b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663

Resubmissions

04-08-2023 09:55

230804-lx95zaad82 10

24-07-2023 06:21

230724-g4d9nabb5x 10

03-05-2023 12:21

230503-pjk6gage31 10

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2023 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe
Size

553KB
MD5

09f041a556aaff79bd410a08ba452a86
SHA1

fbb16877fa1eab06e207177c7c9d581e60575390
SHA256

b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663
SHA512

4f4376e30572a306fc884d033b452dd6f8124de56139d7bdad83252b1862b0c323e4a9c74ac0fd5949a3800c8d4b177f668c3be179579704d7de6cfa4723e908
SSDEEP

12288:XZWETxtYn0CtMjoUexjrTadcWBbfoz9N8SCcI7NUqIFzGRIF6nj1K20XdD/S8Ch7:XZWEfYnDMjjQjCdx5ojI

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\68ac6ac9-ab74-47ee-a61e-978fa28446f9.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230503122201.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1448	msedge.exe
1448	msedge.exe
4124	msedge.exe
4124	msedge.exe
4600	identity_helper.exe
4600	identity_helper.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4124 msedge.exe
4124 msedge.exe
4124 msedge.exe
4124 msedge.exe
4124 msedge.exe
4124 msedge.exe
4124 msedge.exe
4124 msedge.exe
4124 msedge.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

4124 msedge.exe
4124 msedge.exe
4124 msedge.exe

pid	process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

pid	process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exemsedge.exe

description	pid	process	target process
PID 4628 wrote to memory of 4124	4628	b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe	msedge.exe
PID 4628 wrote to memory of 4124	4628	b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe	msedge.exe
PID 4124 wrote to memory of 220	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 220	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 5036	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1448	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1448	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe
PID 4124 wrote to memory of 1264	4124	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe
"C:\Users\Admin\AppData\Local\Temp\b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc492a46f8,0x7ffc492a4708,0x7ffc492a4718
3⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
3⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
3⤵
PID:1264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
3⤵
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
3⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
3⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
3⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
3⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
3⤵
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
3⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
3⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7b66b5460,0x7ff7b66b5470,0x7ff7b66b5480
4⤵
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
3⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
3⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,12190931631779311648,8998921657557157235,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc492a46f8,0x7ffc492a4708,0x7ffc492a4718
3⤵
PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8e068076538743d62dbebbbf7d7e2499

SHA1
12c776b76f9aafee6e1e3acb8f17c397d92dea92

SHA256
f14a4d84df6dc971f79343a4beab6944f2e84c1b86f02ed3ef3b92fd201c0e71

SHA512
f59481e8381089246c347229e95046a80d546bcfcd7f47e8dda630aad363265516b5ed006f4fc7d2d1a7bae3ff4f8cae5f081396f791c8a3b5c073ac3d3b6526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ca5c1e5-72ff-4df2-a90d-afa4e77e78a2.tmp
Filesize
566B

MD5
381ac45cdf7aedc98e646056ccde4a8d

SHA1
168e192b23a595e9f41cf8d107d6c1d601c3ca77

SHA256
9f056538358e029a4a7f13bab71dec7dcec6a9ac69b95c766a887849faf49e84

SHA512
98ab242ae61cbeefe9816b68044a15f7118e2576c6e559fb1fb801cc405d4c81310183c6c6a31ab46791a1477d0f61ce113d98311f9858619e91a03935e8a4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
61a523979f0a2f27beb69559a48c40d3

SHA1
7712b228851f2bf3f22d090f5b8bb756fa2ce91e

SHA256
730cf4aadcccdd9ddc18821c44bd6aa4b9c8c04d5751d1fc240cb7420200f330

SHA512
a00243d2c341e0713c325b99066af1f55db9efbe8fc019784b046d3204feccc75b264c3de4ff9c6a16105f36a2af3082403a126ad90559ed5b3e850f102b93de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
360B

MD5
50b217354a8467dd545e2dcee8c7d1cf

SHA1
82061fbb61dd118d9b177393ea66172f2f38a837

SHA256
f3ca9efa60a8631c7a188475bd00bb04d8d5bf6d999dde7abc31db33e871a6fc

SHA512
77c6e197294fb8774ea0d254cf143c7152dbc89ca49c0806eaa21f265756ee614ae5b04536080173ede91bdcb708693b56e189c12b832a0aee250f8d0ee648fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
72adca6dc7a82b10a0a8538808af0960

SHA1
6f28879d6f70f236b269d5b7271f6f8335658b9f

SHA256
737d70bd973d137a55856ec33a53b1fe0257aeeae044dd8e99aea57051f13212

SHA512
4be7439941a444275537530de8d3529655fb2e2bacf03fb5f30b8e3fed07cd1b433aa27e6b4239c2fb6a3e11514f361a65f18012fd712cda43b40f860b579c5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
83335e90b9848b767d4582e77d8181ab

SHA1
9db9ced5b11d6a923d8f88eeb4b329d8fb3c4fde

SHA256
f0a7488bcd3c724bee200ca8691961d29de57d1863836bbe1255d545cae68b4a

SHA512
7647b056a96de8f42ae940dc7c348f1f1de3fc37cfb02d7840e938e6c66a2abbe9e9ba3e81c32a48b1b7fcac2e0be868bbeef5395a3607711f87360c01557494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
3c193c0e8c02d97135c99588e6ced8ab

SHA1
e5d4739afd7a84979ef2a31c6589f79d1da8d9e7

SHA256
f68d886e250997d95f19382bf0c2912fe52ba08dfcbe45741b73a8fe85da483d

SHA512
65921e871f4e481b393720932fc2497b9dfa681f17a994a1526c4ff056ad57a11dce28a81a77ebdd1e5a66b235a16404e751b7aa46c8da7a7dc2e868897c9a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
b7f5bcd9b86e648ef95b69ac4468a981

SHA1
2a6544691931e77934ebfdc2d8f13ae01ae72280

SHA256
c04101e2fdf9acc0a4fd85b8c782d1411689fe65c31f8dd1f1fc32689c0a1ce0

SHA512
570a7d977d75ee4d6468531f126961b205aba3eb949cb04561d027e87b03e241f3ea61fe2ddfc02f88c49df85630b0a5940bc29c8182a49033b7109517ad5b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
69b72d0a4a2f9cbec95b3201ca02ae2f

SHA1
fcc44ae63c9b0280a10408551a41843f8de72b21

SHA256
996c85ab362c1d17a2a6992e03fdc8a0c0372f81f8fad93970823519973c7b9c

SHA512
08d70d28f1e8d9e539a2c0fbac667a8447ea85ea7b08679139abbbbb1b6250d944468b128ed6b386782f41ca03020e3a82491acb1fe101b09635d606b1a298be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f5144456-d4e9-4f8c-a5d2-6dca739beac9.tmp
Filesize
9KB

MD5
8304b928bb317675834ead5b43b106f6

SHA1
aa8c3be96bef8d2bf35c1fb8c4d239bb2d6dac5e

SHA256
320a9cd93df67b5426a11ddb6f796be73b6138eb4fc99334d837d20e71fd7c7d

SHA512
b5dc1e815059edfd5e49cd1cf355af50745589b3f4c3e06c96b61baf36f0f89bae5d5ca8df6b1549ef5d3c6ee6a7f242644f8e08fcd6362855ba8e73f0b86f42

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
22c9d4871614777a915ee719ac2a8e76

SHA1
c43ec2e92fd30c53db90bdbc64f2849ea2be293d

SHA256
60f1236f6a23b09e49b635be709b43f1db1b0e84b64ccf211148cc750681cbe7

SHA512
d5575f149769133791d0707c13318063c289800befe6fb7eccf8e376fb48e43d9f22d077420d65d7a1ba974abdd89544b035320158ddea5335c11c2663a424f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
8fb0635a36212f70fe0f1ca25c06f398

SHA1
7ad3b8f16668c60e2562107daa12593b07f3c900

SHA256
b4e0afbf40c013bc937b32bd1449d440dd86da4de4e19862a2da1611deb1d4f6

SHA512
d752fc9a6fa1737ca8ea8844d7a940959378c450bcbbd91ca41ccbc1e0f9a44193b82cf5ca1eae3932c4c4ce49db5c6dd6b82edaeb5709463ed7238d3bc606b5

Download Submit
\??\pipe\LOCAL\crashpad_4124_EQWZXHNZYXKELNNO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit