Overview
overview
10Static
static
10FSCapture-...wn.url
windows7-x64
6FSCapture-...wn.url
windows10-2004-x64
3FSCapture-...on.dll
windows7-x64
3FSCapture-...on.dll
windows10-2004-x64
3FSCapture-...01.dll
windows7-x64
3FSCapture-...01.dll
windows10-2004-x64
3FSCapture-...02.exe
windows7-x64
1FSCapture-...02.exe
windows10-2004-x64
1FSCapture-...03.exe
windows7-x64
3FSCapture-...03.exe
windows10-2004-x64
3FSCapture-...04.exe
windows7-x64
3FSCapture-...04.exe
windows10-2004-x64
3FSCapture-...05.dll
windows7-x64
3FSCapture-...05.dll
windows10-2004-x64
3FSCapture-...re.exe
windows7-x64
3FSCapture-...re.exe
windows10-2004-x64
3FSCapture-...ir.exe
windows7-x64
3FSCapture-...ir.exe
windows10-2004-x64
3FSCapture-...us.exe
windows7-x64
3FSCapture-...us.exe
windows10-2004-x64
3FSCapture-...er.exe
windows7-x64
3FSCapture-...er.exe
windows10-2004-x64
3FSCapture-...uv.dll
windows7-x64
3FSCapture-...uv.dll
windows10-2004-x64
3FSCapture-...bp.dll
windows7-x64
3FSCapture-...bp.dll
windows10-2004-x64
3FSCapture-...ng.bat
windows7-x64
10FSCapture-...ng.bat
windows10-2004-x64
10FSCapture-...se.exe
windows7-x64
10FSCapture-...se.exe
windows10-2004-x64
10FSCapture-...64.sys
windows7-x64
1FSCapture-...64.sys
windows10-2004-x64
1Analysis
- max time kernel
142s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
04/11/2024, 04:46
Behavioral task
behavioral1
Sample
FSCapture-10.5-CN/bin/423Down.url
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
FSCapture-10.5-CN/bin/423Down.url
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
FSCapture-10.5-CN/bin/FSCIcon.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
FSCapture-10.5-CN/bin/FSCIcon.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
FSCapture-10.5-CN/bin/FSCPlugin01.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
FSCapture-10.5-CN/bin/FSCPlugin01.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
FSCapture-10.5-CN/bin/FSCPlugin02.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
FSCapture-10.5-CN/bin/FSCPlugin02.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
FSCapture-10.5-CN/bin/FSCPlugin03.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
FSCapture-10.5-CN/bin/FSCPlugin04.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
FSCapture-10.5-CN/bin/FSCPlugin04.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
FSCapture-10.5-CN/bin/FSCPlugin05.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
FSCapture-10.5-CN/bin/FSCPlugin05.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
FSCapture-10.5-CN/bin/FSCapture.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
FSCapture-10.5-CN/bin/FSCapture.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral17
Sample
FSCapture-10.5-CN/bin/FSCrossHair.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
FSCapture-10.5-CN/bin/FSCrossHair.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
FSCapture-10.5-CN/bin/FSFocus.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
FSCapture-10.5-CN/bin/FSFocus.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
FSCapture-10.5-CN/bin/FSRecorder.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
FSCapture-10.5-CN/bin/FSRecorder.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
FSCapture-10.5-CN/bin/libsharpyuv.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
FSCapture-10.5-CN/bin/libsharpyuv.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
FSCapture-10.5-CN/bin/libwebp.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
FSCapture-10.5-CN/bin/libwebp.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral28
Sample
FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target FSCapture-10.5-CN/bin/423Down.url
- Size 209B
- Sample241104-fd1jjatjay
- SHA256 93585a844b68e62ad7aa69b013b7f10d8b949a7f35af0b9b6b823aa526f7af8f
- MD5 6d2178f6fbf26d009562415daf5a2cb7
- SHA1 60804c9f71460d19cbf5a7b30f5d467c7547803c
- SHA512 95a39fd75abd54dd017b229fdbccb522bd78113ec80586e5ddf81d9787e854853535f983b9bedbcad4ae0d54c792c97721ab93a454ee513622e52a81474b2fd3
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 468 msedge.exe 468 msedge.exe 860 msedge.exe 860 msedge.exe 3824 identity_helper.exe 3824 identity_helper.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 860 4824 rundll32.exe 84 PID 4824 wrote to memory of 860 4824 rundll32.exe 84 PID 860 wrote to memory of 2856 860 msedge.exe 86 PID 860 wrote to memory of 2856 860 msedge.exe 86 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 4652 860 msedge.exe 87 PID 860 wrote to memory of 468 860 msedge.exe 88 PID 860 wrote to memory of 468 860 msedge.exe 88 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89 PID 860 wrote to memory of 1448 860 msedge.exe 89
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\FSCapture-10.5-CN\bin\423Down.url1⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.423down.com/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcb55446f8,0x7ffcb5544708,0x7ffcb55447183⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:23⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:83⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:13⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:83⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:13⤵PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:13⤵PID:384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:13⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:13⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14640341848029947894,1071121887729062691,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5488 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4316
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
- MD5 b8880802fc2bb880a7a869faa01315b0
- SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
- SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
- MD5 ba6ef346187b40694d493da98d5da979
- SHA1 643c15bec043f8673943885199bb06cd1652ee37
- SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 192B
- SHA256 14904cf6f4a2f67f91aff0454943fa3bcbd35391e7b44932a0078f2715467f9c
- MD5 253eb772779c731bfe540f3302b3bc66
- SHA1 618b12325ab860e96e6e43f5fb5d98e56e9b095d
- SHA512 fe21a9f23f5c9bac6d136d907a0798f39949b1514fa6b0037eb900b552ea0e2aa7ec1901acdf54dbe69d6817ee43f0273d7954a82a35da93b73448decf276158
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 6caf0b5bbc3af4a22496e3a0c2a8c97ea43fbc64b50de5d997282cfb716f41e1
- MD5 189c78f2753482b648413c706e58922c
- SHA1 d40894b900d3ac19566a48c2be7a7f16d0da044c
- SHA512 5191d691bc6bd14d92f19d46e7071a5cd47992e82de51111258a31a9b4f921c3e7d4aeac91f8a270166b315b100992dbc3eadd3f8d09ec80f8cefab00d20b04c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 e59db88d90a5e8a76c13f03a9303b8b4760d802ba04f8e6e9319ea5a7e8178f2
- MD5 7d060056d5949cfe0a5a85a269ab92d6
- SHA1 84476fc8c726c7b49b36647efbd8eefefc1796a2
- SHA512 76dc42d1b062540366a33c82529b0b1be276b70a721724aa2d194069f723af7dad909c18e1f43bda90fedd2fc7122ce5e0e84f0baa11b8b5b53ce7505f41caaa
- SSDEEP 96:nMkLm1aQUMFwpvWMoiVmdeHAnKeHUWQyV+VDCziEwb:nMkiyMFGWMXGKgro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 a4d77b7325b5f1b604f53b3558d452e2b7fa0acf34de4d0d329d577e424731b6
- MD5 0ff54871559a99138b5e51802d83d9f0
- SHA1 d9327a87889e7943ddd1030980403b7ccd7ea437
- SHA512 53d8d5e14c5334840a119894e09cc234e7dcdb665781c6e7fb6a30b371037b98911d326778d16779f7cfe0c0931756bbf67aec19d47478fc80ffb42a88a8dd27
- SSDEEP 96:nMkMm1aQUpFwpvWMoiVmdeYu+1DiKIbU2AnKNHUWQyV+VD7AiEwb:nMkTypFGWMou+diKkU2GK1rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e0c88006021565ded33203719840f71572935d3102f32d3d7321f66f52cbe395
- MD5 2f0219f16e9bf595eaa9d3eda96dac57
- SHA1 77b1d3bb6c6f7bf296f31e1a79479a00f3f7c4c0
- SHA512 de7eb57bf4d215aa7adb7c789e32b424f012a43b1639072de37d8cf61507447b75b753032db66a7e770c8bab5c4a569466cfe5867249bcd4aa44886e493f05ab
- SSDEEP 96:nMkrm1aQUpFwpvWMoiVmdeYu+1DiKIbU2AnKDHUWQyV+VDCAiEwb:nMkCypFGWMou+diKkU2GKrrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 371B
- SHA256 fe3aec67b623b6f6aa3018fc2a6282c672a50716e857c5c7044bfcab9f9046e3
- MD5 06d7e0034883af6b6b1f7f45c853a3c1
- SHA1 270b21773098d626f44a7f25e399651db0f592ff
- SHA512 b4f9c8f05ac9c2092e32508c7537321c979af51efbfbf918f9a2d780c17c1099c2c7893e67bd210393dae17cf18ae8d0020ac55301e0ebfe813cf28dea9be014
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe599503.TMP
- Size 371B
- SHA256 d29ad04a42aa2dbdebdb8d9e653f9347feefda3d77f0ddda8fce601bde8e7cc1
- MD5 5467cda56274bf714725bf5ee56a3457
- SHA1 28b06f5498aeeac98d9640d9e75475c83a0727de
- SHA512 3dde75824a1ca9f8bf11738ffdcf04119689788e4a3eb714aac713a2ebf81ed823489826ea183647621ceb92892dcc6f30ef3040e8102e9e9204ea40c9056978
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 976f1f3746e51577f007e0f1c389de964e99754fb968e8945b6afb7fd7dd00aa
- MD5 a02a6f10b1efe9531f5a7843914889c0
- SHA1 c06853d25da8de31862da56e0cd5967caa0a2d6c
- SHA512 ff7480e1ecdb7916cb41a445422fbf795c9d13501334734ef3bcb0544c86b9f963123cd2afec2a23e30a4afbb5bfb3c39dbb656e5ffb1354597e64719eeb9811
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupG7e2RUpkNyHqRUx3GPOx9x:A9iIxuERzA83h09RZxYGr7tSFGmx8oFl
- MD5 SHA1 SHA512 SSDEEP