hxxps://mega[.]nz/folder/wqUnUTZI#I5QLaN4hzBNT-okvyXZQYg

Resubmissions

18-04-2024 05:28

240418-f6b2mscd84 1

18-04-2024 05:24

240418-f3s6racc97 1

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/wqUnUTZI#I5QLaN4hzBNT-okvyXZQYg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1132431369-515282257-1998160155-1000\{BE235942-FF57-4918-B1D6-A317E7690B3D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
8	msedge.exe
8	msedge.exe
316	identity_helper.exe
316	identity_helper.exe
5496	msedge.exe
5588	msedge.exe
5588	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3968	8	msedge.exe	86
PID 8 wrote to memory of 3968	8	msedge.exe	86
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 624	8	msedge.exe	87
PID 8 wrote to memory of 2344	8	msedge.exe	88
PID 8 wrote to memory of 2344	8	msedge.exe	88
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89
PID 8 wrote to memory of 1028	8	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/wqUnUTZI#I5QLaN4hzBNT-okvyXZQYg
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb342246f8,0x7ffb34224708,0x7ffb34224718
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17745292761688524707,6599967364362839225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6544 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x4f8
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
97KB

MD5
9026c1a039bfb1796b34eeb74a8a716a

SHA1
0fff9a37ca34aa4811e4e48f4022f1e3bb5f95d0

SHA256
4a3b444e966106bf9551108f259d543858a36d28acd8d2dd2f38e522ec922cca

SHA512
51704c92f1a4fdb55604faabae333157526fb93f3b669aeccdd04a9f728122cf81bc2c8ee0df2efa23661666a697e8f4daa491b25a64282aaf68a4420d341da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
48KB

MD5
21af9bc981d404957c6344aaff4b3e28

SHA1
e5569bc0876884ded0d9594432cc261effc66d47

SHA256
e9515acb1b0c8f7c1008358ed424d6563cae681f0e87c53547d0cb7b9f51b051

SHA512
fb42427a114a3cb5739c30f6235c4fe3102876b2063772665c82ecce483955d357dead930e6da185f2b27fb0e72b9837ee272c3271efa5b7e80f98edf4cfaae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008a

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
29c6caf5d06bce91f96e14570424d05b

SHA1
92e0ae7cf6760b352111d38b57aeb10774f7d9ed

SHA256
b3a8cfe1b36e9ecc5b5bc7a6d7f83d832ad74c62e8662801bb530d8cdccada06

SHA512
011e965a4e334341d81ee53b6c6c63f3e6f36ee9aab5f663354b7d42e473a65bbaa21a9ace94ae7e85bcda143099851ceb8b381394964915b33624f3f4dd62f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
17bdcb1fbf808b8888a1cdc517d06533

SHA1
a77a48654fecb169a0570be962290ee85cc0c2a9

SHA256
e8e75c4aa2b6460a7b5d5d40bcac9771edc78c29ef75c7330a13865857c08cb7

SHA512
97eeb5e80b6867bfcc23de79fea44d1cd5c13c3a8d88a3ab318808ccc132e1427605d3dceb2c4c5bbb0ad70872f932c8a24da4c22630cad45e23f4d3621f455d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1fbf1daec94a047b071859a0628b7582

SHA1
54ce9c9fe43f677d619f94518989a3e48ee4e86d

SHA256
3751a534d63e87aea327222edfe682a66de574a577868b880bbea89ba7c427a3

SHA512
b0b415347776d8489c1197e46aee86c5d429482eefb049b4b5bd4965e0a4bd8af95d0ef954ec1126a9ce1efc3f9c5edc5a64131ef7ebec9f8b454c873ce791ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dc21fefe5027f3198fec37d9f0b17989

SHA1
10d7078edd980c2e7fe9708149fccade209be042

SHA256
c9ccb40a955073ba2d14d2d0f6dce8baea8171c79d2261942c32c5d7ea5886c3

SHA512
26a31ce6e4b8d770bdcafac13765be718384febe37eb02a4735dc082c720c2c0df20b2c724ab4737d21ae8d1cb38e6a195690704a69286b622a1b40f1a9c516b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d775e969121d2fa32d9d1afe96712b6

SHA1
9491cbd90d326e213f1626cde2349269fad27193

SHA256
c1fd4fcfa6de831542a5b45da26f237c1a3030755cf7330b43d5fbf6402ea8d0

SHA512
dda4b4c13b4ae3afbe8087b1bc3215658e0dcb81282940c39f8c641b1b1241021105877f1a89028150f449339813e82936c93177e26ff15b43ea9f9d68f4c1ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
91b0b20ccf4664de2443a3b2cc4f435b

SHA1
86ac7c6df5bd114b9d69e53c2e33c7cf4c7a4e82

SHA256
60cb5c6bebf3f13bdd223901fe9337fd090e92f1a4e4b97ce393e847d074cdca

SHA512
3260beae40024aab88b82b4e7466ee9b5765c3fb69aa18e68cc243a5dd714391a8990bfc9830428d565568a91a2685f8315ca2e28684c3b1a12262b119a9acd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a84927289c26c66ffe170818e7fa97c

SHA1
b60d0ee2fa746768a179892483656826eacc7874

SHA256
b03804205f1b5537914cf933a98391039ed55fe9f10822cbe08a3991dd5dca7f

SHA512
66faa1a85eba0e75733447fdf8a10a4a891c6cb9c21b73bfc2a25498d52e41512ce230a7881177b1f4ceebd1ad71b1aad83079714fee612408220f5325dd819e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d51b6287c906a242ee249a18180aa6be

SHA1
51a906d16ee1f3263bbeb8b41d3acc247895d20f

SHA256
7d2de38f7faa406f401e46f0f6bbdd2c0394e4587c28b89cb7c3075de018bae3

SHA512
f056cf77713d44bfffd3a4c3ecfcd77b6c6fa47bced8a7f7c425ac6ddb5ec4ba3bd38f89e27265edd608830048b3fd6e73fafb239222db3af3b4365b1f57fe8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7e8bd9d4144e24be5936ee481693de9

SHA1
438680b08a06d0a961da9e9bd2898c286fa47ab8

SHA256
5c534c84aec0df9d9d61db9453b1d5d53599d5717449ee014cee67eceb29eb0b

SHA512
491729f07bd723ff535995dc141b44de14b29b24d911f23749c35e7102bdf4d9d79b9cc586bf7bb064b376f48a80f92afd6e0de5c355088bbe09e1969c311787

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
65c3fea43a788f51d01be2fdde8c06a7

SHA1
73065b128118c20f17fd4f73820be44c51006bcf

SHA256
4d70c9173282b4074997c0d7eb15533e7949b8677d0a881596be80e6d021b4be

SHA512
e22e9907874c8cfd4c292a917b07029ff53342c9d428933bf0e7d17e6d22c92baca8255dbc866396c08a0476d049f66222632738a225517a7e890ea5de19a345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe578df8.TMP

Filesize
48B

MD5
99c393714b6910d76fb59ef228d6fede

SHA1
4ea567e4145000fef2e79c6403d00d848a95041b

SHA256
cac625f7a2ac1cf57663ec1d2a96a806ebad082696a3b446ca495cc43dd1db58

SHA512
9039049719c4d5655c9fbb9022bc5d7eb77a80d5ad18d9f03959be327eab720d73ba2d12220913753b430a7978c19047bb7af847971f284e93f19a4233ddae64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d83f22d4840031f3e20291665885e9b5

SHA1
dcd49255f44c9a1db7b5d407950a7eb2a3c930b9

SHA256
9def67bcc56ab63f29be231bccc8f6e7a7221df02ca43a8d48fb42d99a3b94ac

SHA512
75f7001e6bc0623c4979df3f32511a58518258dcaa4625154aad7b071296daa3cdfb17fbb829f84eb9be06f382ddb15c719cec592e323038ccf1d6e7a59b45d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25bef1fd91fc983466087ee99cf3e431

