6c26664ce65b4a3602fdc8fd21fb53b82498712bb602773e6747bc68d5b980ed

Analysis

max time kernel
1799s
max time network
1804s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FortniteClient-Win64-Shipping_BE.exe
Size

223KB
MD5

138b9702b1163a9ea21688640955479c
SHA1

245083872ab5fc45961c6d2f5772172b61db008d
SHA256

6c26664ce65b4a3602fdc8fd21fb53b82498712bb602773e6747bc68d5b980ed
SHA512

46230a4bddb6d34767c0cae223cf28f5d0eac1cd16ae1aea734ae99761df4474e340bc257b7519dfabe6594e2674c18779000c5a09211289ecbd83781b639d5f
SSDEEP

1536:ijnFF/DXXXnHJXXXnHmH3pH3MoM0NxHKb0gR:iDFFIH3pH3M4HKb0g

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-618519468-4027732583-1827558364-1000\{6BA3B0EA-2C19-48B8-A996-E43EF52D9DF3}	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
2532	msedge.exe
2532	msedge.exe
3020	identity_helper.exe
3020	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1788	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4976	2532	msedge.exe	117
PID 2532 wrote to memory of 4976	2532	msedge.exe	117
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 3996	2532	msedge.exe	119
PID 2532 wrote to memory of 1192	2532	msedge.exe	120
PID 2532 wrote to memory of 1192	2532	msedge.exe	120
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121
PID 2532 wrote to memory of 1204	2532	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\FortniteClient-Win64-Shipping_BE.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteClient-Win64-Shipping_BE.exe"
1⤵
PID:4596

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:2404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1744

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FormatReceive.vbe"
1⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd380346f8,0x7ffd38034708,0x7ffd38034718
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8847045384693046400,996272400253232817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:3720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
16KB

MD5
63e644c9caebb2a95701be42393a0bd2

SHA1
454dbe29e4e07b7caf9a98bb28625baa1f32f119

SHA256
6123f8fb450ee719895a342d8c41cacebd486e5405e40c7927fbd935f529a58b

SHA512
2d467e0bbdefd29de26e584a1014f988761fb81b33573dcc976ddf88cb1ac947ddb9947874e21587c88d76eb618768cbf2976dc6f19517be5e5f05c39ed7c20f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
d8588a7d7bb0b66fb439edf73ee37563

SHA1
a2398d543e3fbeb197e2128654bb5a1afd599585

SHA256
2210c60cbfec62e2bebd2c77783511100072459b3d0cc296216eab8e72d8af35

SHA512
7c87e7b4ec1d643ce2672ef9badefad6832c6fcc4053cedad2d34c52004aed4e0a589e2f839ace7bcdb0f409fff836ca7ce20dc882d9982568176d4b1c830bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e554d377c7cfd06c55514e58dfaf63e2

SHA1
37a438632b25285d8bf9aa9969069ab0927f1ca4

SHA256
c8d818a03f543895d59c959dd91a942f13d2ddf3c629eeeaa4f68a37fd7c0b09

SHA512
eab5c36045a58293539572ef622dfb0cd3fafe6f6d4cf96d23d1eccd91ccd96b727b7efa41998d6684317378be09270e1b0b5cf4064802d009a073d8256b985d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
242442553f885869dc0d97a6b34dabce

SHA1
1ede02a3e6aa7c0fc2e42fa3a7ab5ed594cb59de

SHA256
01d08d11b83151bb81633d7f53ee2589700caedf7a9e5bca9c57848afc15fb20

SHA512
7208b6f1736e219033a9a036e80c4c8f535e7b7cdbf7ede2096f5f3bc9be283708b564729a1965f91aebde4ec6a598db1f4f1e592449264607b5c1c33931cb6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b4ae62203b850496cbb63c006849267

SHA1
59dfd0463f139403520e450fb186387bcae340f2

SHA256
89d62e5ff7f5adfe3c2172a9643b330ea5f48333f32f5c74ef6458dc7610eb2f

SHA512
6e7567a3650129e4c5fac6784fb441ab6378b1cc8b8fdf4486d43a847d714b3befe51c1efa437d702483e34a70e7bb0046b82e73b052ecc495bce59dd8e107fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19fba2b21405ad0a41d7a5864f2b5e3b

SHA1
0a92fca8328a37d63478411883381551f42926df

SHA256
bd94036e1cabd226a824f347217391669921152132a256cf3f463c0960df4e51

SHA512
2c6c88354bed5ad9d3842c5a062da3b3d5188e669c33d9184f167ba7ed5612d7b7fe10d8fd214180c9e460d3efce60b170fc88bfb90ecc857394707816a80338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f700b940b2df97e376012d3e740dce06

SHA1
bc63a6cf845cd1fd2cf34480cdf4fbb1c321e16c

SHA256
efe27eeee3b2a6f3b0fabf672f76157df7b258041dd6d8dcab07d214def9b108

SHA512
70ec1a0d8ebefcd14f1e7a515bcf555f98909efd3271ae8054249aeae8555823d8fa7bd4c1ca20e1adcfa284e17610f6a11acdb4a055ea328311b13a6e5bfb69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
3c0bda59a0db9e52cabaa26dbb9fd431

SHA1
0e208f355572f10b6babf047560db3907cfdda78

SHA256
1ced63a75beb827fc37b355923114542e61d7e1719284147ef91738e8b5f6078

SHA512
a40264d66f561d4082cee648df06253d7716e73925c0092715b601541ac293ea41b63d0d26ea981373811bdee74daacd56566577512f6a95823436cdde6223a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
4cd924cde57a0afcd7fb67467acfeffb

SHA1
149ff26601b3214f68656ce9f83cc8a8f4670c0a

SHA256
f2b3456fb3c0c488a1ee092ede4b215e2700205c121583bb3bdef887774f9d09

SHA512
41e53900ebb013c5ebdd7758fdfbe2d25b745edfa3117d350b388e85cf977b611f322a4e5a277cd9b7acf5f56cfe3dc384047eef4def86bfbfa82162727c27ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe728ea0.TMP

Filesize
538B

MD5
70924cea022f6d1c7f299a092ca4ece2

SHA1
b1ff3de20d92806bca30602e6e5163e5884e99ca

SHA256
2c8028db619050e1d9aa2a56c011c1557aebc3061265083eeb84739489f2734a

SHA512
2ada0cc085ea2b0ee4acf870471bd8bca363d84dffec6dfa5d749b07e683581b8098aa0d19c5830b515857a48cd8bb1e7ded8f7fdf27c27cf7c28d2c8a4290ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1f0c2a77de6f89f37d43c70f03531b0e

SHA1
f248ab2b6d6c93d8d804e27daff26c7b06e7902b

SHA256
89593e03b439b55273751df79a1c73e9263f278283a71d2129b3a5c9f47cfd55

SHA512
be759b589da7901dfd2835178a00a9205fcfcf5806a0b801e6699d08c766390e3b9bbdd42bd34ee78451ba8084abd2da0bda1f98f95ac73f208a379eeaa19264

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit