hxxps://gtcontientals[.]webcindario[.]com

Analysis

max time kernel
600s
max time network
603s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://gtcontientals.webcindario.com

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
78	ipinfo.io
81	ipinfo.io
328	ipinfo.io

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
2812	msedge.exe
2812	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 368	2812	msedge.exe	90
PID 2812 wrote to memory of 368	2812	msedge.exe	90
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1480	2812	msedge.exe	91
PID 2812 wrote to memory of 1228	2812	msedge.exe	92
PID 2812 wrote to memory of 1228	2812	msedge.exe	92
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93
PID 2812 wrote to memory of 3232	2812	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gtcontientals.webcindario.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeac3e46f8,0x7ffeac3e4708,0x7ffeac3e4718
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5473003375784575762,1261807859406140379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24e641bb-dd0d-4dd1-ae89-4c72141c5763.tmp

Filesize
11KB

MD5
207dc5e230af9f6b6fb9c484fc01da65

SHA1
48f351a78b757a6386991d719ad7f6c1153721ad

SHA256
5bb866a8bf4ef067fdebbbf4fb7e351d0167b78e2c7e79e042a579e5be460284

SHA512
761dcc09cf657d180405ee34671799454d2e0495119924b03c68ce0afdfa440174c96dea7e81f124bd53dff89b46c1c181e599bda8b5c14a5c611381cf030bd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
49KB

MD5
8e32e53a42805dda5ed717b2e3356999

SHA1
ee488c132fd00240e5b345229032ecb96994148a

SHA256
f07ebbf3f96366391ec2588ff858a802868bb6c79604ef807f3c798e1cfd3cec

SHA512
2f508612f2c0fbbb63efa48a50ca3d107fab3765826aafe6161d79bba3655f14d3b285d3a7dfd509b858f281e5d1fa2d426d277533f803eeb4fbbceb8bfeb744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
137KB

MD5
29ebeae29286e38f6b8879c6852a6c9c

SHA1
62c88ce560fcd17c5fe8931ef87d8cc38f4957b3

SHA256
799ecaf476ca248e3a06f750eccce16115af938fdaf2b6dd21156c89d8d42ef5

SHA512
d0c0a197f4148f762a32381b38615e066e940e91b3c1c2af7b385cdb10e6c56242c7aaa582716969ac17f277d15a4ffc03d676886fdec43f92ec2c252aef2e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
69KB

MD5
d09cc1822246214d0c6af55d6a8e2966

SHA1
ee2ff980b6e33ca644db0f28d0a8bd671c7d0cef

SHA256
103268f2cb78df7df3c53e94b917c86cda8a84156dff26a761a3326d74827da1

SHA512
a9214c10990d76c9ba87f34c5bbaaf8ca3ca58189c654550acb61d4eb1b1df79d36658616b3541c83d553fecb556baf471e5c8ffcebeba2293234785faf81fb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
31KB

MD5
ec630bee42e4050f65db4df5b7c3b147

SHA1
0f5d64ea4c0ebd02b02a70312de0f190e25aca4c

SHA256
f77b2bd2bcf75550041f6ae34ea833f2073cbc0fcb1638f29b3f18f98400cfff

SHA512
9b654f3cf17161a9aed93dd63176ea7e2fcc6ad51726e740c5904f824a9e9757f32f30010a72f2a200b67a4b8a38bda428544d233488905c65f49848f4d5771c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
30853dc22d0477bbb248d7e64083bc92

SHA1
32d7162e6e0cd972517773f9e0b97e8e01317a65

SHA256
6315a5b8a2118bd444e7d582356a64f2a22c62bf2b580a78b7d032e12316d4ad

SHA512
a7077f12763b6289a9af247189d06adca9f242168668533edaf622a789c558903a06c0d39fcfe6e67adeb08ac129a272d8f1043cddde94d6899b7a675e271a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
384af671dff5482368dcd41bd0490bb8

SHA1
c464e2f628b52144f917547b9cfa6ed659e69661

SHA256
1992bcf304bc0de64a64f1cd4af5462cc5230d21fd8d610aacbba7b9d5aea171

SHA512
fe370d865767aa05e04deeef9ee7ec9ca601b7f0343b3c9e8c7d7aea3770d415c40db22a4bd0ac6f9b000c806975725f889ffa67433ff39fd0531a39c558f766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
572941d89d06c6346b025aa6fd3d6f3c

