hxxp://gotomypc

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gotomypc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2878641211-696417878-3864914810-1000\{E48CC85B-BC4D-4A6C-8E9D-224C3A9C9C0F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
2648	msedge.exe
2648	msedge.exe
4064	msedge.exe
4064	msedge.exe
4476	identity_helper.exe
4476	identity_helper.exe
840	msedge.exe
840	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4064 wrote to memory of 4744	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 4744	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 432	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 2648	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 2648	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe
PID 4064 wrote to memory of 3508	4064	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://gotomypc
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae5c746f8,0x7ffae5c74708,0x7ffae5c74718
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,2852553467236426775,14144655054324093557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f206ff5341033c9e5fc98fb2c80f626b

SHA1
8c604c2313fe0130ce4bfaa7962662b46a8a2926

SHA256
32bdcea895760c703b630fe1d1c580c791c824c38ae054e370a04804178a43d4

SHA512
37804a5380e3149a16984617fd44424b6d36012c069bc2accadaee52b623d49f9877599ed10fcb748ee866615750d4c0a3206a61a39ad93a6e427e482e4084a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
38e22dea0efe7e994b4906813a14f200

SHA1
59fb3a0df8d6d2933ad78c690f90d57058dba15d

SHA256
2166cba863ea999fabb7a2ab14785dfd8fddcb4e07d952e929b576134e0da896

SHA512
742c8ba0811c6f9db50c3fbd4f99524170b9190c8b63477b8e4487f8ef63582bf6d991ffd8410f60e240d04cf8dbe8f79e8fc30c10b76791bc15cc44d74065f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
88bdf692bd82ece51a66ce4b8096bcaa

SHA1
17ffa53bce333f180406e6521d449005c01ddb9f

SHA256
1dd94ba739a1bd409b6b17b2c8a86b9d83cb662231af31809a1bf5808ea6f9c4

SHA512
094d3a67bb25b8b14893a9e2cd2b9d07fe185b34c11b59794b37561563cfb2fc38e1f1a606f1ca23e60d211896c07e0147e9aab48c60ce1a0dcff13782f10d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ae5ecab8af54c9fe02e301e115a994fe

SHA1
4b2a0d49a551a6aacca6d961f9fdfe35512895b3

SHA256
d7992c4c9ef676eb60426e2f1c41f3a66ddce56f2e2157ed8f7e28331772672f

SHA512
ca771192a3c1b6b56939ed59c1bd475c93256b6425d49fa2ab8bcd987871094bd00d91a793e987686af6f9291d3c843b36ff600e0cc1197ec861db8ed01ecdfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
92a4394f125898094aa91d5ab2afbf54

SHA1
ecab2ea28cfa8271481b31ac3211c57763a0ec34

SHA256
2aee6bf4ecbcc4118d45c75370f0649e9b72214f1998917c3ce10b661c35b2fd

SHA512
680326420708a24f7a189534367030b1e264cf484cd9e5c51e5651e7086af6ad95fe6f67399d61143b0c09c459aa99908a51f2c8c5539258876e5bec68f3b257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
60ddb9184b4c22382703cf131a019b34

SHA1
ffb65e4eb384be9eb1550652d927c304e651619e

SHA256
514baf48baae22a6427f9ed5d48a3792bfa7f580499b8ffff786660486786469

SHA512
0f138f4826822b47504aabee41017651ac9388958ef2bbcc064b98b4f624a74929fe12b523c1b9ba14d055b6332fba286a825efab11b021b75a78fa84a2860a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01e8fe47c094e6f34e8f67144f6e25fe

SHA1
337ad61cf37ad32ddbb742368ecbdc220aab0aad

SHA256
cd0a201c6816cd95a7aef6870ccdc8d45c17d922d8eed8396d91c71b81270c28

SHA512
066039636d469f760babb5d689e705fc439ca0aa4b988fc36b2b182fec60ddc3e6886b4dc94b903a4ed3e8b998e4cd86fecb451daf96877e0f871134ff48a37a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4059b56adaaadcd0d3e64c8e42c033b3

SHA1
e0b6b3de938e84b10d118bc52f71c74cbe913772

SHA256
789b250679fdf729f68ce2ac282d473de77726fecfae12d8aa753d9674b48d2c

SHA512
1c73a300ca26ce789219ff6edc4a84b510bf071fdd538ed70d81b2f52b09595ebecb19199f7873c98d371057690343350f25e107299403780ee0d9d3c2d12aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
2d968e40a7870c889211bd462cc65100

SHA1
40d4fa34424c1a4c3ad0d0bb833789f0f1be7b32

SHA256
260d1272fb2f7c7ab53409008da9a699804b96d6eca63902bc532d402f28d120

SHA512
b19dd3976b595b17510fb6cbd0434dfc6b8cae4985cc1ab76e39f2912dbf11c774074e14966450e1a6afc675b5e7befb2a6a643224672ed434a88928ae6a7d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8143fec83e32d0554a9924ea24554548

SHA1
1d564a3eb30c7c2d9a309674614d5985628f2a3b

SHA256
601f7b684c4114973a4a66bad7a9aa1f2d3624edc1ff0c49b49fcffa8a5df87e

SHA512
f47f3d3838de68ac1241fb585f2d2ae3161c07104f02bd164fa63258872a2124d465dafcfd94ede74e4188f2e04e9cdca395b5d64efc256ae6973cb01ba700d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d4401c3db5d8f25de606996a4bf8ca57

SHA1
cc448080bcc7c9c32995f04d5360c090b166c74f

SHA256
09eab835bd4f1923ac9ff420f6cb2815e97d96d623f1672294f43e90693367ef

SHA512
c8984d9f725bf0768699e52279668fb523bf760b422aee16612668dcd955c8d6a2517ba7cc7ccda1d14d6615c8192d1fe6a82d87f036c8c9e3483915c5d3d8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58216e.TMP

Filesize
3KB

MD5
8e9faa9769269ec9cc6035daf6cc9bf7

SHA1
3dbee0f157f12119205a8b5e0f2b69bc5a1892d4

SHA256
99109973c573d1ba32ee9716233a83ec03965059fa21534df2d4335aa2993a04

SHA512
f214e3e0ea5387f4be4f93b6a7ded404fb89e9ead1421dc6c224aeac41b087a797525dd576204ce7158999a90bc2ecd0ae2856cb6b5576d28e9477d726386b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a3dbca11e8e50e345ff3b08f7870890d

SHA1
bf835ce129213fb3bd42eab5d7da1e7f228137e0

SHA256
6fd74d99c54e1c505ba848f73a57a5a8cd193b6a8b7a753b4448fddc0ba43d9b

SHA512
4b708bfce4517fba303402edd2afc55364c0f40f8a06807e97e554a563cc92634914e9583a5184bafeddf0a12bdd18d49b789a507f6383aae8c74623de5c9743

Download Submit
\??\pipe\LOCAL\crashpad_4064_RVUMOMRMVDWPOKCE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit