32e6b0ea398e3cf66275449f4eed43074d91e67642e1a15f8fdb46db262c3511

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
Size

28KB
MD5

06fb86cb0a706457a8975951491064cb
SHA1

acf100409ffa610116f0085a561d7d4faefbb497
SHA256

de50f96cb09cc27d12eb293d84cb35a333a4c230729bd1e9673aa5c14c5b9cd9
SHA512

f7d2a490d5e585d9d01bb1e42fa03f4615c8fb16cbab713dcb25fc837d2c94f6f60c2bf4ab61271ee1b8f59cc6002884a922333770ad4e02697dfaac14a4f5a2
SSDEEP

192:lRkjoJAjnhtcr/kbN9RYW3MHaMTqBS24OwVHl1LA+8+uU77qcFkPlD2oVFoEc:gJLI/eNnnl+8+uU77qcFID2BE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
4380	msedge.exe
4380	msedge.exe
2916	msedge.exe
2916	msedge.exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
3352	identity_helper.exe
3352	identity_helper.exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2916	1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe	91
PID 1812 wrote to memory of 2916	1812	Skill Hack WarRock-Hacker.de[9.Juni.2009].exe	91
PID 2916 wrote to memory of 2444	2916	msedge.exe	92
PID 2916 wrote to memory of 2444	2916	msedge.exe	92
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 440	2916	msedge.exe	93
PID 2916 wrote to memory of 4380	2916	msedge.exe	94
PID 2916 wrote to memory of 4380	2916	msedge.exe	94
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95
PID 2916 wrote to memory of 1900	2916	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\Skill Hack WarRock-Hacker.de[9.Juni.2009].exe
"C:\Users\Admin\AppData\Local\Temp\Skill Hack WarRock-Hacker.de[9.Juni.2009].exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://warrock-hacker.de/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2a9846f8,0x7ffd2a984708,0x7ffd2a984718
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12919053292625451340,16924133971760999878,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4144 /prefetch:2
    3⤵
    PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db67be85e5e3284274d90b3d53437c2a

SHA1
b0246a9d37bba540cb73899ef5bc3bac7884bf3e

SHA256
7ba720701ae683228413af2182983232b5eb3165f229ce310a3ea6f41894d4ee

SHA512
4b768dd864ac24ef68a803ba210b3a21287daf76276218db063f0c3e7524a223cd91c91062594b9b85155607123a236c401c5afaf13fb0c758d95fea0cc089fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b5f8e87513b28b6c2481754b0ff1586

SHA1
3d1d1ff3234f32daf90fa7a57176b106cfc7ec5d

SHA256
74d45071c9791836a7d31d1072b65d602c6d75ddd96c7cd8e588d7d1d30c71a7

SHA512
78119fc3469bfb6c4dd70ca90941c789b8830604ecf58dd8658c0dc247f4ea46595bac383bb426584f7f15b4af2fa62be6b10316082003afea2ba6fbaf0c8031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da0a06e3c059956d2747f1970ffd8dac

SHA1
654f29400e52ca795539e085f178156f50ac9922

SHA256
361b4d75b324da999263672102b7bae0eb36e4ca858cd1d8f643ce06d5fefc48

SHA512
798599f28162c9328ea070e13d2220758d4d55e9e9aed097a979b516bef0262b21cc7798f9c914cfdaf3ee7d7a00dd0ba1cf975433c9d5baee99bce214c678a2

Download Submit