f0f2ee7efac49fb975781173db74e67e38e7a49664cae1e65788b10a73675baa

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

824-97-0x00000000002E0000-0x0000000000310000-memory.exe
Size

192KB
MD5

6d48ed4d6611e523a7826db28695cfca
SHA1

31587036856ecc68800a32e31e2451e9822fe892
SHA256

f0f2ee7efac49fb975781173db74e67e38e7a49664cae1e65788b10a73675baa
SHA512

cd15d552aebe2486fa1c96daf47629b45c44b9a1978361085776d25f7ffbb78a57b2efa574b1b549f714e6e512079509e72b76d39038482d6d85e62cb617ee80
SSDEEP

3072:J47FCYO0NJQ5S0xNcIA7qVJeNGt8e8hy:Jvd0AEnCVJeNGt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{C3134B37-377C-4251-A30F-D1104462ECA1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1640	1560	824-97-0x00000000002E0000-0x0000000000310000-memory.exe	103
PID 1560 wrote to memory of 1640	1560	824-97-0x00000000002E0000-0x0000000000310000-memory.exe	103
PID 1560 wrote to memory of 4116	1560	824-97-0x00000000002E0000-0x0000000000310000-memory.exe	113
PID 1560 wrote to memory of 4116	1560	824-97-0x00000000002E0000-0x0000000000310000-memory.exe	113
PID 4116 wrote to memory of 4080	4116	msedge.exe	114
PID 4116 wrote to memory of 4080	4116	msedge.exe	114
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 1892	4116	msedge.exe	115
PID 4116 wrote to memory of 268	4116	msedge.exe	116
PID 4116 wrote to memory of 268	4116	msedge.exe	116
PID 4116 wrote to memory of 2396	4116	msedge.exe	117
PID 4116 wrote to memory of 2396	4116	msedge.exe	117
PID 4116 wrote to memory of 2396	4116	msedge.exe	117
PID 4116 wrote to memory of 2396	4116	msedge.exe	117
PID 4116 wrote to memory of 2396	4116	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\824-97-0x00000000002E0000-0x0000000000310000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\824-97-0x00000000002E0000-0x0000000000310000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=824-97-0x00000000002E0000-0x0000000000310000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=824-97-0x00000000002E0000-0x0000000000310000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x2a8,0x358,0x35c,0x2a4,0x368,0x7fff688b2e98,0x7fff688b2ea4,0x7fff688b2eb0
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2272 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:2
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2948 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:3
    3⤵
    PID:268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3084 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3428 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3444 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4888 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5084 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3604 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5192 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5744 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5744 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5852 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5804 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5956 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=3564 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6036 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5956 --field-trial-handle=2276,i,3207366468803192798,11202831713194117163,262144 --variations-seed-version /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4136 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:1
1⤵
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5048 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:1
1⤵
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5444 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
1⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5536 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:1
1⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5588 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
1⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5624 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:1
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
b58211ad0be2a2e0819203d22e07c2e4

SHA1
090b9c4c425dba69e4b66650745cb229846846f7

SHA256
fcc1a21bdbf065abd75206ebc208a4068e5e74dbe5a377fde2050cac2ecd34a5

SHA512
7eee3d92834509f833668dfd47913efff3b6af152e98a7df927558bc8c747347de7cae868e53730f8c22b38e358cc76634308a06eb75fff4a00c7af23e6b63f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
91e60e466cb23688852776f8bb2fc42f

SHA1
b947a5d32579b0cf10e57995a1eaf1f6659e3c10

SHA256
6ed2529d5ea92a429326b215995c9e2ba7d150bad6044448f0dbfd88f180df8b

SHA512
6733dad3b4cba7c806169b11d1f9bf55d329a20efca6e64569e72dd67519268b539789a8554bf71a60645b21560017659d482ac500234754728fdd768dcb5a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
306ad16889cc6df6dc3b012f018bc9a8

SHA1
65b3f41414283a34af6defb262ceed174e954665

SHA256
253c7a4d16b0abd16443898e36dbd73598b9047b1342368a45e3d52e2c0f8932

SHA512
b4b85293fabc10174c6ddeebf84e467f71d0a90821ff0bff747379e374d3691aedd0004d807e27764ed0a9a475a615a1b1597211fb3fe7b6ee4af4cb52fb2cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
500283c402474399b408f7eb9d37696f

SHA1
0ae2ac9412d19569ce8c2df02ed1341c393f611b

SHA256
10f4852e68c914ed6cba1e0209666c5f011a9eaed7ed5c47b6c933fd057ea92c

SHA512
58b4cf81f610d98ca91a3b0264d29bb9e3d9c70b02d1775ef4efc08031acbfd74329cb0642363f27c252345571e0557b4c3eb48bc5520c40765af29061344ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582083.TMP

Filesize
168B

MD5
72a246b32deb7b4928643d3ae0873d60

SHA1
8d5f981c82f3bedbd95d8f900c4c71e820ada634

SHA256
d92a6993961b0cda43c803435adb338d815e30905ca3d8d14f24be384434ad41

SHA512
dc74a51fbf14a89fc035cb71f287c08a9222f60729db8c9af163c544fbf5491a402d57af5da351ca03dc2a6605aeb43147b13eb7221fc003c4cfbc4595ba6735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
cd157e93fbb8a1f0f33ba886a1625c9e

SHA1
11fbab5f50212f9b83dff4a09dfd358ff00d6e26

SHA256
002adfcaed1780bdc0f7bc67b94edef631cc59c49db49b41d3ad700ccb1b14e2

SHA512
de8dad3be634fa68caed87d4cc21093a924ab9290b678d951afcf2452d7679e6a58e701b557d9d2aa1cf6655a6b1f5a4685afd74287dbd6e16fc55bbbdf18c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
dea9c5130c081ef7887ef58440a97c5b

SHA1
c297af0c3a3fd04c2ef321438c3d860a69aa433e

SHA256
2db1e934eec6b177a50437896e477243570141218d7fefbbb7cacdbbbe687a0b

SHA512
50895f8772a5c596529b2d01f8f5a595c0723a1ce85c9ae010f939a19ed3c384ffd801f0df9e8f46e4eaa8140fc594c09fcc2f7b750f24715f2372615b963f47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ba01cc0039e19d9bd3df68c96012d806

SHA1
92ecda369089717693c1047ca149d9defce30641

SHA256
c6e31e9343d87ac8b15151656f72733e455c27662918ae68d70e057cdaf3d3f0

SHA512
20c207f48683dbe3e959df85ee0b9335a285ee66ba5ebe6ff50098a0d2bc59e65f5ef2a6cc815bd7fd4e413f2efb62fe47151969c25416c3ebdf8dda35a0586d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
cdf96bc9514edc1565853798261499f0

SHA1
f4490c6de4d46b188870fda735205226d0efe3f6

SHA256
cb0fc45af52e1828b47e9fe61dbd0bcce08672bb3af7dcc08325b1938d0fecee

SHA512
d98f7448a3f58d6205b86a2e458b6d62c4b350da69f335870788d5755c49d5ae6385e3318801763a29c4988f03388a98526e728a81631d9d32db6704d2388505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
b761f5b01349b04440ed311c5baf9d97

SHA1
76f731f0b2b7fa25868b58b87d42a863c876b245

SHA256
c60c9d0c5ef5f74a458f1b0b03e6a94d397b669fd55f24566d032986930b5d2a

SHA512
9395b31d23991078e3378d40c31037c2984f8724d0950ec8989a6146707afb491070f3279acf93e9fba949fc29de8258802a10b04eec7534261d25df3b42bac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
f056d32030e2b41875508f77e3ac9115

SHA1
542d1f782740b308df0ef5bdc704910783ce5e3c

SHA256
71bc227be5d387825ebbc3b6dfd9a3f9fe16e063d7e5840dce931953b41ca1c6

SHA512
a54e0b39ab0a6c4556c51403346c0e13cef0a4e886f64cddada7cd6acf9714d143778ee9191e40a0b1eb235f1687e06d42eb937051141444e4e391f681c7be6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0d22145df4403800d3696901e4b9d1d3

SHA1
fe25edbbfe57a88633c38e0c5a50103810d1943a

SHA256
80a66346ad24621422f266c88dd117cb53339347943324c180504a1fddff7e68

SHA512
c3b7acb9b8548c83259aeca10faff636b2aa1e2e2aeae18cf2cdbe81d01fe67c378833faac6cc8e9b84bfafc192a16d13267bf32a6f71d0e35b842f0f81f6f2f

Download Submit