8719baf9ea1e0874a266a3ee4ec71c3fc9c56f17c3a68e213ef9618f4ae81c71

Analysis

max time kernel
2212s
max time network
2174s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1logo.png
Size

7KB
MD5

3533a94aa651be30bb10954ba4e6fe46
SHA1

aeea89ef0a826e22f8a1b0f365e487d109286b90
SHA256

8719baf9ea1e0874a266a3ee4ec71c3fc9c56f17c3a68e213ef9618f4ae81c71
SHA512

1b4045563fdfce260ebf950b315cb2eec768fa1bcdc6d1032525d22c12bb273432dc9d364d5fc08212055f32941df57c9be6152d65475e5f9d1ae100058a5608
SSDEEP

192:wZEZRfR3iDlWfA+u6e9kbAS+a2s/+HPNg/70wM+8KXeKZ:wqFi0Ad6hAu2smvNg/70yhOK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355664440-2199602304-1223909400-1000\{3D5AC21F-E6BD-415B-A903-95F6069176BF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
1292	msedge.exe
1292	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
1184	msedge.exe
1184	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3232	1292	msedge.exe	117
PID 1292 wrote to memory of 3232	1292	msedge.exe	117
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 1672	1292	msedge.exe	118
PID 1292 wrote to memory of 3484	1292	msedge.exe	119
PID 1292 wrote to memory of 3484	1292	msedge.exe	119
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120
PID 1292 wrote to memory of 224	1292	msedge.exe	120

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1logo.png
1⤵
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffff8de46f8,0x7ffff8de4708,0x7ffff8de4718
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9718232289240824582,3835393810569682575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d39f5ba70017c066ccaf64a3abcc2c68

SHA1
423a799b6d26f66a91e9f9381da888d8c5b95c31

SHA256
3746cbe39ea3ce1bcbf4affaf093f7a80c8a2bb33efd3ca0d788aedad21877b2

SHA512
0c9706f473aed44c47c5ec7cf6339edffc738cb2306b1e483e3211768a54e3134928ca898c44f818ebd48e6bfc3f890e13dd31065abb46dd339537c22cee8498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
95c133ee3f43e9916a4d105ba267a1f9

SHA1
ac5f1920a7c76a495e910bf1d0298644ba29aeb2

SHA256
5d70c8623ff6d7b100f07e51699066f6479ba65110c22b49093d63fd1ef1f9b0

SHA512
e0c470b7aee1d3ac19899485430e2af023c58bd7f513541c386dc2286b91b54d46e01cc28ef8a28147122f71bbccc8e387779af1cd202d6b8163d83385c1a2b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ccf0d3c5cfc587fb664a1cb7be083fc

SHA1
c25df0351eed03431ec6e42cd4d3a833de3f8bcd

SHA256
9a8cc224811e6e24f9159499f424927182be012669dde178daf9849310ee7498

SHA512
fcb67733c7172d85154e2464a45e167aef0ade35d72929947bfe94d5eb043b908cbd7ae7f1479e2963c4b745a59e0edc2e9e95333d92ffb60e751e68d72bab51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d5409d0e7a6b2d72dcf1ea3c3ad6679

SHA1
e339be77685901f913c29d24cf449718a395adba

SHA256
eb8f993ef489bdbac9ad9268dc788ea9c4f5cabcd4e2f8db6ea6640eb8cc2a31

SHA512
f31b55df3781f4ce25ca4f121760f778ebf822f094ba6641fbe32f29998b26526248871228578b827a323a0acc8e142c4afabdccca283f7aad1293076a3be8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e79d37bc75aae68ccbda3f65f5781c3

SHA1
0536654dd17fe85087622e1ee19ad5ad752c2c4f

SHA256
b86631c9ba0f0cb062a7477da67c5a9263a06acbc5dcae262fd3543858350887

SHA512
6e2bb86c7fd9ef8f8c9573a0160490d72e2784cff7465a7b17ebcff3968399437045e261e86647242f4cee7bd6b639399df2e8442e5d68ef011b8bb66accc4d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4f5c5b9ab28abec152fef70160ba65e2

SHA1
a3e9c8f81f72e059d3ac00f31e33a00c66cd94be

SHA256
f455a6547dc06bd8810d62dafcecb341311d9683635f20931fffd1e19a474f32

SHA512
7240fe62ca3f6dd3b17d167e06ece6d1e2732bb7b93a719be5665053050f78782ffcc797777dcb3ad83279fbda46f3d23fe80e4fc1c29f96bf0dfb373919a9a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\116a2459d02c031f944714e6f3f3a77cb3eadb79\a7b3ad0f-44cf-4b79-ba28-13cdf759b9f8\index-dir\the-real-index

Filesize
72B

MD5
19a63907cb2fd15a9358670f6ea3706b

SHA1
4eaef07ba5c7eda0620c1b068b6d3af81b1ed6db

SHA256
948bf945578fa34e2f59521929396e2732ca2352dcd8137193c41ca80d33b562

SHA512
9ccbc27868cd8fbe6adbdba38ae0e8490ff4c3544432fe71422cc9b85d23ce62a57187591becac105fb643a8c845c0d261af4a3695448b5c50dc9a9fddafbb6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\116a2459d02c031f944714e6f3f3a77cb3eadb79\a7b3ad0f-44cf-4b79-ba28-13cdf759b9f8\index-dir\the-real-index~RFe59c615.TMP

Filesize
48B

MD5
48df9d53f625f61702c751c60aa14f9e

SHA1
33c3888f1ef825f2c0ddcfa54a9d8ec6e20b23a7

SHA256
1d5b93a72dd70b50316f915c9d7309cd18b09858efb3aff4c8e4b7dfad173415

SHA512
0c525e6c1caf494f8b130c4116834965d5550b831f15dff53598f170c031c982f47e2d852c1cb6d15f37ed6905bbb7ca14b3f11f7a90d8c1a556b0d41aead4ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\116a2459d02c031f944714e6f3f3a77cb3eadb79\index.txt

Filesize
90B

MD5
9a66429873abad487415cf69b237acd2

SHA1
ac146cc097120bc78448feafde67af02907388de

SHA256
7a240021ae749a29c7e21dae660c5aa9b5a61541c6eafcfa1b959955502a81d2

SHA512
29a5219e37d2e60571d951cdd54c57da4ef77d4ca2ad370afa09970ea391d2f7e7c30d9a398e9eb1894ecfb0c6cce9c32d6156df68f8cf1c72e23d48ffdc5d4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\116a2459d02c031f944714e6f3f3a77cb3eadb79\index.txt

Filesize
84B

MD5
bde9a52f3dfff8e514997273caadfa80

SHA1
6c82ed6a3b7ec02e9d7d74148b446a03f67ea26c

SHA256
aefe82221fb8c23086b75b0ec89d0c9298c491b5b9c1fc0596e31da89e08b548

SHA512
050f8c3b1dc735c4319706e44398753ad5b21f14bf8de554902ee5a4c9fe75b7ac9009d9aa780972e3bbc0bdbdc4f0ab71be93c70af3ffc5c93ff134f36bca83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
59ac06d7fa0ae7e9501b4b797307fca9

SHA1
155242ddbfc3241685e10a55d030d7d9e02902c5

SHA256
95629c1fd6e661165fe3f62ed7a626c7fc6c15449edc6f0cc5a5d78c73020fc0

SHA512
8b6148b6099f1dd73526fb2ff2cf2ec5e0ef5c0fbe6f6f1a691b6b01dba9c4f01ab263a98f0eea65e061ec9f8cd4125ea72e1f0e61f7ce064513a140061002cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c50b.TMP

Filesize
48B

MD5
49a2bb57b50d62a51bca808dbdc8a8c3

SHA1
39afa86a0ca01e8ba594a9d4bc0944e9c39c1134

SHA256
656918fd2ec2735582efe0943e392eb0063c4a8088024d286859f85f4856ec47

SHA512
20a6030a775034fa061309c80328b4635053d360a46749909d58f31e846f04453ea294ca82a85ae23b6619348e4fb92b2513c85bbdb024d2fc115c5b302f5fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e0932ca012ab05ba33d9d33257b55223

SHA1
be7fc9af89e253b463028d0540ba747f31d9cf3b

SHA256
359ad86fd79f38681e1cc262e02d47b7bb71f491fed62c9c554661d65ff6d6bd

SHA512
8e52c3e4b04410b9ad34718fc5b1ebd57940568fe14e064a29eb571138ec76e0ecf3519b09fb7b127fa36c6358155d3cc321e4d574857bd62e02faf6002c4dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59aeb5.TMP

Filesize
1KB

MD5
709ca3c1ce3f3ec8ba8017bc481eb353

SHA1
2e05708e6d77c8e84d55b43fde16602da840626c

SHA256
13cab7b4b467254d4929bea4cd93be3042aebc997b0c2d99b7af981fa7ff2d73

SHA512
3be99290eed7e0ba1aa5e6bb2bbe47bb6c6330924619a44764fdd505c5811fe71e46db916907be17d9bd3b9cc23a646c7801923d41361d526445c09ad326624a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cbd9f357dbe5cc4f84be230a93225fc2

SHA1
0c808d0ea725f9ccd49f5f9f0c8ccf25e7c5d295

SHA256
a2c2abeca8ca272bce240a7e9e7a86937736fc2b9b5515dcf85fa4a50b556362

SHA512
13819afe932df6ea3cc084dc4bcd473cd34919eff5c2b6dc435eb3323f26c0e170ae6c8e5dacb45f2a9692e2b8f8d10a1f564c729f1a2127e8b4fb8f3cd1a34c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7643fd2acd0b16876ffeee67e53d7e6c

SHA1
fd8b6cb5678c5190551773e07c5e69216e04a56d

SHA256
9275524bda620f9ba556aaaf3078cbf49e4329bc0de8be6d8065776acd487ed7

SHA512
4218f56350d35d39bd41a046f8270176914b0113be841a48676e0ab681b59041fc9fe5e9e5c1ff06e466121fc4a57e12f6f957e21be24a749fdc2f1a3de89b7a

Download Submit