e05613686da1b949850cec1991e39e58680cd49cec3ced4257c7bbef8dd6755c

Analysis

max time kernel
2s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

073b8f77bf22c82d0c5ed6192179d0b7.exe
Size

512KB
MD5

073b8f77bf22c82d0c5ed6192179d0b7
SHA1

5429cd8bd6c327d3c01232c3aee99e686832a696
SHA256

e05613686da1b949850cec1991e39e58680cd49cec3ced4257c7bbef8dd6755c
SHA512

26e23692cec6718f8806391547f361181b9597e3859c13bcdc19fd403965879d28bb50e8b5775e0943b9345c77e7f5909125fcf8e65e21b066e0a18686bf2da4
SSDEEP

6144:/BW0tiiyjJ8rUjvvaLdn6s3agaSnitm4JFKERN6gWrM7RpHrroWkHqx98gWNlPTt:pW0cj3jvvW6MagaFxUMGqAtzNtTird4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
552	G_Server.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatCache\Low	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatUaCache\Low	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Virtualized	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites\desktop.ini	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\Low	IEXPLORE.EXE

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\G_Server.DLL	G_Server.exe
File created	C:\Windows\uninstal.bat	073b8f77bf22c82d0c5ed6192179d0b7.exe
File created	C:\Windows\G_Server.exe	073b8f77bf22c82d0c5ed6192179d0b7.exe
File opened for modification	C:\Windows\G_Server.exe	073b8f77bf22c82d0c5ed6192179d0b7.exe
File created	C:\Windows\G_Server.DLL	G_Server.exe

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Feeds	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\F12	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Connection Wizard	G_Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "12"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Connection Wizard\Completed = 01000000	G_Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1853558461"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31078226"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	G_Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Internet Explorer	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	G_Server.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2344	552	G_Server.exe	22
PID 552 wrote to memory of 2344	552	G_Server.exe	22
PID 3680 wrote to memory of 4580	3680	073b8f77bf22c82d0c5ed6192179d0b7.exe	25
PID 3680 wrote to memory of 4580	3680	073b8f77bf22c82d0c5ed6192179d0b7.exe	25
PID 3680 wrote to memory of 4580	3680	073b8f77bf22c82d0c5ed6192179d0b7.exe	25

C:\Users\Admin\AppData\Local\Temp\073b8f77bf22c82d0c5ed6192179d0b7.exe
"C:\Users\Admin\AppData\Local\Temp\073b8f77bf22c82d0c5ed6192179d0b7.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:4580

C:\Windows\G_Server.exe
C:\Windows\G_Server.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2344
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:17410 /prefetch:2
    3⤵
    PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10054
      4⤵
      PID:4496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10054
        5⤵
        
        PID:5024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
        6⤵
        
        PID:32
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
        6⤵
        
        PID:4516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        6⤵
        
        PID:932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
        6⤵
        
        PID:832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
        6⤵
        
        PID:4828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:1
        6⤵
        
        PID:3816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
        6⤵
        
        PID:3656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
        6⤵
        
        PID:3376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
        6⤵
        
        PID:2648
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
        6⤵
        
        PID:1416
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9396059069513745220,6050837954528347297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
        6⤵
        
        PID:5244
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        
        PID:5260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7ded75460,0x7ff7ded75470,0x7ff7ded75480
        7⤵
        
        PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbcdcf46f8,0x7ffbcdcf4708,0x7ffbcdcf4718
1⤵
PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\G_Server.exe

Filesize
146KB

MD5
f4dd0862de734b3dc62d08aec329f184

SHA1
631aa12125ac058277da6ef663462a8326e18f31

SHA256
5c5f16e6ec8347f8739ac1a9bbf0bb1a8eacdcd8decb98c5f8d1188d9a2f03b5

SHA512
9fc1c8a3e0cce8ab400e0369cdab380db6fafda3dfb0292acaf3836b6f1d0ded6e506e93ce767c960fe082a4a9bd6e58e3df7247b1706ec693bd85615164c335

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61ee6c40c57b8033af9019b3bcfb776d

SHA1
bd69118e629301604efa0f798f93fc04e9b0048a

SHA256
13010e67881de59bc0a6720a18fa17c16b7448419ea3e1b99b85448cf1785554

SHA512
3151f9703e73d1b528b96c30c30856b1f92f36cda0f18eef256d43d4ad1a97e46b20ad25b4ab2ab1522d19861fc48c8203bf8d5990af133b62092ffe66ce4223

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02d33cd251005311482e8a620d4d5036

SHA1
a22db9c5dafd347787c4b49299154ee5154df897

SHA256
d993ef6b06ecabbcc6c9a385055f9586e0e13f7a0f1de70dc5394309c6b8e14d

SHA512
8ea980f14eb2f70e71d89c99f3a37458543898bc24b4b945f8badf866e3ebefb23c3b0a55ec3674426da2c7daa3025ded619edd387dcd4dd7ac97b38c45f5746

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\6aa6f29a-c077-4d84-83bd-b7de642985d7.tmp

Filesize
51KB

MD5
50fd19bc7550f98c7db0aeb00dbd71ae

SHA1
83870e7d316c009b2e1db72a89b971db9ec7ca40

SHA256
9651da114b3500fee396298d27fca5621b36029560cdd7ee75728aaab3a6e5f3

SHA512
b92019080fa538bcb3e8ef791b9448d427bac919b71d8a541428713fca85ce85006741915ee92f8cf971e48e6efbca1390110d14322ea3b17d4650e579a4466f

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
8d7742cd778858e327e4f1cdb01e64cb

SHA1
1ec731ea29ec10c2e8c43b0e9a18003328aa352b

SHA256
21e82cfe3caeb671df8485302fb89d67a8056063ef9465308aacc138931f3f74

SHA512
1783681102024c12676287e7b2b66c4cd26db6862e6e8bfa59acc49266b0d0caaf0831e1afc6da266782dd100972cc9636ed745008f24c9b0a24377d783235a0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe575776.TMP

Filesize
4KB

MD5
a090c16cad268ca3fe94b1ce1bf0037e

SHA1
6fd257e6924a859626b4da1ebc242877d86fef6b

SHA256
be574d2b95dae5415f004363dda7cda0c7fd34134b6c4efdbb49c845ae5833f7

SHA512
eddfc19920fb5f013c1b961562e1709a79e222e0f872374ad7c77058cd9d95842bb51b3c1f5e0baef992586d173ac85c6e0b9cb2783a190d55321af8aa486150

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
73KB

MD5
3623f8a1ed63976084a1dab664b478c5

SHA1
7d9cc0c346cf7c138ed1da6d04e1863d282b2796

SHA256
56043e3145d75b75b43eabf5bdf25be6af6e210cd5f97e5b2a45ec01044211b3

SHA512
074219b568ceb69d6d0ebce4133de82a7951bc7377c03faeee1885c6a8633153122568904ff3db251fa383a2745f2b879f83b4a8e2095f84dd6a54fb3c6a17dc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

Filesize
402B

MD5
881dfac93652edb0a8228029ba92d0f5

SHA1
5b317253a63fecb167bf07befa05c5ed09c4ccea

SHA256
a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464

SHA512
592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8106b8077c3e32409b873e9d2fc266fa

SHA1
72063c553741a069fc648315a5588d57dd0f66f3

SHA256
0979f5836a39ee27255dd06114ad4582f84b41532f3cdf7322184a2926ea8578

SHA512
3640beb8e1d6388eb156158973b5d9e5a295063e24333b730ba8f563a40c975d2e265d5c5211239d8454d95bdef5c954619178aa2b176df81ea13f5f9baf4fe6

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
9765a92adc1638b00947f5622b00d731

SHA1
4465a0eee01b423174f9cf361b44889e48a2a0fc

SHA256
03e8d6f4fbc3417a7f2523d8685b0b0f3367f3b4d356e065a049d2b52218ac62

SHA512
7befe46bf8df03f83332e3c5b8a276d6790f89a30cde10dbb03e285f7d6234fc8760c834b9b38af8235b654fc56fb7a9f0458490a98e41eb5cba64a4dc54199b

Download Submit
memory/552-64-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/552-71-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/552-289-0x0000000013140000-0x000000001324C000-memory.dmp

Filesize
1.0MB

Download
memory/552-62-0x0000000013140000-0x000000001324C000-memory.dmp

Filesize
1.0MB

Download
memory/552-63-0x0000000000D50000-0x0000000000D93000-memory.dmp

Filesize
268KB

Download
memory/552-67-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/552-69-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/3680-47-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/3680-15-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3680-34-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3680-33-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/3680-32-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3680-31-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3680-30-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3680-29-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/3680-28-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3680-27-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3680-26-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3680-77-0x0000000013140000-0x000000001324C000-memory.dmp

Filesize
1.0MB

Download
memory/3680-41-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/3680-42-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/3680-36-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/3680-58-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/3680-59-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/3680-0-0x0000000013140000-0x000000001324C000-memory.dmp

Filesize
1.0MB

Download
memory/3680-37-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/3680-38-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/3680-43-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/3680-25-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/3680-24-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/3680-44-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/3680-45-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/3680-46-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/3680-40-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3680-23-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/3680-35-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/3680-22-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3680-53-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/3680-19-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/3680-18-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/3680-17-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3680-48-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/3680-49-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/3680-50-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/3680-51-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/3680-52-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/3680-16-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/3680-21-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3680-14-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/3680-13-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3680-20-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3680-11-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/3680-12-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/3680-7-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/3680-5-0x00000000022B0000-0x00000000022B2000-memory.dmp

Filesize
8KB

Download
memory/3680-6-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/3680-3-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/3680-4-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/3680-2-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/3680-1-0x00000000020E0000-0x0000000002123000-memory.dmp

Filesize
268KB

Download
memory/3680-54-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/3680-39-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/3680-55-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/3680-56-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3680-57-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/3680-10-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download