SHA1
1123d7cb8e0de5f4144e40c5f300580077eeabab

SHA256
60da67e0ad97782f30f180523cb813157b7457d783b6c122e756e481b8eccddd

SHA512
b89341ef651b8d3e82147d57412faf4744458af9e3032d7279d1d465a5968e424cb93e9bae78d81c2f683a023f125c8e7cba8b5a357f3e166212cd42c11163e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ae52d18aa1069ffdf497d867388da25c

SHA1
90460803ad81c4751b327bad9c1c139eb2948a49

SHA256
591bde3e71cabf598bd03ed81ebf876f8bdc27de65b4e8ffeadf65a6ce827fbf

SHA512
20530eae887d3117ca28648e7d24afbb4e9afd5bfccdf65636f4478c3016cd5f03fcaaa897aca3ea97425aaf1c32d8ea87c25385c98238b28e13fcebca632254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c4757c218160c7e4b5c8f40b368e9b3b

SHA1
48a51c9f97df11ed2f411186dc9e6588b07d093b

SHA256
ab6a5895ee7db7e6a08beec40f7a95d705a7e55f8dd6a661005c8da04f9312f0

SHA512
d91d18aeddf2b09f5ee0e33ce4bcb7a7a320efb9244a0a9e793a463b61ebc5d179ab6b48069d336c48c82ba487669b7769f9de2775cbeea56cb0635462d63f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1468400138c35b25bf686485507784f7

SHA1
a46aebb5eb11e10f3eea9cb8a5c50f298fe8e683

SHA256
1296c4b9f65c69322478b557039193ed465e9c9e266a89a16627b76ed1d4685f

SHA512
f7d59b5b50dad93c8cb91b3074fbf34ec7cfd81a19d05957a55e102c98699f3cb1c8a3768e30f300529e9ca62f8a8ead5c1f6490bea511b609b2e66e18e447e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c884142456aa1a9d97bbf774fdc5f1f2

SHA1
f53c1c1a02ce1d57e3eda940d6beb9d22c575ae4

SHA256
8d24deae79330a7be9ea3ced7432185565ab5b3c6d1be0186a3d1aab03f9334e

SHA512
d986c8a74c112aaa0ebe593727fe2730dcd92fb9aa6dd2628dd23ae9d96de20597019b2685225ec7c7bd8ab05a61a3dc9e79e84f1f1b585bdb14fdeae4f0f731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579de6.TMP

Filesize
1KB

MD5
a0d1d2c46170e73e459feff7b6aa3cb5

SHA1
12cea3f7bd62382f0933a1bed44aaf76d2d2a6b9

SHA256
108cd026b5d45ac4abee7b9eb048c29299c3c1884785e93c4f825cee1b3286ea

SHA512
38aa762cea8fd3168c831e0d8b1d707805f503dac5f1e385acb638419899c5544915ef66e6bd53f685236e116b55c3129cc1423dd40a1e7c11d2de38f93ef6b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc7aa1e3-ed6c-4ad8-b99d-961ee06e9280.tmp

Filesize
1KB

MD5
461c92ae1c3c9c168786e19021041c5c

SHA1
97b7d4fe170855769c44b8e4b9cab1adf23cc604

SHA256
874b7ba8c51b329fd758869710c81894c5fb99b119d2c0871e3d7af699777433

SHA512
39205bdd7f5916e9c87a5b659c9de5d3fdcb3fa83841f4d21fbdec3c3e6638a712aa68534f28c502109e83de03c690a12dc12fe150aafe5c39f52abb08e1ec41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
249bb1a3f0bc63c072d2f96406671579

SHA1
77f1ee9426b8a1d25aa7cce3fb7e21c759832100

SHA256
4d69e70536d8b38e7a3e7d9af653d519832e91240c87cd424339670a745f7524

SHA512
de7418dd5598b2db908ccbb83a3f968f739074f2c067ce969f5d99456d59b4535ea2f899db9f89524b89b93ce67d6ff9228018b852baf15e411b71c069d77089

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit