db9686427f60a39aac3fda1fac3550c7afcad9608a465210887fec7dd1ff6941

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2023 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XB1ULK 1.1/Xbox Achievement Unlocker.exe
Size

126KB
MD5

aa7c839ccecd16ba591a503c116f6e5b
SHA1

a5cc6849f7966ca295252b742032e7ed8dd999e1
SHA256

9488330b6e2d063be4fb1c2aec2f413bc5a4240adc869d880cad63c671bf0e74
SHA512

1d307e025bebfcfb39be0cf01de15f8a84c91c1d71ef01f1acd21c511c671c632188db6a2ddaa58f3d12e032ddf677467de7cc8db9acc411453af348bc1442df
SSDEEP

3072:6l0xIHQmEb9liHk29+E8Ufjz1BNOG/QJpXvj/tktDqY:79OwG/Qbbtk1q

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\80488bdb-8675-49d6-bf9f-248722ac47b9.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230302184932.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 713095.crdownload:SmartScreen msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 713095.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3008	msedge.exe
3008	msedge.exe
2044	msedge.exe
2044	msedge.exe
2816	identity_helper.exe
2816	identity_helper.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2044 msedge.exe
2044 msedge.exe
2044 msedge.exe
2044 msedge.exe
2044 msedge.exe
2044 msedge.exe
2044 msedge.exe
2044 msedge.exe
2044 msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Xbox Achievement Unlocker.exemsedge.exe

description	pid	process	target process
PID 3924 wrote to memory of 2044	3924	Xbox Achievement Unlocker.exe	msedge.exe
PID 3924 wrote to memory of 2044	3924	Xbox Achievement Unlocker.exe	msedge.exe
PID 2044 wrote to memory of 2804	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 2804	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3556	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3008	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3008	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe
PID 2044 wrote to memory of 3680	2044	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\XB1ULK 1.1\Xbox Achievement Unlocker.exe
"C:\Users\Admin\AppData\Local\Temp\XB1ULK 1.1\Xbox Achievement Unlocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=5.0.17&gui=true
2⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa408646f8,0x7ffa40864708,0x7ffa40864718
3⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
3⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
3⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
3⤵
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
3⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
3⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5352 /prefetch:8
3⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
3⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
3⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6064 /prefetch:8
3⤵
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
3⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
3⤵
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
3⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6c0eb5460,0x7ff6c0eb5470,0x7ff6c0eb5480
4⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
3⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
3⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17709225901874214000,15283773576290984669,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2864 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1db53baf44edd6b1bc2b7576e2f01e12

SHA1
e35739fa87978775dcb3d8df5c8d2063631fa8df

SHA256
0d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48

SHA512
84f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
cff4e9756d6964ec88aee8324346043e

SHA1
880c4b57ba0405ad82e6d31cd4545d26d4b13d18

SHA256
23ac811e9177415812db3d0296b02e4ccff21412f4fd035bdb5ea6cc6a0d71f5

SHA512
aaba719e8ff5031813317d907ad12a1aca1e0f5c7b5f224f7d2fdac17ae205f526db2f129b916ce8e0f19b73e55cd599398b43950ba1008999038503308a6c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
cac8813fa94b831b3625ba89247751dd

SHA1
d0c3040dfb5618061fb9cb787ff3a6b353634f6b

SHA256
90893772be871ead27dd89d8873a3ebb24a9a5a1e8de553e1182ed8ca15f45aa

SHA512
05bcb03500de23ffdd45e2ced2301af37474c03240838e862b9b6781661ce874b210282dfdffc7ba0bd9d0e09441456d6b04f5a7c0078dd239a4e4812f979b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
a7433a1a2badf5ce07c38d7472bdad45

SHA1
54b61c0db14aa6e36dedd2bad98253390823bd74

SHA256
6fd26239c8fcb926f8d62011c82a68c62adfdab5250b0b7c2cf22bbbc798ad1c

SHA512
87dad1e0a7c243bce39a1e85ff92f60b7109e7ed52f535ef8a65872cd2d300484907a5661e66cc44740a4020b8fe6db1dbe4b3cbdb521d8e73d4aac0ade29d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bbfd687411a5d79b2cc0a71bd475932f

SHA1
43737cc11c54610ace58dfc9eede4ffd81f85ca3

SHA256
b87037df5c0ae0c0040d65d6dd4037d5a053409c27a8f3d345d17acc7ffdc411

SHA512
f97915a5256f3034be547ef5314639bf1ca8dde7b1d5448692826875f28bdb32b22e4819229d557e611475447348c0a8a7b7179f6794237747e5a5d3a285cfbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
4219cca44ffb8733f499fa9f897895f9

SHA1
a0f1cb52f5f7c6be7bbc66572a5401ec23fac63e

SHA256
7972a3c5847342503203afbef9c9d6871929d53b33f8b6229c04e30c80e39834

SHA512
23c8cdb510154a83c09070d210f3107b26def26a3e5a316531a09a063e6588253968dfcaf4da28c401e06d195c05519c582ec41e2f49621ee38a36780200068f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fbc99df276f07b9cea1dc97ebb5de5a4

SHA1
5214570a2e1394d8983d1feafe375241be205c42

SHA256
7312378bb04f7742869db6db6966cd6d5dfdf2952642dabcc041556206f0c308

SHA512
11621e89165fa01a1fa2884363878fa8ebc797104d2a5098ef3d1db16ebdf04c2e09e70aaba50d799f9b52c8c67025869b548101740033fdb3c5fc87b1673ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e3e063ddc8f9a8226158979f2c6f4e9

SHA1
b0cccc690aa5c53ab2ea3b058fbe50af635deea3

SHA256
c0a9ae5fcdaddff9a8e8f7efe0f465c4eddad3e5039bb988eecba4ecc1af635f

SHA512
3afe2335fae9308202b66a03e3f1517c24c0cb5bddad0022bf001abe9264f2b6ac918469c9d3b02a9f00c53f0eff4c71b02d8afb39fe8d7e6be9c3df677cd969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
76773586e6adca7d4223017779850aac

SHA1
07d8c214a738c07814ac5bfaa74954a79a7f2c24

SHA256
54f62749ac5c1bf553f26f6d8efa205f62a6af48e12a942ce287b3c217131e3e

SHA512
0f2ce40d6fc88a76209183ddbb759d570eede325fefa8fab84aad09aa09ff3e1b8fb5fb16c503c2579acfd18ffac5ff8c670e4a4ba43b59f3d156bb07614c4fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
114416a8265602f77f30a575a3909f9e

SHA1
625bb44fa2e4810b295e19dd4cbb917826d22928

SHA256
ee417d76ec234831fb6d642f32a9fc088486a53c7c09c448cb21febc7d2c7f50

SHA512
5d673e83e0ca5adb1c683a7d1b109e9b9c5ac5530015a55643f5fb77c31eef2abeee7ec534978afda3c230034910c86015c4a17424c7b05f3ec1be85cdc7a7b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
168d371f88989c80ad6fc6657f64b244

SHA1
1ce656fd81fff49e9ac2a6e21b8bc2d940da2f4a

SHA256
0338ac01545d01dc3fdf13a7d7790ee355d4d4b313026fd35fbe5e153d8a3060

SHA512
905ece21910db0d35a4e7807417fc37010217702510c2b34027a35090830cbb55af313f997a47aa6ba8ae7f1c496c92dc3c5771cd8fa0e6e5d5d56ebed11c3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
27c60210c6a21bc101d3117303dff8f1

SHA1
76c38d05322bf19a267cd9e8e58a26e527a08393

SHA256
b1ae8bdd91ed5da81ef17f4632e2025aaf720e6c135438657ea799b9db89571c

SHA512
d5f8f67b1eb285552d620ab4434e03191d4b5e8c665a1e372fb97edf07b7506c478c7be0ec8c54886139d4990c3c6d71b97ab9b61022413c0a34e1013825c15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5731af.TMP

Filesize
537B

MD5
3cf62b6238cf4a0301d907d5a8e92e8b

SHA1
ff51df12a1a3252fb9c45c2843782f34445bf4f7

SHA256
6f32f01c6b9f04721342166c5c766ad129d98864bc2a61bf5ee596023ce5de7d

SHA512
9e5feb6594decccbb8cacde4223be1b38cdbf543fb5607cf9b0e9ad8e5d2cb1e9e35134483615d7018a792a29428f96a5e9e4e5b1a4ccdf0dfb1802cacd0a1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
ce00291d163672771e318663a3f69631

SHA1
9c4543161eba659979be50047f56cc5edb57a892

SHA256
6984363ae77a0508340dc7bb8214e2206426cc724a35f1d34f75ec01ba91a54d

SHA512
7853b023d1912177860b1fb614932b05c155a1e17d99046f39c00fa34e1c17d622688b96c3c1a3891bbaedbae03bb9b121b3577f033b4932a703421899d3aa6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8768dc4375112800635750c59d201524

SHA1
144f9fc268d8bc46aac7d93d5da3620e0c8979c2

SHA256
dd251e32aa721f3888542ad08123b5f857e54f3b71e214ce59c708c2a1f32e35

SHA512
5038843c500da4a08383917a00173c98d36fc2bef26a62b91c023a631da17e2b644c6c7eaf1999005ace88be2996556cb47733b5603e7d1602db344fc01584eb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
a79091d9652d41072065cc0981957c4a

SHA1
fb473e964c02aeac0de50c0ea3038bafc57134b7

SHA256
8c80b21a546b16b175ecdd6816e17c70d2b579c457a8e0f690242207c82180ca

SHA512
ddacb5bfc667f4b8f8ca1aa50055a2672ffe48379fc31ac010c9a8ec92a0810dbb42b26a416470977fc96863b326e74032e1df342c12652343ef79bdd341ff3f

Download Submit
\??\pipe\LOCAL\crashpad_2044_ONGTCTFIXZKZOYMZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3556-145-0x00007FFA5D850000-0x00007FFA5D851000-memory.dmp

Filesize
4KB

Download
memory/3988-289-0x00007FFA5CF90000-0x00007FFA5CF91000-memory.dmp

Filesize
4KB

Download
memory/3988-286-0x00007FFA5E2F0000-0x00007FFA5E2F1000-memory.dmp

Filesize
4KB

Download