hxxp://klar[.]gg/loader

Resubmissions

10/08/2024, 13:31

240810-qstpms1epr 8

10/08/2024, 13:29

240810-qrb37s1ejn 8

Analysis

max time kernel
71s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://klar.gg/loader

Score

8^/10

discovery vmprotect

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1984	Loader.exe
5424	4Q2GV1DNLS.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0007000000023473-88.dat	vmprotect
behavioral1/memory/1984-129-0x00007FF7D1D30000-0x00007FF7D2713000-memory.dmp	vmprotect
behavioral1/files/0x0008000000023488-155.dat	vmprotect
behavioral1/memory/5424-157-0x00007FF7AB840000-0x00007FF7AC22C000-memory.dmp	vmprotect

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5496	PING.EXE
5436	cmd.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	cmd.exe
3968	net.exe
2036	net1.exe
5536	cmd.exe
5552	net.exe
5568	net1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2036	ipconfig.exe
3044	ipconfig.exe
5700	ipconfig.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1076	taskkill.exe
5636	taskkill.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 863050.crdownload:SmartScreen	msedge.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5496	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
4556	msedge.exe
4556	msedge.exe
2940	identity_helper.exe
2940	identity_helper.exe
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	5636	taskkill.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1984	Loader.exe
1984	Loader.exe
5424	4Q2GV1DNLS.exe
5424	4Q2GV1DNLS.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3080	4556	msedge.exe	84
PID 4556 wrote to memory of 3080	4556	msedge.exe	84
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 788	4556	msedge.exe	85
PID 4556 wrote to memory of 60	4556	msedge.exe	86
PID 4556 wrote to memory of 60	4556	msedge.exe	86
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87
PID 4556 wrote to memory of 4268	4556	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://klar.gg/loader
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb022d46f8,0x7ffb022d4708,0x7ffb022d4718
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net start w32time
    3⤵
    - System Time Discovery
    PID:4588
  - - C:\Windows\system32\net.exe
      net start w32time
      4⤵
      System Time Discovery
      PID:3968
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start w32time
        5⤵
        System Time Discovery
        
        PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c w32tm /resync /nowait
    3⤵
    PID:2724
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync /nowait
      4⤵
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /IM RainbowSix.exe /f
    3⤵
    PID:4960
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM RainbowSix.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /flushdns
    3⤵
    PID:4244
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /flushdns
    3⤵
    PID:4592
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:3044
- - C:\Users\Admin\Downloads\4Q2GV1DNLS.exe
    "C:\Users\Admin\Downloads\4Q2GV1DNLS.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net start w32time
      4⤵
      System Time Discovery
      PID:5536
    - - C:\Windows\system32\net.exe
        
        net start w32time
        5⤵
        System Time Discovery
        
        PID:5552
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start w32time
        6⤵
        System Time Discovery
        
        PID:5568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c w32tm /resync /nowait
      4⤵
      PID:5584
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /resync /nowait
        5⤵
        
        PID:5600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /IM RainbowSix.exe /f
      4⤵
      PID:5620
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RainbowSix.exe /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /flushdns
      4⤵
      PID:5684
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /flushdns
        5⤵
        Gathers network information
        
        PID:5700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Downloads\Loader.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5436
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7273001918343195745,2326732959774243789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f469f3be7a185e45971e19acb064a0b3

SHA1
161bbf79c4359b09bec0150d3b04237ae4bf1a44

SHA256
02fd2c46c6ff7c93461c9e9b42babd5d40ad727de729a80737d0f75b1c57a234

SHA512
df46535af2e673de068b91436b0b7e0694893373f4ec96e70dd7559a8c68182d2de2b93a956234bbf134b4e30ed2f7b2d74c4bf2b11e3036b5b103fdb00c78a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
942B

MD5
6e28b2ad98b3117323054a53c4c39291

SHA1
0bf2f6bdfbea9ce314435bb3dbfcc3f8df7c6720

SHA256
251470b3696475e92b1d717f1af29e4fded90f96740234c93986408466d796c6

SHA512
36f36a789a88ddf301b0469211ccbd6be3ed0b56d4c11f5b5213bc10aa0dd765310e79a9d7af03a2c1b5f52b5027a6da3547747bb810a39bc30417532fc1c9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02ecbfecb4a56b5a8be38adb5b1afbae

SHA1
b2b4434d3353647a540eb66bf3b5b7aa2353403e

SHA256
f1eed28078225749ce163f2999c7099c466ab9518c76b15d80d46046a7dd61d1

SHA512
44a9014861a7bdca59de9434371ce837ad7749e5bb12066628b5499e59a7332a992b0669b30d272625a8f2076112fa87e68d26475dcc965e76adead5527aa56b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
816a310cb643233bdc4007a8d07743de

SHA1
ac699283fad8063d6b0eba3143a3d745efaf3c3b

SHA256
839e6bdbbc49109d4dbc37dc909bf5b8c1ada541a819e99ac190966cf36c8129

SHA512
c4815b6c3c7627caebf17cfe229b841053b4e54c7fd506d9e97d2c2d444226a667719aa3450dcb9bac2b9eb7ba5e95d2bb84b234417a26c5c6e6d49a6e67967b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a299141e354264db521be3f88b0cfa67

SHA1
ef7791a8fdecc09e38938c2da99965932a997460

SHA256
dd80d24299b444140581f26f66db020640ff9be4a4c5e611993e570179126445

SHA512
ceec5443ab477e2d02f965374f5ded0b8ad135206be7e6fecd7c4e5698e20093ac8c73711728e44c13a2e64ba1399f437e4d892890c10f225399486f4905aa56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ddee41b875c585abb0924f2904ee2f0c

SHA1
aa02f7632480f9c79701ac1899bd0c5fa7586b6f

SHA256
f7b584ab4b6ad9332d0380045348e931a65f7006857d41c0372211ddcec8e5ca

SHA512
562abf3eeffd021dc6cf4212f22165388d989b08faa0be4968933d20cf0910d3054e6ce8a48a07dd51236a56fa323d5b4ccef115790ce67433a633c9543adb45

Download Submit
C:\Users\Admin\Downloads\4Q2GV1DNLS.exe

Filesize
4.9MB

MD5
6261ee4279a2f896625ca965ad014fb7

SHA1
0bbd43aed75d13993e364cd7e26393d2b4fefb50

SHA256
5b36923b5ab87c82b33614790f2ab2add6b8675ebd27ba278f1eaf2499848cdd

SHA512
40d39aa83b603ec5b9b2260d9976663decdf49799e6387b7f4a557e6e5662e5246b75ec97507af4c117cd6aafbd9ebb332f705961e50fd68830df19dd9bbd3f8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 863050.crdownload

Filesize
4.9MB

MD5
c01c4d326d65d94e05361c30821b2dbd

SHA1
16c0e2a2dff1e06cbdc5036d13a7444edc469193

SHA256
6a79b18a0b6ce048bd93586272612296073c5b7c252e13f378914a9d2d7fc9a2

SHA512
69ef9d5870d76e8175f5749b8ab24e9574c021fa8c2a0b0ea088bcd2ad93373efac252295395eb6f0d5896474d9f22275948dd79baded12a634e97e72f50abed

Download Submit
memory/1984-129-0x00007FF7D1D30000-0x00007FF7D2713000-memory.dmp

Filesize
9.9MB

Download
memory/5424-157-0x00007FF7AB840000-0x00007FF7AC22C000-memory.dmp

Filesize
9.9MB

Download