SHA1
7f4a62891f6fb71dece624415178bc9dd22f302a

SHA256
c848dfd4a2706976ff3fd7d2cc1d99b9b290ae197fe0f1c19a16c4a6fa2afc5d

SHA512
802aa09b7e4ad99281bf19d234b267ece67b49b8b4e22b76ae8c7d221ab8ffc463e64b38ebb43cc9be6f20223addf791253738ced203f1bc021cb95b54c52a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a157245504719a7325b2cdb1e9eb79ea

SHA1
0b60ee1e0abda52207ec79a130218d7eadc68fd6

SHA256
2bb5eac46188b7ef785bda51067bab52e62886ee74c57d51e2a0adfd7fb0e85a

SHA512
16544bb42d35ead4a517a235aa4409f749c8e1488510554d175d452f2001dd6e2083124dcf0a629cac340229595ab0d6a7213c1764402eb4a8809e969c957852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a94c3172919bea6809a2fd9a9c5bdc83

SHA1
0a14af0b0a02a6592e2dfc2e09929c72ca91227b

SHA256
65dbed011b264cb272ebbd377d033d541d27e126edcdee8d3091a62472092e10

SHA512
93b854f951f4baa5665066e3759b3fcf605e002d9836a74073f042c1045dfe128cf0fc8b7e4e7383832a100442c5c0df01d078282725982caf623759012f97de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
89ec824b4c2c2289720deadf5bcd9a7c

SHA1
4d8b53a08a97059e0af5c70386b3078e1185b435

SHA256
6ecfb42590b765c2acadbbe86f260b4ecab878a511c15c89f6bc0fd374dfb871

SHA512
f3a29394df09c7386284b78c3f94028b1ee97ea8ae5239a808e25607ff3a0442aa53a713a42d2087d1769fe90c206c26cf6b81da1385176b788f54e2552314b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
d92869adbbca5dfa267ced2ef08d2b7b

SHA1
507273b0749eabe1477b86a4a2408ae5f1cd0dc2

SHA256
fc2526017670af14b3b69ca3ed39908c16d10b5cc975f9899155767c7e951313

SHA512
a27f38857b54fba0986edbff07e70a8400f0517a7008f665d1fc5540e1a9e8df7b5eb584994db67cf0588d23db667d67b82177e0ce0116a5f7272ea2faab849e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
f3baa2f82cfe06406380ec88b9daf5b3

SHA1
a15d95fde78d8f37c2ae61339a03635781bdda43

SHA256
4d1274627c7b67c03712f76791760b395c6ad85780ef3b0fb2fff882cf0294d4

SHA512
d64d3c1b72e94787d2c463b58c64ade2f9d954cc5b5dc425be484b8aab68202c8beb651c5a90046f382d1d779545396bdda93e306a13191bcf66a8a099346d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
21625eb778d9ebb2cba016bb1eeec75e

SHA1
21e8424ee14dc9269fa79d4616109a0250188640

SHA256
9b32f94c893bbbbaa490b0b94781cd5c502246c737d4f7c75d0efd85663b1f31

SHA512
4521086809e5b72901ca64e28c261971e2d879c64b46eef540f01495acbd80463bae1554ff9ec8901180e1d8e739185e482acaa37e0f76f3aadabb13f6437679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
815e5770aebda0231530d2c485763d56

SHA1
66c00583f3518c91411ed35946e3368828bc2880

SHA256
c98d601567352c6bb0227f24d4395a6823931223cc57a70f7eba6b7e1534f688

SHA512
678aabe2afe6fa042505ebddeef75fd395b3751e0cfccea41ec043f2dae71c5393de493f6094a436ab91773365fcfc4dbbde4d373c127b44652ff12c9c15f151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
852516ca45baaabbdf844c677ff492bf

SHA1
8bd691f45dc50df29a5256d23a515ad4efa93e4e

SHA256
a88e27a415ddead02252edbe884cd8cb40040b4f6cc63d468a1e506e26abe05b

SHA512
b5a587aba03beb29ae443a0ef9951e0eb321e69c8c4ea36a7533d24621ac0de6cd2b905e4d998548881d0455765960b240623118b392b99b111524dffc97bb23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584e79.TMP

Filesize
1KB

MD5
a4f837074c3a9d0cd9ed036cb3537ae2

SHA1
9ff295aebc0aaf781b784d5b9bda8ed0f9471365

SHA256
92b1cfac35bde7605711c41229e02ce49f8c1a02c1d99f93104aa28514cedcde

SHA512
58ef32634a17a6b716630bb68cbf67fe298caf2ddd362be8a01ce9b0430701d704d600d75a643b0b76001d4937d1eef5e15db8aa109c98925bcdd55eea984781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit