Overview
overview
7Static
static
7MiniIE/CN_...ch.htm
windows7-x64
1MiniIE/CN_...ch.htm
windows10-2004-x64
1MiniIE/CN_...ch.htm
windows7-x64
1MiniIE/CN_...ch.htm
windows10-2004-x64
1MiniIE/CN_...ge.htm
windows7-x64
1MiniIE/CN_...ge.htm
windows10-2004-x64
1MiniIE/CN_...ot.htm
windows7-x64
1MiniIE/CN_...ot.htm
windows10-2004-x64
1MiniIE/CN_...op.htm
windows7-x64
1MiniIE/CN_...op.htm
windows10-2004-x64
1MiniIE/COMCTL32.dll
windows7-x64
1MiniIE/COMCTL32.dll
windows10-2004-x64
1MiniIE/COMDLG32.dll
windows7-x64
1MiniIE/COMDLG32.dll
windows10-2004-x64
1MiniIE/MSINET.dll
windows7-x64
1MiniIE/MSINET.dll
windows10-2004-x64
1MiniIE/Min...re.exe
windows7-x64
1MiniIE/Min...re.exe
windows10-2004-x64
1MiniIE/MiniIE.exe
windows7-x64
3MiniIE/MiniIE.exe
windows10-2004-x64
1MiniIE/MiniIE_2.exe
windows7-x64
1MiniIE/MiniIE_2.exe
windows10-2004-x64
1MiniIE/Min...ox.exe
windows7-x64
1MiniIE/Min...ox.exe
windows10-2004-x64
1MiniIE/Min...fo.exe
windows7-x64
1MiniIE/Min...fo.exe
windows10-2004-x64
1MiniIE/MiniIE_SDD.dll
windows7-x64
1MiniIE/MiniIE_SDD.dll
windows10-2004-x64
1MiniIE/Update.exe
windows7-x64
1MiniIE/Update.exe
windows10-2004-x64
1MiniIE/新...��.url
windows7-x64
1MiniIE/新...��.url
windows10-2004-x64
1Analysis
-
max time kernel
155s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 04:58
Behavioral task
behavioral1
Sample
MiniIE/CN_MiniIE_ErrorPage_Search.htm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MiniIE/CN_MiniIE_ErrorPage_Search.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
MiniIE/CN_MiniIE_Search.htm
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MiniIE/CN_MiniIE_Search.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
MiniIE/CN_MiniIE_StartPage.htm
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
MiniIE/CN_MiniIE_StartPage.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
MiniIE/CN_MiniIE_StartPage_Bot.htm
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
MiniIE/CN_MiniIE_StartPage_Bot.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
MiniIE/CN_MiniIE_StartPage_Top.htm
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
MiniIE/CN_MiniIE_StartPage_Top.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
MiniIE/COMCTL32.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
MiniIE/COMCTL32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MiniIE/COMDLG32.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
MiniIE/COMDLG32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
MiniIE/MSINET.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
MiniIE/MSINET.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
MiniIE/MiniIE-Capture.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
MiniIE/MiniIE-Capture.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
MiniIE/MiniIE.exe
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
MiniIE/MiniIE.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
MiniIE/MiniIE_2.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
MiniIE/MiniIE_2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
MiniIE/MiniIE_FavoriteBox.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
MiniIE/MiniIE_FavoriteBox.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
MiniIE/MiniIE_Info.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
MiniIE/MiniIE_Info.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
MiniIE/MiniIE_SDD.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
MiniIE/MiniIE_SDD.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
MiniIE/Update.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
MiniIE/Update.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
MiniIE/新云软件.url
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
