hxxps://cloudflare-ipfs[.]com/ipfs/bafybeig4kuskm3b3u2yww2hjym543cpb5jwlp2ing6viznd4csskt5q5e4#jorge[.]revolorio@banrural[.]com[.]gt

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cloudflare-ipfs.com/ipfs/bafybeig4kuskm3b3u2yww2hjym543cpb5jwlp2ing6viznd4csskt5q5e4#[email protected]

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1796	msedge.exe
1796	msedge.exe
5104	msedge.exe
5104	msedge.exe
4216	identity_helper.exe
4216	identity_helper.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5104 wrote to memory of 1360	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 1360	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2372	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 1796	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 1796	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2312	5104	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloudflare-ipfs.com/ipfs/bafybeig4kuskm3b3u2yww2hjym543cpb5jwlp2ing6viznd4csskt5q5e4#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fec846f8,0x7ff8fec84708,0x7ff8fec84718
2⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
2⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
2⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
2⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
2⤵
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1716 /prefetch:8
2⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
2⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
2⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
2⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
2⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
2⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5496 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
2⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
2⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
2⤵
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
2⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4708577333585804870,4130681488018094302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
2⤵
PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
26f8219c59547d181c1f9070c2f5b050

SHA1
cbe34c1b41c0d86e1dff1a0bd82b6c803085a39f

SHA256
3f534bb6f67e07afe3baf85bf750122c2e00b86df6aa258e5752dc6c946fc2d2

SHA512
1600ed7fb809d9f4fd571b99e606ac92f0054f684b6b7a3b72ede39d5edaf458cf551c568ca1bf967326bfbdaf2f7178906fb8d15d82c52049fb6c74205c9f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f4b50b4-9078-44aa-801d-a515f8656e79.tmp
Filesize
1KB

MD5
a361ef6a6b765f96f1ced80512f06b4f

SHA1
f61f2cbc7a93e1892883be325e3724efe6f2023b

SHA256
ffe285df4c1229b1f9ae2206f9d09d413d8335d8db781373c45bd735535b5f38

SHA512
d0f481c2028269f4f91866f8bbf3ec769ae176653d32bda0f3a6dd7f83f5ce1ab8851cac96200756f86f81ebc2402509c67229613f653d3e65e75c015e2d89fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85a71888-f7c5-45ee-92e4-c868317730a2.tmp
Filesize
8KB

MD5
b3e6d1e22eb8d0dc962dbcec49e79b47

SHA1
e43c364512b63e55b180fde0efe12c7046caa433

SHA256
31290424a0d2b2d2c3ad1062ef2a6be8195dd219e81e6c72db75996d0d468ae6

SHA512
ec130ff931932b053170b757f4dfb0bcb6978e9393fc0b8e4c0c91205935cf18d9f653f8e0fe170f3b4ce74aa0ea147d27cdfa480cbbd9b942f54fccec0b0e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
e63d145ef0d5bc954723d93a723070c3

SHA1
6423e350ffe2d3f2d7ad94e05272d0fc072ebc50

SHA256
158a83561b2896843f7be8ed1edf5df3c394e3cd9953a23633bc407c961ecf9e

SHA512
345dae9f7e7d76c1aa12ba7a51e8374e556124e21ee4b5033676b66d3805ec4adee9b0d1d03b1ec9976a856ad74c7fdf3a2af2e56bed5ef0240068b3966679bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6b34d8587babdeb2eeb64f2776c9df26

SHA1
4ab3880fc6e8d36bfea5660b4e650f30e9d0c69d

SHA256
ebd7ae7316c32b7738c58b74d73508964e752fa43bc13a03fad3dc8fa5731fc7

SHA512
6b96b90400e3c62c9624d64188baa0d9bf23d4709a9e1aaff14a40200b62c5b4fccd68297f62d179f0b15a76b6e9f9f61d890a7cf475c456a23016ebd379f312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c9865b4ae8a0dd078218b42388185ca3

SHA1
85637e25f7928f5a5f36992f0036671ee74410c3

SHA256
7265358b0ffd6cef21929180ded01be6144f8af008aa4deae4958e8fa49b5d49

SHA512
76a65aa9d45b96dc666507de25290297221cb37153898307d2edcf388944d522356347e1296c681c0ff92ca6106088f614caaba262e5b68df4bfc2c7cdd38f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
20b891bff5b34e6869b0f5c6ba797ce5

SHA1
a71439587af4c4c7eba90431cf636402bda9c7b4

SHA256
9400ab0504acf615a3d34558e593601436f061425b179fad317e462f99a0df9b

SHA512
877ab35316d608ca6d0a279acdedcd1ed50931d6fd96a4fbe3e833c677d6ceb5aec2f001de886e8f1dc6d6e6f96f84bc3bd32ec375bbd539001a8c8f3fdb250a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
b2b5f4e4361be0ccc0d629ff727a16e2

SHA1
5e5400797008d7a19b307fbdb303367e4d8e24c1

SHA256
d1b292b94ae87a8281618a25aa7f7b23e9105d29121f18b0448429088404e8b0

SHA512
dcf1250a9e7e29100a6cf933d7528d0fbd0ace3e9ee37d92d5d329b78c64612b365b83f48ce732cda1c4978db2687a31c5b6b3b4840239cb2b020a12d365de9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
10ba3e64667ec7b4d1cc51b6dccdb96e

SHA1
45fe63151e9c2d432da2b7124be0fc9e731f9d9b

SHA256
e78b64008a296b8c0d224ac3d8583e82ae4bb38733c8caac016b8ad04cf3f488

SHA512
3df1679ab71f85265f4edc0880e4867db42cab1a891b275f3740ef18fc92b1121232bbce09376e9eae4f5dcaa9e878e956ed149a24543d78815f71282d6036dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
022c37131d2a74414fd1b368ce611ed3

SHA1
6e71a4b3fbcb357c85c23c1a2d1698c5231b500f

SHA256
f28980165df3c587b031f657ff65cd45c8a47570e57eaa41159cc7aa2b742eee

SHA512
c7c4b525c0bc48ef6ef093b6324fe1af3aa3d01038c4af06b9c8fadbfe3c4000fdf12f068f8ef52038579d0029e256bfc4394ad9302a35e8a9a6be4549318fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
552e9c775a8c9c89aeca5668a277cddf

SHA1
e4ed37894561b3d9842eabbe40b28f3f10677a4c

SHA256
58993dd3864a47cb6a9d883b56e669aff813f36baf0bf14638268741dcf24731

SHA512
8b1ac098a6aec20654944d1abb8ebce985725f132d55b1f21c77f8af3a978f1748693f393fc8e70529858064ad021b93148a9acd8128b57e20d49ae5b8d2ec5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
bc31f9c58322cd1b8eb8a246be508c80

SHA1
a2ddff1b61ec55b2b0a0286525d56602f94ee208

SHA256
3e48d1f92eac300ee1a79ab17d281f11c0a9c41380a53a884daf73bc6de7aebd

SHA512
9c7e769a2d32855510b374e00d5ee8414db7efe547907747c8c3e2756376ad829e0f284d665b8e28df77ba58fcc84c3fae49c8af775abde3ae1c75b02883fccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
9eafa66a6b035ff6c238eb00d7a7c4bd

SHA1
41e4d362e39bd90e9ba3fbffed107f91d5bc21ab

SHA256
33bada350d76d0ad6da9eaae75675f45059330fc286d22085c5540336c7c7108

SHA512
361439d1ef7821b796aa1533eaae95ffdbb71e29c19100f5605a5e32871aafee6d9a36baaf923f77aa18b2c135d5ec757fa37503b683c52c07a9f28db361257b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
24647e3a0a35af585a228ddcc45d033b

SHA1
0abc9a1b199a8eded69b91fae848f6f85cae30fb

SHA256
2de9d3ff1f9f8c7838f98093b671e08d2f738304fdcf2c9070796d8195fc4f27

SHA512
fa7930fdea944b15c033d801831fe279f1fe724758e34d16607c7e2b1b3ce938ff9a8ef9e59ef24c85ea2b641bdfc38489bf1cb25d3fdb8e843d26b9f6c9ad3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a469.TMP
Filesize
872B

MD5
6fe051a55d3e81dcd6c76bb004c83c17

SHA1
a2ff3aa91030ff4ffb999a6e2769a711361e1ce3

SHA256
159512750d273d9f4295b44aa12888a7e7270bb127e5f66d8d84e40de334d486

SHA512
8cedf85fc9fe72f9d2702724126d50d3d278ad6296d2a679db4de925c3bce165ed70557042dd8004aae843c569e444d74b377806809c490ee0a9393a3862f6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc309c61-7f40-4336-b364-55a1840cf47a.tmp
Filesize
872B

MD5
3dc01d755e2dccfd0084ecf40cac6f9c

SHA1
e2087632fcfed379d343f9de4486e25a1be56c76

SHA256
c12dff2de38c95b379c93a95789fd53bac37cf6d459e86b0c5f27a90505334b1

SHA512
3803ef6b0a4e2923d68329221437651fa40f3115fd14ce534f7a7ebb76c1f805f08af300e5da8119bf1d5f81da610419869dd1e48a91ce3062a19bee9a192ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7953d1a38350053fff60c148563f40af

SHA1
feafc2bbcb6cca91236b1b8ac1303b8aabed2b7b

SHA256
ded8a519fa55c9f9e20518c2f6a01e9398fd4c427d72cc5e6b8b11e380ad846c

SHA512
3c643c479b15cc929e793ad3dd17343c7f88b415bfe465390fd7c57a1164c47ab1b57506febb2129efd88c7c7f3ec3e4503693b7f6eae9af1a5472d0df6dcaee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a024560a642555c6d7b48811113fd501

SHA1
c529f8e5bbe54b36761bb40b98db24a45ab9a9da

SHA256
97d9b037ff5ee7fc44e4348a2cadf88b82384f1451673755881650ce0c8286b9

SHA512
18b033b1a9b26fecb8c41d62d5c65eac3127e6d9c39293ac365cb23294d0f3632fecfe0183d6644de89ed0be864ba8aad4f588120e26138db9967dae92a30e1f

Download Submit
\??\pipe\LOCAL\crashpad_5104_PLOTMWEXHQBNITTH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit