Overview
overview
10Static
static
10Debug/Crystal.exe
windows7-x64
10Debug/Crystal.exe
windows10-2004-x64
10Debug/Crys...re.dll
windows7-x64
1Debug/Crys...re.dll
windows10-2004-x64
1Debug/Crys...pet.js
windows7-x64
3Debug/Crys...pet.js
windows10-2004-x64
3Debug/Guna.UI2.dll
windows7-x64
1Debug/Guna.UI2.dll
windows10-2004-x64
1Debug/Micr...re.dll
windows7-x64
1Debug/Micr...re.dll
windows10-2004-x64
1Debug/Micr...ms.dll
windows7-x64
1Debug/Micr...ms.dll
windows10-2004-x64
1Debug/Micr...pf.dll
windows7-x64
1Debug/Micr...pf.dll
windows10-2004-x64
1Debug/Monaco/fgd.html
windows7-x64
1Debug/Monaco/fgd.html
windows10-2004-x64
6Debug/Mona...dex.js
windows7-x64
3Debug/Mona...dex.js
windows10-2004-x64
3Debug/Mona...n/mime
ubuntu-18.04-amd64
3Debug/Mona...n/mime
debian-9-armhf
1Debug/Mona...n/mime
debian-9-mips
Debug/Mona...n/mime
debian-9-mipsel
Debug/Mona...me.cmd
windows7-x64
1Debug/Mona...me.cmd
windows10-2004-x64
1Debug/Mona...me.ps1
ubuntu-18.04-amd64
1Debug/Mona...me.ps1
debian-9-armhf
1Debug/Mona...me.ps1
debian-9-mips
Debug/Mona...me.ps1
debian-9-mipsel
Debug/Mona...DME.js
windows7-x64
3Debug/Mona...DME.js
windows10-2004-x64
3Debug/Mona...dex.js
windows7-x64
3Debug/Mona...dex.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 01:03
Behavioral task
behavioral1
Sample
Debug/Crystal.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
Debug/Crystal.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Debug/Crystal.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral4
Sample
Debug/Crystal.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Debug/Crystal.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.52/adblock_snippet.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral6
Sample
Debug/Crystal.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.52/adblock_snippet.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Debug/Guna.UI2.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
Debug/Guna.UI2.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Debug/Microsoft.Web.WebView2.Core.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral10
Sample
Debug/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Debug/Microsoft.Web.WebView2.WinForms.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral12
Sample
Debug/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Debug/Microsoft.Web.WebView2.Wpf.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral14
Sample
Debug/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Debug/Monaco/fgd.html
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral16
Sample
Debug/Monaco/fgd.html
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Debug/Monaco/fileaccess/index.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral18
Sample
Debug/Monaco/fileaccess/index.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral21
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral22
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime.cmd
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime.cmd
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime.ps1
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime.ps1
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral27
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime.ps1
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral28
Sample
Debug/Monaco/fileaccess/node_modules/.bin/mime.ps1
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral29
Sample
Debug/Monaco/fileaccess/node_modules/accepts/README.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
Debug/Monaco/fileaccess/node_modules/accepts/README.js
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Debug/Monaco/fileaccess/node_modules/accepts/index.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral32
Sample