MiniIE/新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
MiniIE/CN_MiniIE_StartPage.htm
-
Size
50KB
-
MD5
3cb29fb9474675458535a4b8acdef90a
-
SHA1
08c7c76dc87c4431f4d153534169e19b420523ca
-
SHA256
9db6b000edd4944f61e5953d89670b2c6302180b18e89ef74522acfe5bacbf5a
-
SHA512
284efea1681fbb48e956709b22d1d9ee74ed1d6f2af2ba28b586e11b7ff2858976dfc0fe45a0a4b181d4b3bfbb555ce7a88f129db6c91d9589c08bfcc94971c7
-
SSDEEP
384:1Ncpsmf4fff+yunQLit64mfYdzdzGDdpniGw3ge+QxaltHy+6PhBk1YbRpLBgb2r:H2RAunQGDmfSwDdpVht8hJT
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1228 msedge.exe 1228 msedge.exe 4284 msedge.exe 4284 msedge.exe 1460 identity_helper.exe 1460 identity_helper.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4284 wrote to memory of 3032 4284 msedge.exe 87 PID 4284 wrote to memory of 3032 4284 msedge.exe 87 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 3144 4284 msedge.exe 88 PID 4284 wrote to memory of 1228 4284 msedge.exe 89 PID 4284 wrote to memory of 1228 4284 msedge.exe 89 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90 PID 4284 wrote to memory of 792 4284 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\MiniIE\CN_MiniIE_StartPage.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d13e46f8,0x7ff9d13e4708,0x7ff9d13e47182⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:12⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:82⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:12⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:12⤵PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4600984078504331160,1885039115636727746,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3416 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1048
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD536bb45cb1262fcfcab1e3e7960784eaa
SHA1ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA2567c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
SHA51202c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
-
Filesize
152B
MD51e3dc6a82a2cb341f7c9feeaf53f466f
SHA1915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA256a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
SHA5120a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD58a8e6af4c1f9a5b5835ddd885401aac1
SHA135012ca842d398915e51d84583fe68820cc542b1
SHA2568362b4c501ba55bfd0b3f4671884b7b2461e312d70653b78d84f62e3d2156b43
SHA51275ebc59aa80376326a3ba3dbee69d61df175ffed9d473ee35a960ef6e8c24b1a40a75c828979213331cc34f33664b5b0dbc9a14a2b12493ea6a9d14a56875a6c
-
Filesize
6KB
MD511fa8f6cd62f2e6ca50d7792251aa575
SHA1dfc54df9cd12fd567fe2112437f4df35655d404d
SHA2560d6831c2353ddf321655aa4bea1a150a4cfdcd594d119337083e325ae8321da8
SHA512e163f8e9c75117737dd77f5429cab910d05f491b6cf421a9ed13842f08c9c1afd0501224b191c059bb1c912de636161e4ca961362292a022f7759aad31855e1f
-
Filesize
6KB
MD58a31acbcfdb466b5f4930d43d7076f0c
SHA1f216ffecd6390aa1a544abb5b2df2b95d12dc434
SHA25683c470f4ee8703826457089c2a4cd5c48c658e722b752244c92103404cabc933
SHA5129ac2fc66008490a32822f6a3305d668e62bb93adacdea154acf8265a3498069230e0f56aebe849edfaa304b51bad9bfefb1d6c82bbcf0b650f8bd1ad224713ff
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f1fb66f88be4cd7cd8569aa54717e240
SHA1c887b67f6913f6c95cdcbdd7c364bd5e1fe332d5
SHA2569e5e6d675910a6c41b18f8f56456c55e0b83b1e305a52eb5e61f9563cdafb224
SHA512d780a48a277ab2b9e3ea584704685f145b31055382fb6f2a162a2eb12b15f146b37893bd161388481033a7668c24044b7801ee9ba87f57c6466ac8be26aaa060
-
Filesize
11KB
MD5434ed5c66dbfa6acd12bdfa1028286ee
SHA1dcfe75906d65f9a99fbc0246c76fa6b8b3f43ca4
SHA2565908836a4357555ad949c63589d8d143c5104ccfb1bdcf02b66de7e98dc29a28
SHA51290bf7ad694bf4c343033c1e625ca9600605cd926419eb545f551492f29472ed09beef568b2508420ab1e305c5dbaf78930091a2f5192ad771ebdbcdfe150586d