837ec0e9287fcb56331695971c618ce18f14dff0107ccd5749bd51c75bccc6d6

Analysis

max time kernel
136s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rift.exe
Size

279KB
MD5

53079cfec7e72232789416f1adb5e41e
SHA1

7f9099600f8bd745cf020a93ae3c4b9278624a8e
SHA256

9b2661b1eefc555a5ccacc9eef7285d3fe288e71d75351eb2e7b4f4fcba9b945
SHA512

e752de02a5b8be11dd243c9eed341247b0a3302b42371a6e51932c64855dcc428e2ffd2076b9a7faa798c6544884576b0df23b82784d09f5b9f0479bd47624ba
SSDEEP

3072:D6eSqsywT/IiODn5Ikt8pKO9WpheWyutIRMQc59uxmZx:DLDn5I7p8hen2n

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2231940048-779848787-2990559741-1000\{0C632CE8-2706-4249-BCAA-EAB57C30B597}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2231940048-779848787-2990559741-1000\{1D057C7C-FA5F-4F29-BEF5-8D59004F8E5B}	svchost.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 385104.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 385104.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1588	msedge.exe
1588	msedge.exe
224	msedge.exe
224	msedge.exe
4984	identity_helper.exe
4984	identity_helper.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

Processes:

msedge.exe

pid	process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4396 OpenWith.exe

pid	process
4396	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Rift.exemsedge.exe

description	pid	process	target process
PID 4356 wrote to memory of 224	4356	Rift.exe	msedge.exe
PID 4356 wrote to memory of 224	4356	Rift.exe	msedge.exe
PID 224 wrote to memory of 1516	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1516	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2500	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1588	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1588	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 1988	224	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Rift.exe
"C:\Users\Admin\AppData\Local\Temp\Rift.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&gui=true&apphost_version=3.1.30
2⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb50b346f8,0x7ffb50b34708,0x7ffb50b34718
3⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
3⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
3⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
3⤵
PID:1312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
3⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
3⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5184 /prefetch:8
3⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
3⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
3⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5676 /prefetch:8
3⤵
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
3⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
3⤵
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6672 /prefetch:8
3⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6672 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
3⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
3⤵
PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4572449471452456439,5466431133009548995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3788 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4844

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:1468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
3066cd87efeca1b47ab09feaaaa717ce

SHA1
1ab375aba618b32c688072ba01a7771c57c27e97

SHA256
c7f76a7f84f56fd5af17c5703910aaed67d9a07dd917080febf004ac8fae22b2

SHA512
835a3c036d99b2e2239748bd027264568ad53f11e121202e309d869570b7cc552d15dd919119071070bb57f3508c85715d397cc6b357863ccc6efe10d46ea370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
86416e635c8297e2b0ecac3123fb4aab

SHA1
03e2dfd59ff30c25529cbba0f90509db412810d9

SHA256
2ec291fe1e3f00285ecb98384a172a6043de7676e780a575acbbcafa15ed015a

SHA512
e3c0d5738c2b8b7dab05b2c19ac6aa6351a5b61f3cdd064ebb83e1e863a12016c2146072f20901fa0ecb601146a4cef04f6caba91b8abca5ea0c22b9f2761e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7e6fe2f686a533c9d343f5800e28af6

SHA1
30f2181d2b5e27f9a9d6285e2c004fcdc9a72caf

SHA256
80bee515a5ab901a6ee2a110d60ed0af11b39c8dd1d707b5ea3ae04a684af8d3

SHA512
2df3fe1bb6b532449cdbb29eaf5624f800164a2d8a8386b815570d77cba4d4039676df06f04ebf857f000533af1ba4b363381d7aa542c7c6a6515f2f05475a45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
294e4ae8d6efdf6e7032c64cbd538fcc

SHA1
6d962cc654d0d944e0886e41c4492f39982137c1

SHA256
175f6a99ebbdb5be65354274c1e8d5abb9e3a2d4ca48ba7e613be602ac0c39dc

SHA512
e6a92a5e250b759e3e7c57c71eac245254f827024702ed741405afcfa7549c7fb34c98d7167619f5140375b78147263299488ed942d4b1dc177d2aec6fa3c5d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
55e54aecf275abac5c8f885b5c3e24d1

SHA1
8d5c634fcadafdf46accf4b54ceb2c8552b9a62c

SHA256
36e3aa18c12d701c7571432acf3346a86fafb13b26dfebd998e5751e32b78176

SHA512
18062d2502519edbd38a1647265bf2e50f011fb06cdcd9539d14681695a8247286221e61ee109c1743028e0de7c4ec9a0c5acaaf1bb3d9ce102215d1617ceb9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
df69fc35805967a916caaf5da28f400c

SHA1
8df06a5720569a866e0fdc3f502594d9694e693a

SHA256
396cb6956cec1e6273c062a76b2abaed139e697ac89274e7fd30f94853cdffd9

SHA512
7e67464f8e9defaebffd7a54a9a95ec8e84dc7cdda2fa58429e3548bda51708bb2c91102b00dff01cafb006378ae36cfe91f6e684db549c9280cf754bf9a8df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5931b5.TMP

Filesize
706B

MD5
72b6bead7b1eea1389f4ec1fefd08632

SHA1
b93bcc9404fef845922e8f98286407a1fcfa4c9e

SHA256
874168299530d64ea8220beb5ee93f52348140a6cc04dcf8b3dbe7b20094bc68

SHA512
e424e2a3312b82a65bf45ab69160ec7832364ec3fdfa82e3fdd7ba5827cd918c394cb691e220ec9a1186da56f5637b48b29067f356904a3f7729e691e821fa02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa814589-8bca-4a30-b7f6-2ad3c59592f0.tmp

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2fb1f8a87bd4082e582d4c895099a9fb

SHA1
466f48909e8250eb1e3003369dca246d33e9a5ee

SHA256
e976b5130d7edbabea72c7b70149af3b55670f458d035f1f1ac117fdc1811982

SHA512
4327ccb53c4ebdf4415f85d1a2d9182be2010ba907526ffc3ba292f1bbe530c4f33a07cc0489a8234efc6e9857e5a35d65513a24ed0eba8d29b9e58092647b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
00600bbbfbca4e8d5b762df8d1abdb06

SHA1
2460726f1ec187fdf4422720208cf85dd6ea3fae

SHA256
d47ebc07fd391e809bf994df9ad020c11a3c2876e94ee8a51260abb2559eec08

SHA512
ade2f6fb6d88413920ad7661ce6849da4e8d1f88c7c7b24a0e1c7a903eba15a7b9c8177d5c41bab9f091f82586babc05410c37c029798706a5e583b8b2a29102

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
\??\pipe\LOCAL\crashpad_224_OGIEBOIXPQNQOBNZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit