hxxps://l[.]facebook[.]com/l[.]php?u=https%3A%2F%2FnewsamericansRfdTByA[.]100days[.]us%2Futm%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0avesGJvM71IK4yVMdQD1RRwAluiYlEloOF3zE13rSmM-0xcqmz1IUgGg_aem_AeKxB7toLQUr4u9KXIl9V2IZ9WYcwctV0-nXF1V-ZYVZsxG7nQxEpDoU70DOApVVRCv38v6-u9SHgKRMwVqjYh8a&h=AT1hvVaVfFHrIyqSnCpp4be-WyzH7crRtaSxNxewQu3dsiLrKaG8yq2Q-bqRotFguj5mbow074ri5KqF3ToFeMdwJK73nblVtwqdQtNs0LtNXLJcj_oiclT4blCftVpvug&__tn__=R]-R&c0=AT3Hch7-mf1vB-AUs6xOmd82aBA-9QOWHFgmNDZEtG7FQFwgWg_R6RvcvSbqTRDc53WkUTFFvVsatMV9_dbSPT3yfB7hmyk5uTqABgkCrSbpFqXnDd1qaZyA-4TJvjW5lOXxob9lC9TzvqA8eiaqKZKbjKKynyfMREjLlcCs9sL4dXszwWD0QjvJrFXaqADylvnNxPm8BVpbGvT8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://l.facebook.com/l.php?u=https%3A%2F%2FnewsamericansRfdTByA.100days.us%2Futm%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0avesGJvM71IK4yVMdQD1RRwAluiYlEloOF3zE13rSmM-0xcqmz1IUgGg_aem_AeKxB7toLQUr4u9KXIl9V2IZ9WYcwctV0-nXF1V-ZYVZsxG7nQxEpDoU70DOApVVRCv38v6-u9SHgKRMwVqjYh8a&h=AT1hvVaVfFHrIyqSnCpp4be-WyzH7crRtaSxNxewQu3dsiLrKaG8yq2Q-bqRotFguj5mbow074ri5KqF3ToFeMdwJK73nblVtwqdQtNs0LtNXLJcj_oiclT4blCftVpvug&__tn__=R]-R&c0=AT3Hch7-mf1vB-AUs6xOmd82aBA-9QOWHFgmNDZEtG7FQFwgWg_R6RvcvSbqTRDc53WkUTFFvVsatMV9_dbSPT3yfB7hmyk5uTqABgkCrSbpFqXnDd1qaZyA-4TJvjW5lOXxob9lC9TzvqA8eiaqKZKbjKKynyfMREjLlcCs9sL4dXszwWD0QjvJrFXaqADylvnNxPm8BVpbGvT8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
1316	msedge.exe
1316	msedge.exe
4116	identity_helper.exe
4116	identity_helper.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2696	1316	msedge.exe	85
PID 1316 wrote to memory of 2696	1316	msedge.exe	85
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 2132	1316	msedge.exe	86
PID 1316 wrote to memory of 4608	1316	msedge.exe	87
PID 1316 wrote to memory of 4608	1316	msedge.exe	87
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88
PID 1316 wrote to memory of 5052	1316	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://l.facebook.com/l.php?u=https%3A%2F%2FnewsamericansRfdTByA.100days.us%2Futm%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0avesGJvM71IK4yVMdQD1RRwAluiYlEloOF3zE13rSmM-0xcqmz1IUgGg_aem_AeKxB7toLQUr4u9KXIl9V2IZ9WYcwctV0-nXF1V-ZYVZsxG7nQxEpDoU70DOApVVRCv38v6-u9SHgKRMwVqjYh8a&h=AT1hvVaVfFHrIyqSnCpp4be-WyzH7crRtaSxNxewQu3dsiLrKaG8yq2Q-bqRotFguj5mbow074ri5KqF3ToFeMdwJK73nblVtwqdQtNs0LtNXLJcj_oiclT4blCftVpvug&__tn__=R]-R&c0=AT3Hch7-mf1vB-AUs6xOmd82aBA-9QOWHFgmNDZEtG7FQFwgWg_R6RvcvSbqTRDc53WkUTFFvVsatMV9_dbSPT3yfB7hmyk5uTqABgkCrSbpFqXnDd1qaZyA-4TJvjW5lOXxob9lC9TzvqA8eiaqKZKbjKKynyfMREjLlcCs9sL4dXszwWD0QjvJrFXaqADylvnNxPm8BVpbGvT8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2ebd46f8,0x7ffb2ebd4708,0x7ffb2ebd4718
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4314333647888384390,12868183663342890802,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b9863082789b2acccfd13f09ab20f5ce

SHA1
81bde5117a04d4f4459b03ba763260d3126de767

SHA256
e3a01009dd1ef3442c90e7569c5aad5d31289a19b088a9c65ab2f291d8d78c05

SHA512
cd9b0b7bd767b6cd8f5770e9e9ad8bb727b40bb9b238976859289336fe87f8b13a1f64806a1cbd64672575e3fc88dcb2c44b91320b2dba093157e39c2575c01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
333B

MD5
32d71f876d1c7e52cff92583c40f6b40

SHA1
b113b81025aa9eab93cb8e39e31cf3cbad039fe8

SHA256
a8ddaa6f7bbaf8047807c37297d28fe8398ad29279160164ab65e508163c0472

SHA512
6316391892cad7a8e5888ec7feab9cfe2ac2c5d57ddfe734ec119340b0de42055367ed605b51acde219ebfa38e807fd41abe657028a2e0129b255b2edb20880d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68bd6cd43858ac6cac26e940f205f8b0

SHA1
2aef3e24bb1548fa86a273b0f891d8f4ac71cda4

SHA256
eb17c55604ac021c5a7e6238b6d73cb8648fd1493f28298f2dc1f9e6731f2699

SHA512
ed9c2a19689592b022dfe1f914f08ba8b4059833db858809f746c9d6aa63d4f81a2b330db9d22d311fe76f87c9495970445f99657e1c4246cbce1183625eb81a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
12624f604922df657021ba70d98956ac

SHA1
a8b3947055596c512622af7b7ee1c3a8dc915eb9

SHA256
3eeeaf4e284b8c9f17f93bbb0e34a13f57c197451ce872eae1894300dfdd8aca

SHA512
3f73eb83bcd555e99c627e0a6cd9d35347d5de1e713bcb38d259a3cfdcfec23bc5e098b5570975c6954619f94754575d9b0633cfbc1a574a54fc5bccc7a2229f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
a6c1a98c03216185270f40bbeb08dd48

SHA1
17d8010e0bc37db450607b4b7485e8623f0852ec

SHA256
e6df46e9299a169ba12c70b8dbfe0b6370f68dcb988f8bbeea47c451bb082913

SHA512
a0bcc9ea0a02b8e6c14c2bb495e7e0f831b41932a9ffe6e42a359cf8ecdc26c526db3bac4463251d31345f4e77dcead931f038249d2bfb78cf36749549affdea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57cbbc.TMP

Filesize
48B

MD5
fc733f7345a46713f28ba7c7eb50d58b

SHA1
5a684aa519e944e8f956c937213108d53645a630

SHA256
cd5b9c0f1578ab6e33b236ee4c08632fbc59e35dca26b3dfda7066820c4399a4

SHA512
75ca10ce9f01f8051cbac631545fd046f544d8f76e508c687ef5eaae59e8df46b89b299ee9ced7e3dc153a874ec488b48fdbf4e3f14f58d64e2aac2cdeb89674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e62577f28d4c9f5bfd6270c107ad2a08

SHA1
4f05a98dfaf1d0f7b5a4fc24abebcce6fe27a98d

SHA256
4d142362eb3d23aa0acebd7f7affe2de8085e40a562bf93105981ea278033ecc

SHA512
e501386450148a8e70b8f3897f83c12509713c991c595b9bf16696e35b3b0250d98f4a7bbbd7b12692743ba24a507aa8eec0fb6bf969e1b20299d6c2572f3d39

Download Submit