Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 01:20
Static task
static1
Behavioral task
behavioral1
Sample
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
Resource
win10v2004-20220901-en
General
-
Target
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
-
Size
200KB
-
MD5
4d3cd27b04757cbee353f2d695aaadd6
-
SHA1
a60669e7cf30bd313af33f2c835851d37f5ba43d
-
SHA256
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f
-
SHA512
52744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d
-
SSDEEP
3072:DyzGoDoxz/ch6pSPKAtArmLuAl5aFmCUlK3eDjyF/kPbV1P1oX1l:DySGwz0TBtArmlFhKuDOFcjCl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4460 ¯«²§±©¾¦¾.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\31a07b0e-4b4a-4462-8850-de08fc0d726c.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221020073030.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1192 msedge.exe 1192 msedge.exe 3948 msedge.exe 3948 msedge.exe 3836 identity_helper.exe 3836 identity_helper.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3916 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 4460 ¯«²§±©¾¦¾.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3916 wrote to memory of 3948 3916 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 81 PID 3916 wrote to memory of 3948 3916 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 81 PID 3916 wrote to memory of 4460 3916 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 82 PID 3916 wrote to memory of 4460 3916 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 82 PID 3916 wrote to memory of 4460 3916 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 82 PID 3948 wrote to memory of 1428 3948 msedge.exe 83 PID 3948 wrote to memory of 1428 3948 msedge.exe 83 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 2040 3948 msedge.exe 85 PID 3948 wrote to memory of 1192 3948 msedge.exe 86 PID 3948 wrote to memory of 1192 3948 msedge.exe 86 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88 PID 3948 wrote to memory of 3104 3948 msedge.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe"C:\Users\Admin\AppData\Local\Temp\140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://goo.gl/5UGSXR2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83d0246f8,0x7ff83d024708,0x7ff83d0247183⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:23⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:83⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:13⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:13⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4868 /prefetch:83⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:13⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5396 /prefetch:83⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:13⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:13⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:83⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4712 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x208,0x22c,0x7ff79db85460,0x7ff79db85470,0x7ff79db854804⤵PID:2984
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 /prefetch:83⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:83⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5180 /prefetch:83⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3176 /prefetch:83⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:13⤵PID:956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:13⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:83⤵PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,7656739394278553846,8023645606347718611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5772 /prefetch:83⤵PID:4952
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4460
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2236
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD54d3cd27b04757cbee353f2d695aaadd6
SHA1a60669e7cf30bd313af33f2c835851d37f5ba43d
SHA256140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f
SHA51252744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d
-
Filesize
200KB
MD54d3cd27b04757cbee353f2d695aaadd6
SHA1a60669e7cf30bd313af33f2c835851d37f5ba43d
SHA256140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f
SHA51252744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d