njrat | 4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe
Size

58KB
MD5

d851457375df95ee26ca13524e5bbbfb
SHA1

8243d96f85b5290c864ea8b29638d3d4baca4a86
SHA256

4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3
SHA512

0ec419e362d8f6f5c9819faa572fc15c24d94a166a3032348ff544cfbd250128bf03fc1fe37764642a3dd1d793ce12331ec193dbd737b1617697c7dd82eae7e9
SSDEEP

1536:y2q3pLscBG2HwE+xSC3RUIHpZMXpB9O+nk:QVDg4wt33H7ypfO+nk

Score

10^/10

njrat hacked discovery trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

127.0.0.1:7771

Mutex

4c7a09e2b9a3f7aed80289c245122ae5

Attributes

reg_key
4c7a09e2b9a3f7aed80289c245122ae5
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4340 set thread context of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
592	msedge.exe
592	msedge.exe
4648	msedge.exe
4648	msedge.exe
4268	identity_helper.exe
4268	identity_helper.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84
PID 4340 wrote to memory of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84
PID 4340 wrote to memory of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84
PID 4340 wrote to memory of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84
PID 4340 wrote to memory of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84
PID 4340 wrote to memory of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84
PID 4340 wrote to memory of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84
PID 4340 wrote to memory of 4352	4340	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	84
PID 4352 wrote to memory of 4648	4352	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	90
PID 4352 wrote to memory of 4648	4352	4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe	90
PID 4648 wrote to memory of 2980	4648	msedge.exe	91
PID 4648 wrote to memory of 2980	4648	msedge.exe	91
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 3156	4648	msedge.exe	92
PID 4648 wrote to memory of 592	4648	msedge.exe	93
PID 4648 wrote to memory of 592	4648	msedge.exe	93
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94
PID 4648 wrote to memory of 1124	4648	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe
"C:\Users\Admin\AppData\Local\Temp\4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe
  "C:\Users\Admin\AppData\Local\Temp\4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffe0b0546f8,0x7ffe0b054708,0x7ffe0b054718
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14820852844175288825,13849413428106654681,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4be94f702c445d29a29d9c6cfd27402912d8e453d7d7c7a47d26b736673896a3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0b0546f8,0x7ffe0b054708,0x7ffe0b054718
      4⤵
      PID:1688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
f0ed3c7e7977adce82743f26dac44951

SHA1
9d9314ec32215132ccf9e1f13547aab10d409433

SHA256
0deecaf973fb1e2ae1c82b93d1dc5bc90ede3780d4b44280c930e9dd77c5b5cd

SHA512
fbe83d88ed349cb9e35f199b58593759f3b72b2bb19feb980b4fa269a0d8d8e31793c36c4d41b5f9508f057417cedb46699d3cd9969f9c7ff8b0216ae6d3570b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8387b3474a03e76973c97c843beb53e

SHA1
58ee2aa4b8e982383f91c4cbee338144324657ee

SHA256
404dbbb157d7fe3664858fac67ae52a783f051b18aa38bce2d30b6353d7a2ad0

SHA512
9d9ccb521b34968f42a72cdc33174f4fc376fff0c758a54fbcf633f8696d5c386fa583096ee9b4ae869541ff3698ebb255f92b6f45554c4ef471d2005399abda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
95a112a4491b358dd0eda916e2ed022b

SHA1
4a7f1db3ded5e6024fd42e7bdb5626833f62e34a

SHA256
2bc5805720c959af639133d7538de94f85e4bc49d4db9c7dde23285d3f7f670d

SHA512
bf895f92c270ea19aec9011f3a019882a6f81d4cdbdf1d48b9df9af0194996e9814775e12bd3860b7057cc377fa06011bad6607ed096d403452bafc30391560d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
001b4c85462ddec3b26cc3094f85d6d0

SHA1
21ac959ad880ceab005c09523d2f3b685b0d20ad

SHA256
274d8af99e89aa7bee09d4a10b9ebfd59535a905f079796afec55644081189a1

SHA512
b83ad56b3ab0a6a8c755a503d43536d93c0c5e9cb17caa0b3c0f8ee24f7a0db6edbb48603ff4c82f0b7d48bdd463662a8310ce8c8fbb39e760519a798b4ac548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
f648cd544bef2980724cb0874e1f7d61

SHA1
6fc05281b6ef245920083c140c722565366aa9f8

SHA256
5bc9ff88b9848d884c2434ffcd92f8d4e691b24a7d4656d72a1616318aabef1e

SHA512
a8e87ed8646d1c09e9ec59e80e3bef0a608663b9ce88f52698308ecf10a1cc2e8b087f34e861cf2d23a671681085261bd94e06535e535522db5b20e0ca1b96ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816fe.TMP

Filesize
369B

MD5
e2e69c551fdbedaee47408c5cb6d9c42

SHA1
733cb2ccd0ef9a94288ca21e5f0db78e609c6765

SHA256
d96f8d8f105e60d5210f3296211cbec9f000ea74b51f81fffb427da31cd866fa

SHA512
abdb460280f094d3007fa43fc12467841b2640d11e8693f620a168bdd34ed11a2549b7d3178071a56f967892b0de0bfdd305e5424f09c775212fc1cc38a3986d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d1ad84766cecd56575969ca8159e6d4

SHA1
6f3b2cbe14be0e1d26b96645d81c524088232965

SHA256
7143e275d1068681844d8e8d7850f4e08794fa9ecb5f8eddce22bbc7033063fa

SHA512
719ed7f1471199c0c947e0cc67ade10bea1833c99acdd3f2e8ab1bdc237d83013df4c62f559d856fbc7c857da2a1110afe295f43b37afbde98cfa547ab007d41

Download Submit
memory/4340-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4352-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4352-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4352-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download