Resubmissions
26-11-2024 11:58
241126-n488cswpdm 826-11-2024 11:53
241126-n2e7hawnbr 826-11-2024 11:37
241126-nreg8awkak 826-11-2024 11:30
241126-nmcstsyqbv 826-11-2024 09:55
241126-lxyf6ssmhk 8Analysis
-
max time kernel
227s -
max time network
229s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
26-11-2024 11:30
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ch.bing.com/ck/a?!&&p=de01397e8e89421aJmltdHM9MTY5ODcxMDQwMCZpZ3VpZD0yNTA1NWYyZi1hMDEzLTY3ZTQtMmY0Yy00Yzk0YTEwMTY2MGYmaW5zaWQ9NTE3Nw&ptn=3&ver=2&hsh=3&fclid=25055f2f-a013-67e4-2f4c-4c94a101660f&u=a1aHR0cHM6Ly9mY2Z0YS5jb20vZW5zLw#Ym93ZW4uemhlbmdAb2FrbGV5Y2FwaXRhbC5jb20=
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
https://ch.bing.com/ck/a?!&&p=de01397e8e89421aJmltdHM9MTY5ODcxMDQwMCZpZ3VpZD0yNTA1NWYyZi1hMDEzLTY3ZTQtMmY0Yy00Yzk0YTEwMTY2MGYmaW5zaWQ9NTE3Nw&ptn=3&ver=2&hsh=3&fclid=25055f2f-a013-67e4-2f4c-4c94a101660f&u=a1aHR0cHM6Ly9mY2Z0YS5jb20vZW5zLw#Ym93ZW4uemhlbmdAb2FrbGV5Y2FwaXRhbC5jb20=
Resource
win11-20241007-en
General
-
Target
https://ch.bing.com/ck/a?!&&p=de01397e8e89421aJmltdHM9MTY5ODcxMDQwMCZpZ3VpZD0yNTA1NWYyZi1hMDEzLTY3ZTQtMmY0Yy00Yzk0YTEwMTY2MGYmaW5zaWQ9NTE3Nw&ptn=3&ver=2&hsh=3&fclid=25055f2f-a013-67e4-2f4c-4c94a101660f&u=a1aHR0cHM6Ly9mY2Z0YS5jb20vZW5zLw#Ym93ZW4uemhlbmdAb2FrbGV5Y2FwaXRhbC5jb20=
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Detected phishing page
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6934c7b0-e0b6-4a8c-a976-fcfcbff663f3.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241126113040.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1232 msedge.exe 1232 msedge.exe 4140 msedge.exe 4140 msedge.exe 3252 identity_helper.exe 3252 identity_helper.exe 3388 msedge.exe 3388 msedge.exe 3388 msedge.exe 3388 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe 4140 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 252 4140 msedge.exe 80 PID 4140 wrote to memory of 252 4140 msedge.exe 80 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 3172 4140 msedge.exe 81 PID 4140 wrote to memory of 1232 4140 msedge.exe 82 PID 4140 wrote to memory of 1232 4140 msedge.exe 82 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83 PID 4140 wrote to memory of 4488 4140 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ch.bing.com/ck/a?!&&p=de01397e8e89421aJmltdHM9MTY5ODcxMDQwMCZpZ3VpZD0yNTA1NWYyZi1hMDEzLTY3ZTQtMmY0Yy00Yzk0YTEwMTY2MGYmaW5zaWQ9NTE3Nw&ptn=3&ver=2&hsh=3&fclid=25055f2f-a013-67e4-2f4c-4c94a101660f&u=a1aHR0cHM6Ly9mY2Z0YS5jb20vZW5zLw#Ym93ZW4uemhlbmdAb2FrbGV5Y2FwaXRhbC5jb20=1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffd1f7546f8,0x7ffd1f754708,0x7ffd1f7547182⤵PID:252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:12⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:82⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:440 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6dfc15460,0x7ff6dfc15470,0x7ff6dfc154803⤵PID:1260
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:12⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:12⤵PID:2936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:12⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8027186293088289928,249794341324393506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:12⤵PID:1304
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ccff51f965f8f4176e4ad112c34c86a7
SHA1eab249ca0f58ed7a8afbca30bdae123136463cd8
SHA2563eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33
SHA5128c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd
-
Filesize
152B
MD5c29339188732b78d10f11d3fb23063cb
SHA12db38f26fbc92417888251d9e31be37c9380136f
SHA2560a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2
SHA51277f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5e844a1c84d6feb60f30433cf4052290a
SHA13ac15558df7ddaa2330ff4b87272d741e31d7348
SHA256b8f8bbaf54ce83a157299ac88a14464e474459db9d68f60d2c772349f0b93e1c
SHA51223b4cf35cba4a9a9163bc53ab4566e726453878813e55bbe64bdc6cc5fc3cb3e7043903639ac21c882f35730a912cce702ebb602e1d1f623ee419229df21b8d3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD54809b83b9141caee77ff5e578897280d
SHA1a442e341bf291a37e7492fcb9f2070054b80838f
SHA25656dcc2c2c9e95032a23fbb1f1d556c42cf605dff5953929f23f3e99bafd99d37
SHA5124f574902395ff1604a129245e2f1cb77faf9e5aa6f1df3ecd7b772c67e678dd8606ea50dbd9e046527c888888cc81ce5b8e5c92d2e426236e7136e0a2c5b8d6a
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
808B
MD5fa8d2702707aaed74bd80f7eedbbf501
SHA1d1e75c6c96cda22baf84a9b56d64941627ae82c8
SHA25688b2cd9222427377ca640939d27c6768da0472157818441fe1bf7f9a5f50daf6
SHA512e68c72fa19a0f52a13e13d8411fbb9bce2475369f48ac5becd3835ff3b7427750baede3e7240a120c884e5e606d28d0b016f2e99f8921fbcabc0f5a863d522bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5887e8.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
6KB
MD5819b40076de9732ac35c4e3a011f87e7
SHA1609366f0f511d84410e9ff54e298f0fb95b1ef45
SHA25691317a7ec878c2241bcfa76dca180a15bcf951f77c26aaf9bf2efcc67fe48c1a
SHA51222e967503b58055263b29955cab2b08110388b42e25f34baa0cdbc7b07c2d736d7ba660350193416053e75449330e39da15f9b98e9608d88b86848875ae8521f
-
Filesize
7KB
MD5a5144522c67d42a53b6ec39650cac818
SHA125a612608b4d411af502b58e2e4997320aae7f71
SHA25659ea820d2b25491b054fd6c3ff1a4ca836ca026c77f184073f0a6cfc3617d443
SHA5127ce708e47f43fd924aa555bbbc3d9e58b1dd999dc02e70548068f8bbffb9424d2fd028371b8d78daa9904ff693bb46f27240eb509ac0f04f491b9102e052b07d
-
Filesize
5KB
MD521d303f7219e509bce81a4f0f8079c6d
SHA15ebeb627bb3a8fad3f406384bc2fb34f72834f6c
SHA2566cded09339087bad12f4572dfc70d3252b567c0202daa22ccf33cfa767333cc3
SHA5120320da58c6d473953135b92e84f34ee1d44b7165aadefb2e5fa2a0240b1562a23bcd40e4e16efcadb41c7e3f0752a388bfddaf0a9bd9e55e1481f9f59b913a28
-
Filesize
6KB
MD52ba4183aa76a99941cd28055760906dd
SHA1bc007bb50e215314ed0c551a7f12705144a49708
SHA256a463fb5bb73d745d0639e6e6ed17289c1e81f7c614c6f8713c6a5a948ef001ee
SHA5124ba733ea33b3e54fbebd424d8c3ac010ae1bed78535d373328d98814e41ee7942964c4cbde14ce7c4a45be0b35511e867e3c205883e700050b3c492b14e0ef54
-
Filesize
7KB
MD54b475f3a146e6a253340546e0afbca6c
SHA1881ff3e4e8b20cda779ee3a83ac33dd943ac8a53
SHA25668da73b8b81bb5744f0a137ec83879d5b06ad011564fd7f5de5ec685d8dc7b2a
SHA5128938618bb0db9432e68a9e83a0552a92ed2945b63421b0d418cf1bb0d13dc55d9f1dc500dad69fe5142d4cae116a70f7f7b6195b77fe8d5e21c89a91adc152f0
-
Filesize
24KB
MD586aa28ffd286b08415aa197216684874
SHA1d99924976c73e3220108817ad6bc1d8b1795ca2d
SHA256a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d
SHA512a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa
-
Filesize
24KB
MD526978f38b0bce48572b90b762b7d937c
SHA18b8b88012fab1d37fca79575a5db81674b424867
SHA256b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa
SHA512501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379
-
Filesize
372B
MD56e23e564680c64acd814ee81b4117a81
SHA1042573d7de59b3381b2f2cb79f0936e5e6803aae
SHA2569fcc71dac3c103eae1b9ccb4556598fbd03ad6d09dac2bc6154bc5dd95a149a7
SHA51261de8e83455958ae25a947cd9e4dea3dc1e7722a7cc510fc1498d4b5bcf9d7b66b113405df0e8c3adc3b34bf0d91a3e87f3966a8b5ab910cf2475f8e5186e80b
-
Filesize
372B
MD5a9ad762434b662fb54fb3c2443c5cc2d
SHA14861c9033fc1c0f72d89bf07e74f126cff293e92
SHA256802b925e817f599364f5651067afc13764e0dd5aec4bafefdcf456111992944f
SHA512f9ed6f776e4356c4d3ac81e0924bc210c2f7bca85d1133f5448f7f22df3f80dc0738a746d49c598992d869a24d2430369633431295794d5fdaaa8c1d222267a6
-
Filesize
204B
MD5ca31cd0525ca02c8515d614ef8055935
SHA1d6c90b39d014ddf3c9c2179dc587e1235a37d0c3
SHA25688f54588dedc694d50cfe0a6c7d70ad981152d1dac01a8c71b5800c1b29585e2
SHA512fe9d21d1807e9b474c04d982e5c22cfc8e002181aef1b9fc87508cd0287a20f244a32445a98f7ae042d04b15b638320d9ddb6a65275faf27fd52ec20534d9ee3
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
8KB
MD51f6d990240b9a1c45e084100d99421bb
SHA1ae88934523aae2c60d8c1afadd09678523f8fb64
SHA256ee975b061c0834a6257f71272d0da1cd8b29fd0bead14fe2a374feec9b635197
SHA512cbaa328006ce7b688c27405e7d42b249e779724c4ef04ccc6ac650624494a55dd2aca8dcdeed48aa4d6c7b0b1096a9419332f55b68dde8d019b6f907be6dee2e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5c1fb45c0945ad3f8851435cf3ae383e4
SHA19953f907bae81c6fd434f816d87c3150876ce99b
SHA2564b9875bea956f3f4cf19ca440bed751f3b1c76b1f7773034ff1b79fbb069449b
SHA51297e48f1cdc541e830764f99a409ccf5949f85fd3e75f93928f4a30cde4859df2aa035d242bb9447203fe3968bf0760eba2d82e0af5121e47bec2c69c07a063d8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5d5d29f47fa6f2df50867651027b02dfe
SHA1a0bfce9485987cf5db945b51b144153ca1ce2efb
SHA25684152c8e8fe1aedda58fba8f54924fa4396919e1fa15a06aa9b1202c79719892
SHA512642efed7e51eb2238c821338a193947c64e1d55b88c4b4ac869b083ac977ef977d61a77e536b68d14600c5587599cc38ee13e70c08fa6860b32fade05e6dae3c