5d12f5042c56bf1b30a854d150cf012271f70138149708b0954cabacf41bc525

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2023, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3796-271-0x0000000000560000-0x0000000000590000-memory.exe
Size

192KB
MD5

f82e5bdb3fc1d4ea7e3686fb8908f39b
SHA1

b6663ddeea17f226838760da28f4fd0e1eaf72ca
SHA256

5d12f5042c56bf1b30a854d150cf012271f70138149708b0954cabacf41bc525
SHA512

54b6ff2faab573192ad6d6399c558184a3590ba7eb9e924643fac808554803c89484b0ee7de16bd28975bf15e86cec9ccdc008ebb510fcec711756210e0952bf
SSDEEP

1536:khbEey6y36sv0W7TDGOIrHuyk7xk2W5/uGxNFVYQffbuclGHQ4N0GkRR8e8h3:klEebE6Cyk9i5/uGxNMS3azNW8e8h3

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6E5414F9-3EF9-48E6-BB62-F350956AF0ED}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6CDF6114-4D26-41AA-84D5-69DF2A7F885F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{ED9FE855-7D6A-4052-A122-C011E997DDAE}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{91525897-566A-4C2E-9F77-852DC870BC97}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{583FB1BB-E0FA-4FCB-B5B1-9FF936752E95}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2AFA0788-40B3-4FA7-834E-93A324033373}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{69866ABB-7A29-4BA4-9288-0DF17C7220C6}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{82A0F191-5EEC-4E0F-A94E-4BC5449C189D}.catalogItem	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fd624fda-5aca-493f-9ece-afed9c7ad768.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230701224924.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
4600	msedge.exe
4600	msedge.exe
4824	identity_helper.exe
4824	identity_helper.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4600	4908	3796-271-0x0000000000560000-0x0000000000590000-memory.exe	92
PID 4908 wrote to memory of 4600	4908	3796-271-0x0000000000560000-0x0000000000590000-memory.exe	92
PID 4600 wrote to memory of 1892	4600	msedge.exe	93
PID 4600 wrote to memory of 1892	4600	msedge.exe	93
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 1816	4600	msedge.exe	95
PID 4600 wrote to memory of 2676	4600	msedge.exe	96
PID 4600 wrote to memory of 2676	4600	msedge.exe	96
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97
PID 4600 wrote to memory of 1676	4600	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\3796-271-0x0000000000560000-0x0000000000590000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3796-271-0x0000000000560000-0x0000000000590000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3796-271-0x0000000000560000-0x0000000000590000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7e1e46f8,0x7fff7e1e4708,0x7fff7e1e4718
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 /prefetch:8
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff68a3d5460,0x7ff68a3d5470,0x7ff68a3d5480
      4⤵
      PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1460,11490014119492133673,16794905985183792217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3796-271-0x0000000000560000-0x0000000000590000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7e1e46f8,0x7fff7e1e4708,0x7fff7e1e4718
    3⤵
    PID:2452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a9f76dde5876d055fc0a4a821de6d02

SHA1
3cb30f2ff875cff6a4e4be0c7506254e076ad4df

SHA256
323204c96cf3ed35bb893c2f20a444cd0c7aa0b44749174b7b22ab351b2edf1a

SHA512
b805309fbbc622f2e47c9d4397662713b37879d0ea0602675c0894e655b9dcd34d483a02c6bdb73b5c6ce084ca7523e038104bce428a5bc7be3569c0d18b9091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6abe43658387f0826ca6d505ba2a9b0c

SHA1
ba777e01296195063af3aef86ad61289215991b6

SHA256
2683def01b6ee96268c1ee356bee3d8540683e6c830f6860a903cffc07f345e7

SHA512
2ca9e4ef89bc9d518a08ead9420610b2c24574f474f03545a65d589a8ee01a926b7da3d344e227a7f056a004766344bbb57d37f2d0cc3dd0078ddd9eedc87b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93c5bbcafcf5bb0c6f5a69213346cd57

SHA1
83be2db3ee167ca94d828fb6b5c259dd83f1c43c

SHA256
bf6963b8e445330d682f6cc98cb90b97971d914dc8dfab0945a6e4d2feab4f44

SHA512
6df37202e72db7f2e711b82601bc4c5ec01a918dfece209e734473b826a4cbdbb12ddbab8232e03afdb695bdad14c5b944cc26de99d9b2bff678a3fc267d3fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
d2f516975e4444780bffae6ee96fb4f0

SHA1
d1b2cb1e04951adfb0ba505a62cbf2df46f785d5

SHA256
a0d924023665b6098a4b513385d5e6f86eda1fadb36604699ffe2a76f25aa1bf

SHA512
fc297f718c390313ca0608bb780eb9d5492f06703d207d716d7a5c9be5c3747defbf2a861de4d98cf09bc365630b2707c8bcabeacf9615df54eaffed3150ff48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
b3bfeceefc8c3cdde7f1f26fee77587b

SHA1
3b96f45e0e78155a7a529f6f6619330e1326eaf4

SHA256
ef36e95faebe6e478beb836b96d8d4a8edb06984d358387eb57356a6fdcc94de

SHA512
af89218ae256deb8e0b8e1068cb4f40b735be604f366e38558cb540c61bb99533c3a1ab2d7e93a8ea97e90394927efc83e7a19978ae4e9a08bba5328c5c2628f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
f3bdda19d16a47f0e46d5ced38942be3

SHA1
51ae3e270927c22c21a3ea9c758f26b5b38898a7

SHA256
89d3d8674f30329a5ad5e139b4dc3582f220ff3931ba5fd1095fb618e3b68769

SHA512
e4e10caee9925bf39c1d3582841be9544fe8c56684c22ed6313ed7843f4d5f08648fc3427833d0521d199571718a044196fdb4f7fe78277c1ceb1d2a41aea78d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
566B

MD5
381ac45cdf7aedc98e646056ccde4a8d

SHA1
168e192b23a595e9f41cf8d107d6c1d601c3ca77

SHA256
9f056538358e029a4a7f13bab71dec7dcec6a9ac69b95c766a887849faf49e84

SHA512
98ab242ae61cbeefe9816b68044a15f7118e2576c6e559fb1fb801cc405d4c81310183c6c6a31ab46791a1477d0f61ce113d98311f9858619e91a03935e8a4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
bfc9774388b892b1c807f196c20b3ae0

SHA1
30f4b4c1803b303d69de6777668d0dca347a0a80

SHA256
11d3ee5da1e4aa9b4828fd5f3f99508dc8e4f3601d8fd387b942a01e4e02239f

SHA512
1d3ee50f18d1eac0c9d99cb211f8c4c83124838c4f9c93b1afa999a45752254a00ed1188c24a8af807cd7e5038abbceecebe39df523b46b6ed6cf275a7d5cbec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
132fbf65f48a8e36394c0ebd08cc27a5

SHA1
e17ea007d7ec722349cd738bb89040d0638adec4

SHA256
151aa200d15120f65333c16ecb7fbd068de067a972d540cdc7ca385d7206af88

SHA512
b7141dec082af2c4c97754b5375ee6c2328040a26ba33c65793746d263aab7ac16d61cfccd723c37bfce9d770d484fa2e471f309416ef584f61b48c85e6bcdcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb2a9c2d0099e32985aebe68825c87f4

SHA1
ffd3cbefbc361ca00f709f17affd704a1fb201a4

SHA256
6295fc88cce9646fa9e889c3a5568a658c5bf4e8ee08792cf6a2b1e1b6361582

SHA512
7ebae97fa8be946e633666780999170fcdceb7be73e479c4954b678e62e82e8993a83f01dcce09787e863c4ab167fa35c563a55acaa5e98110891955a6ccf5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3922931a21a66290ecb769f2d79cc417

SHA1
d72bc5af3b2da078125ce71512249f67765624c3

SHA256
0eb33cdbc3b30f2dd68d3e4de912b61c6f29f3ddbf17b8e83948e9243763b8d4

SHA512
e4b1c22b64afa2120c2ae1385374747b04ea4b509fef1a27384755d57cfd4a86008cbf9af7095a1955c9934148b38cf7aa32b036d08702cbaa0ec9f5f59c3987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b359167b3568d1b4953adefdef0deb24

SHA1
98405d3ec52edeed62f8a42bfe766ecf395a95b6

SHA256
177289a899357233597b059fde47b7e54aba35ca95e2a2201fd8d3ca68273578

SHA512
28efc3e9bb0350c2229ffdfc0578c0ebc8276405849480c1762c75d616998f6ff654f7ffde3cf0676b62b583b5ec207e514040de1a809b465bb9e734e29c96b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
46c75365ed3083d4496d3dc76caadf43

SHA1
ab33cb87866b96e0fe090cb9a258cf35957524fe

SHA256
fa0908de466b8b2c0ff12a8e91995df670258a0291b5fc64cef6db87a8af75a3

SHA512
902cf4e7ce4ab771cc14c90829ee3fd6f670d9162e5b86ee68c86d6ecb66498ba518711656071c514b46ec9f29c2360430c3da194f1229d1f9fe2b5f65d71d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57034c.TMP

Filesize
538B

MD5
a150279c0f6c3cb2d1a1aa56a5e141b9

SHA1
7ffcac69984439c58d3c28317a056c1c2f56a402

SHA256
90702b146fb535331660a68fdea274a15cdf8c8f17ab2389686f09405ff8ce25

SHA512
32094b30ee71d0bb6508f24d2b939d612b02c093059a61d630d988880a3fdf194188ac6c1b696824b36b2ca755fd125a174f888dfc5417b159c52d644c00dffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
856488b664c17c6e5bb5c65f7cd24e04

SHA1
f59770acc95cfb30ae6619880ad54c08513fdf3a

SHA256
7d9a1ab593c284a089c3cc6b0c5841fff056598313b2e0495d8bd6764f579c09

SHA512
9ca61f321fed02f2c4ac35f3959c50121799534a6d945959433249abcda08401e97215aea71a93573dd1652dc0c56fdeff2359d34f31147571f47999e3ddab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
58af81708b91551c058ccd246d71be2a

SHA1
24ee491387fe58467247b9fdab02838d786b6d3a

SHA256
7c17a6150859aec4c554048a7d23ccb5d7f5dd38eca88da75741230fdf313b36

SHA512
0cd6895ed81b3120d5e07a69f71c46d8ab04f81d7d43004ca6a8c358579966fa562d63796e4b644d7dc29477b907f2ff798b3d6b1502726bb9ee08f9b73c4d32

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
384a2f01b91a47b8f3cfe12d17bc0214

SHA1
cb7865b6f7ea786ecb71c7b0db28ac02c5f8e165

SHA256
e7ef2c8f2f8b44e733be91d75669bcfdfe9eb1062e80d0360dba664250219113

SHA512
0e550ee610fce18443e0caff3bc34e9931700adf6b408e52ad70a37576179c533b671b61a400bb65bb238fadbb34fc56f3cb1fcbf016e23caf3118fbd27a75c1

Download Submit