38b2aeb2099ccbe185aa081e66b04223c0fe20ef

SHA512
bb47885e542365c22c6c7bf39199887c655dfa40da03327fab4fc467ee83d82eced84686c9e5e8584734dd381e181c106e11771b0a2a4f5ffabd1e4eae7f83a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
94edc45bfd4be85b7f87c34fe1c1d025

SHA1
a0755ea3ae9883da656abbae6deea8bc9790823d

SHA256
b43a51ad6ebd87bd0d6554d581708bbc64b27679400211a53a94220e3e817316

SHA512
21e0e58ca7ba3d24eb10d8cbe662aa66646de085a29f2705d679d2dc9db8950acbe0a3996f5faa144da87894bd0d5ddac94282489ee91a67a2fb7a9d13cba96a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
44d47582c36aa57faf7114a5e0a985b0

SHA1
b1e808ef82308190679d6a1b0de279054536dd2f

SHA256
b708948a87569d7cfb55e29aca3de6a33d466c73a1a1e24a775c9e10cfc86c3e

SHA512
3f364aed7dbeae04666870396d55a650e30e2338f151e54c59dfeadd7233c0a7c82b66ca90badc558498013537e3244857dda3dd216b30ca066628b3527e3b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
818B

MD5
5ad24552eef18e054eb63f59a0c6ff71

SHA1
8f2bdbe070726a2a7a86c72297e47199c7f5ad86

SHA256
f5b1db9bdd5c05b4c86dc2cfa0f03ddabff938d903f14a1821e6b78a4be5df62

SHA512
ca71760b8e1c61b193d2d2761d0b9f689d7d147c4c555f6d6ebd37c07541fb1c37f061f238fb8b60890d2ad0d6832081e2b36a4c1a7d60743ec384246c17db52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5eb8309684425293fca1a8a9624ed3cb

SHA1
ddc18fb6ce5dc7582b9abf0c84186c225b06e65a

SHA256
a6bd9a59dcd24b13b6b1fc518eba826619a2ae205bc72788a60c221ca5ffcfe0

SHA512
c109f892d84b8917cf558158f54bcf793186763aa521f34147cf84e9c6dae74b5c31300b2f5fc8edbca4ff058c961193835751d00647a2170e70ae3409613c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
698cac7f8c76bc49054a35bf0fc759e6

SHA1
6ba4a39fc6a5dca934d37d23feca204a6cee0401

SHA256
07752b3b650b324d79d14d4970c0d263d44a52a7ba98ba22714a20a4124b7379

SHA512
0e4a2ef3c5eacc9c11f6ec0aa61f103f0965b0c472d2a91cb5f171e9d56337cb1a2c67e6ee67d631ad838d7ca23ae2a3eb16527efdbcd52442eb60396c233a5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bcb4bfc4d5ce6365b03ced738ff0ef72

SHA1
57f6c067581661941d9821a93de9f868f1276c55

SHA256
b311313b1327f29ce9eae02dab434f2741090cdc139ee6a2402985dbb4616a8b

SHA512
648c21c696fbb65634accf4a93ed9b64b66efe05457b75b1a93307947aba0056ccd2d69b3affbb12290487e92c31418707ad9559ca730baf823b30f8e2e88447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58eec6aecde8e781556ca402829201df

SHA1
ac12e02a3e0aefbc8ceb85cc3ce2317e6ae74995

SHA256
ede1038e0359973be203fb4f8d1bf54f85296f36bb8c78b26dc7761b0ec36a5f

SHA512
84aad57adbd81569fdd15e09afbda8bc37f626bc40dbcee454b78bb4f1811c8e781a8a02b38a28cbcab11a1f0d2a57ed467dc701b974423da6b106371909afb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
112aa355995a780231e7327d0571a5ad

SHA1
ce33bc7fd14a63c4d7e5b4e6bd91de794f567f33

SHA256
4e4a8e5ac95b29d1795051c998531e9bca1aeab02e490a0f0b0a54088334eeb2

SHA512
b1a097b96c80f7fad6b670310076921f00d8e02e7456661236316cfa0280e690d60b5e3e82a5a22f2d56f164145a1d6890a05f1f14fef4ce30e7f89ec22dfbc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
b473730430009e7d49046236fc09ff8f

SHA1
62e9c6b1236756b5e5a8f4cd415cf66da50cf8d5

SHA256
f3e8092e35e14f93f48495d8ca3eca95fa296a2b001b80c3de541171f3e5c272

SHA512
ec30c84c52fda11c02607a9c4dc812a309aac47596d68ca4fb458b70e26ff8d9d17e3e9e7b7537fb5ae3c76dae1cfbe1f1de7f38394014477a7ad23c7887608f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588a69.TMP

Filesize
203B

MD5
a04f6336e2aaffdb6d3f6584a650fe51

SHA1
763a2d03972155f9fde14a60da7d7aec997d7eab

SHA256
d5bce82980771bd46426b1baeef5bf609e2928ec6080b77ebae7693ce60a024c

SHA512
0eb02c96390b26234e7664d2af84ff9725070f0ff47a7735121acaa2ebc958ef96ce4db9b2404b2f18634017decbb3905171647e48dc70f45512b8505ec327cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b43d54ccb4ff6cde81f429c5518a7ca8

SHA1
9f0888e7b47149ef2b3256c8c2e9130bb4515cc7

SHA256
1dd1a5b12de8b009a3335e48e27c07a0d71a4575b068bbd6434c47a531cc8a89

SHA512
4e2bc681ea291ef8cacf7a26532b23aebccc787fb40c1117275b30ac061eeb44282bbe6c1332664cea0ea814a5b783c328ab864df1377cc3c6625d50f69f36b6

Download Submit