Debug/Monaco/fileaccess/node_modules/accepts/index.js
Resource
win10v2004-20240611-en
windows10-2004-x64
General
- Target Debug/Monaco/fgd.html
- Size 18KB
- Sample240615-begetstcmg
- SHA256 a6897302dba619dd3c156d57fc4b706662bff4df582975c33478b7878b060d2c
- MD5 a1416c1fe209f7687ff79ab44301b3d3
- SHA1 3ba3ff0027a98128edad78f5561cef53c4236791
- SHA512 ce8a9aaf7ba903dfb25df53e04addfedae7ee4fcd07dffd42abf3f275a75b14cb26bb64c9320fd425003c73618b2967bb7be2cfb849050d50dd5308e69842f79
- SSDEEP 384:fihTARA5Lmwl1qPeVvW4NVtabVBJjVBd+TI6noaQLR7:fihTjoy+StabVBJ/kkgoaQLR7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 46 raw.githubusercontent.com 47 raw.githubusercontent.com - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1096 msedge.exe 1096 msedge.exe 3268 msedge.exe 3268 msedge.exe 1144 identity_helper.exe 1144 identity_helper.exe 5048 msedge.exe 5048 msedge.exe 5048 msedge.exe 5048 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3268 wrote to memory of 4636 3268 msedge.exe 82 PID 3268 wrote to memory of 4636 3268 msedge.exe 82 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 4120 3268 msedge.exe 83 PID 3268 wrote to memory of 1096 3268 msedge.exe 84 PID 3268 wrote to memory of 1096 3268 msedge.exe 84 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85 PID 3268 wrote to memory of 2704 3268 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Debug\Monaco\fgd.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd1b546f8,0x7fffd1b54708,0x7fffd1b547182⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:1608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:12⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,11370924406120318390,9960453043997841524,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5608 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4544
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
- MD5 81e892ca5c5683efdf9135fe0f2adb15
- SHA1 39159b30226d98a465ece1da28dc87088b20ecad
- SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
- MD5 56067634f68231081c4bd5bdbfcc202f
- SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
- SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 746B
- SHA256 a5cc471b8013b7a43afddc097d65085cf573f384bae2e628c66bf8bafc86aa93
- MD5 39e1886b2027015dee80420792edd4f6
- SHA1 179328065bc52d99b05b0ec510ae1b4cab445308
- SHA512 c608081a642026dbe203417dfaf66bf8be2cab2e5cc3f4db138eae195bde949eb3979138c13d662375f9cb0ae984ddbc1a87bc3b98689773c8bcd7628090f549
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 2094df65ec0df7d96097880f09a184a45ac1ed0499382abcf73fa650c714f6c9
- MD5 5f52b2c72db4d82910f3ddf393894577
- SHA1 dfd97cd823ffd7017889be33247cde8e3bf11989
- SHA512 2ef544ceed899b7ed2f9c53e1f905e43138df3a2048bd141ccc6485837074d8fc13df6384886c66449d8501c985fed5e01ae532b485b57180f6e4f3424601f71
- SSDEEP 96:nnk/oxm/DQYmqOs1EQswpvWMoiVmdeHIqQFvQfUWQyV+VDCziEwb:nnkBIg1sGWMXdcYfro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 840c018e134f17c7459d64ce645d9a8b071926c178128313a8fe3706fa407453
- MD5 7f1484cee6b5417a241e1b658394175f
- SHA1 804fe5c54704358b78b567a7778fccc2e8f6b1d7
- SHA512 604c16f3de52b88c4d8f871520a51e661eb5a434b3dfc34fa0a346b8f226b5032c086a989e9e6aa93093b74ec9a0748d2343eb74894980ae042566539d77c0d7
- SSDEEP 96:nnk/oxm/DnmqOs1EQswpvWMoiVmdeHIqQFvQfUWQyV+VD7AiEwb:nnkB6g1sGWMXdcYfrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d219c3353d62fff854d2338e4a82570cd1482d75ad3b165d94257cabe03cf536
- MD5 e4d5a5d1cf43613ae1db301b07b08e89
- SHA1 624ffcd3d389bf0532b94d5dada10373bb60fcb5
- SHA512 1b79618db7b5c827eb835856a177559e7986629aaafa3c372db9a8faa5d0cb9bd01135c035478e5a0a9bc4c3f49f3650135a794775a87fcbf747c871602be78a
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNzp02e2RUqdvL3z2OMDCRx:A9iIxuERzA83h09RZxYNqY5LaOMWRHq+
- MD5 SHA1 SHA512 SSDEEP