Overview
overview
3Static
static
1UCenter_Ho...it.ps1
windows7-x64
3UCenter_Ho...it.ps1
windows10-2004-x64
3UCenter_Ho...cy.ps1
windows7-x64
3UCenter_Ho...cy.ps1
windows10-2004-x64
3UCenter_Ho...up.ps1
windows7-x64
3UCenter_Ho...up.ps1
windows10-2004-x64
3UCenter_Ho...ex.htm
windows7-x64
3UCenter_Ho...ex.htm
windows10-2004-x64
3UCenter_Ho...ad.htm
windows7-x64
3UCenter_Ho...ad.htm
windows10-2004-x64
3UCenter_Ho...um.htm
windows7-x64
3UCenter_Ho...um.htm
windows10-2004-x64
3UCenter_Ho...pp.htm
windows7-x64
3UCenter_Ho...pp.htm
windows10-2004-x64
3UCenter_Ho...up.htm
windows7-x64
3UCenter_Ho...up.htm
windows10-2004-x64
3UCenter_Ho...ck.htm
windows7-x64
3UCenter_Ho...ck.htm
windows10-2004-x64
3UCenter_Ho...og.htm
windows7-x64
3UCenter_Ho...og.htm
windows10-2004-x64
3UCenter_Ho...he.htm
windows7-x64
3UCenter_Ho...he.htm
windows10-2004-x64
3UCenter_Ho...or.htm
windows7-x64
3UCenter_Ho...or.htm
windows10-2004-x64
3UCenter_Ho...nt.htm
windows7-x64
3UCenter_Ho...nt.htm
windows10-2004-x64
3UCenter_Ho...ig.htm
windows7-x64
3UCenter_Ho...ig.htm
windows10-2004-x64
3UCenter_Ho...it.htm
windows7-x64
3UCenter_Ho...it.htm
windows10-2004-x64
3UCenter_Ho...on.htm
windows7-x64
3UCenter_Ho...on.htm
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2024 16:25
Static task
static1
Behavioral task
behavioral1
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/admincp_credit.ps1
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/admincp_credit.ps1
Resource
win10v2004-20240730-en
Behavioral task
behavioral3
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/admincp_privacy.ps1
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/admincp_privacy.ps1
Resource
win10v2004-20240730-en
Behavioral task
behavioral5
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/admincp_usergroup.ps1
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/admincp_usergroup.ps1
Resource
win10v2004-20240730-en
Behavioral task
behavioral7
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/index.htm
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/index.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral9
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/ad.htm
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/ad.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral11
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/album.htm
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/album.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral13
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/app.htm
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/app.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral15
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/backup.htm
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/backup.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral17
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/block.htm
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/block.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral19
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/blog.htm
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/blog.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral21
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/cache.htm
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/cache.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral23
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/censor.htm
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/censor.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral25
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/comment.htm
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/comment.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral27
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/config.htm
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/config.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral29
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/credit.htm
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/credit.htm
Resource
win10v2004-20240730-en
Behavioral task
behavioral31
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/cron.htm
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/cron.htm
Resource
win10v2004-20240730-en
General
-
Target
UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/comment.htm
-
Size
3KB
-
MD5
c584290dc5eb85bea24fe5bbaa660ed9
-
SHA1
7827c3614d4d99c1a12030c3b7c569620485d8c5
-
SHA256
d032ce7380133e206a287599a6f214a97c9d832baa71fd8f6aa94686830fc47a
-
SHA512
2622b72bdb27a42b715427abc619577060a07b5017501377d3a84ce81ee6f8e76a4e20eaef5561a3eb83d19cabe4485da4234c0172f25b5b1742eaa9c9ccc4f7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2948 msedge.exe 2948 msedge.exe 1084 msedge.exe 1084 msedge.exe 2332 identity_helper.exe 2332 identity_helper.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1084 wrote to memory of 1204 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 1204 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 264 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 2948 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 2948 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe PID 1084 wrote to memory of 3132 1084 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\UCenter_Home_1.5RC1_SC_utf8\upload\admin\tpl\comment.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb78f46f8,0x7ffbb78f4708,0x7ffbb78f47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,7028645746922762281,2831392611592714631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5124 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f424846d13eef75a8065348e647b5c3a
SHA1be8a5c387e75f166f933402aca3f6e6f2129e4cf
SHA25640be99629f284d8f3b43c24811b93d372757306f37adbaa90e785ff2604f52cf
SHA512ffb2097c52a3baf18361348787dcb92cd10da54a25d85600184b0182d50f08420d91ac031141871868602ca788cd0eac66e302e8ecce220b2f707f8741e3d178
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56c3a0da38ed31721bf66a6e7519f300a
SHA1db05166b0c96c42e4f89402f1eecb0ce00c5ff7a
SHA256e13bc70f7eee42221ce6f2ebe017538484dbc6ec1059450cae7c579dcb8e6199
SHA512c38a4e591360ae323d9be207ce2af8375ce3797bd16c3da2b8ed96c480d64fd1fd3062b1cd178f7be2f01477b68fa3404c021903c51abaecc90881f96bec76f6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57a62e5c3bb8b4e137805d9e759ee89b5
SHA17fc8f6ea01ed8eef95c272c4dd7f533bd4a48aea
SHA2564d317b454b49ac5f5825c40e62fe07fdfc8f475a45c8fbe917c31a3ac85022f6
SHA51263162786d2b2f8a421865bc1747f05ac62488f715adad2bbd24dd77531e64192cb765b94fd9aac719c2c4ec5f23a67dffc995cd31f9e7a0d075d98c88769852b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD502d594bd1ffdf5845ed9f6e012c481d1
SHA1df671e9acd3d86c1415f66197fd3688d5dd10761
SHA256b2b1ba5fb537297aa3a98ff06237f336c5d23f85a8ca503c3cbab13d3c5f3050
SHA51228ddd78623cb54d9524b4054736ba00c9f2bf406cc5809c50cab3b97d26ea9c2c7dde5ad0aa0d0b52715c53a44fedadf54c2c9fd5f98b8c5aea2a05e0914ab8d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5fa17e70c427c3c56e2eed170c56a6a5d
SHA111f6a9c1414a5e1b374e477f898a0074931b10c2
SHA256df6c6fa14c628282166a42980be26f5ffacbd1d8570d323b86222cb540c6883d
SHA51253c407da01d3f70b5ba3135c4540c021f30928ba61e443df164c4073d016c7b2afe41342e0db2d641c01221c85f6cfb8939f330fb294d5d3e51b75cc60d71782
-
\??\pipe\LOCAL\crashpad_1084_BWXBIBPXZSEVXTQHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e