672cc9612c15ec193edac0dbdf57d2369f5a9193644860bb3f65e501a60784ce

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_29ebedd8a61ecce7b89cb6de43b66cfb.html
Size

241KB
MD5

29ebedd8a61ecce7b89cb6de43b66cfb
SHA1

f9af7a503e19ca138eaf75a7459ce422d7ca72fc
SHA256

672cc9612c15ec193edac0dbdf57d2369f5a9193644860bb3f65e501a60784ce
SHA512

d4f9e596c2391381c4ce4260fbb6d8d54bfae17d4a30f23fcf206a69b7001a62e86ac95fadfe05946c60fe3a40f18d98644083931562048ad0323574a0055b65
SSDEEP

3072:14M0gOS+cOCqPfodE0hMFY+RjXIPzpjmaLH9ZCroYna3vZSP5ZbI0ty/derD8f9m:14fgDmCqRe+xMEax9YDPngfNwZ8Y

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
63	sites.google.com
72	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
4356	msedge.exe
4356	msedge.exe
1644	identity_helper.exe
1644	identity_helper.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4480	4356	msedge.exe	83
PID 4356 wrote to memory of 4480	4356	msedge.exe	83
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3372	4356	msedge.exe	84
PID 4356 wrote to memory of 3896	4356	msedge.exe	85
PID 4356 wrote to memory of 3896	4356	msedge.exe	85
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86
PID 4356 wrote to memory of 3244	4356	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_29ebedd8a61ecce7b89cb6de43b66cfb.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0ac646f8,0x7fff0ac64708,0x7fff0ac64718
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8084 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15105519740369887498,14482694849466003232,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
a6b73b001fcd027005bc49db7eba0190

SHA1
90e9df42d6848dabd947578765a29216e9404713

SHA256
f7007f27d7b67d53a72aaeb4cffa157f126d3fbea6e876b114e9013af58ddb9f

SHA512
8879bf0a0e422595310c80ef8bc08f7cfe99d9d57ef6c6b0982c2fbf37cc8d2089c954e2f42025dd50abe9537e4b4924eb9c0116653f5e08be8fc8b277968835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3c23265edd47dd0bccfaaf204b389d15

SHA1
3d590a114103a1f6ae7235a15f1821c9e65c41ac

SHA256
7665ffb00b330ce59bbaff6f48cbac9af2cb8eb56c719a8a8170c1f417e34ace

SHA512
c25a91d35567dfd44e97a2d3922b5ccb786352f59dcd95c92ddd9fc0136ee40ed1ae6efb4993cabd28ab9d9c98e27b1a74228ee4ad333085eb37da50d8887ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
043f86f708a8acbe4361c1334241c5ee

SHA1
b4259dadc7a19c76305f17895467460e38ac2f73

SHA256
4aa0e8070901ea23a1b70b5f82b9d2c7f2aeae7e2d382ed537f73b2f2608119b

SHA512
23956a82f5dbdb276e4c4760bbab5a416e9a491184f844ee5753249eefc377f3f3e7dded48b15dd2f7dfde74f1f40707b2881c53124c6009511307b939605ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
91a9a2ff9ae05cc6e135cf702e6db19a

SHA1
e1be860ca2dff98d64b514d6ee3e7a7054761948

SHA256
49bb8370740880f5592cc5dd1852a45e143b408a238583e0f4e97905d3d765bf

SHA512
4e76595261bb6735111803137c5346079d67b615d2c57f25b2e61503ea8c46613cce500cbbf6fb7b59bf67f4b0cd0e11eec60fc45a0ced56ef89558b96697a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3db335ed06ce07a677db0deeaad6adb2

SHA1
42f2002c3c685eb09273935c7cda31307450e5e8

SHA256
8cccdc36c4f99c49cc9f2d88a7d7ebbd867395672b829ae2b36c4049a18b4e01

SHA512
c44f54eeb287c3e934b1677d60d0f06a2dd0310189baa764ec3adf72fb59783b8b91366221d428386a979ed73e6776affba0abf1c15340e6b8b94944ab2d7b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
426f16781dbd66f223c6771e79e8752a

SHA1
94501727c14deaabc7043053fd4bf12ea0b79c54

SHA256
5d3fe0b422733ab7dcccf0f594a3be8a92d4fbee04c8a80cc5b9571a8e9c36a4

SHA512
aba4f746b363da13a45d33fa8e9cf649ed73c6f6d90a7a989be72e1c9632f3da493e01235f977541b0e6279e6681856bbd63019298c054b2cc59333063c6474a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
275522f44d96594582505266c59dd54a

SHA1
111e59036498bd2254dc21ea564287e1480829e6

SHA256
dc8b5bc472fb7d3196f201f439540b0d431c8f46c19492fcb86f395bd6283103

SHA512
566a47f10aa1c8817145c42d54716b88931f7e9ac41939c5f2ff9886dfc98eb3b7d030e0a61f2be243a1b91fc0d8c7b78154c86c96c7b43318c07b9fb11fade7

Download Submit