asyncrat | 93c4bdda249ddc80ed634c8f4656872fe2fe4083fbd7c8341fc094474ac69af8

Resubmissions

18-04-2024 21:11

240418-z1nb9sfa27 10

18-04-2024 21:06

240418-zxzwwseh45 10

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C11Setup.exe
Size

252KB
MD5

adb48fc0242b35f84394ab6e76a60c14
SHA1

76200b162b7cd180f25a6effc43e573f665af0ab
SHA256

93c4bdda249ddc80ed634c8f4656872fe2fe4083fbd7c8341fc094474ac69af8
SHA512

f894e5f1d01ad5ae3764065a2334178076021a517b1b6db2cc9a77b7230ae6e3c946e527a5d8e8f92de59a49334403461db9f8afcd706ec5dcfc5bc6f897dcf0
SSDEEP

3072:TUf1cxiaUmPMVWDFgTH1bmOQiR7c2ytBcL5BdkwvTkmEdXYY:TYCUmPMVEuVbzHWwvqdI

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

127.0.0.1:6555

127.0.0.1:0

127.0.0.1:4040

Mutex

mqdprsvdfq

Attributes

delay
1
install
true
install_file
CABotstrapper.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718508534-2116753757-2794822388-1000\{945E32B6-7033-4CF7-B309-91C5A86A9AF2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
772	msedge.exe
772	msedge.exe
3584	identity_helper.exe
3584	identity_helper.exe
4584	msedge.exe
4584	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	C11Setup.exe
Token: SeIncreaseQuotaPrivilege	3220	C11Setup.exe
Token: SeSecurityPrivilege	3220	C11Setup.exe
Token: SeTakeOwnershipPrivilege	3220	C11Setup.exe
Token: SeLoadDriverPrivilege	3220	C11Setup.exe
Token: SeSystemProfilePrivilege	3220	C11Setup.exe
Token: SeSystemtimePrivilege	3220	C11Setup.exe
Token: SeProfSingleProcessPrivilege	3220	C11Setup.exe
Token: SeIncBasePriorityPrivilege	3220	C11Setup.exe
Token: SeCreatePagefilePrivilege	3220	C11Setup.exe
Token: SeBackupPrivilege	3220	C11Setup.exe
Token: SeRestorePrivilege	3220	C11Setup.exe
Token: SeShutdownPrivilege	3220	C11Setup.exe
Token: SeDebugPrivilege	3220	C11Setup.exe
Token: SeSystemEnvironmentPrivilege	3220	C11Setup.exe
Token: SeRemoteShutdownPrivilege	3220	C11Setup.exe
Token: SeUndockPrivilege	3220	C11Setup.exe
Token: SeManageVolumePrivilege	3220	C11Setup.exe
Token: 33	3220	C11Setup.exe
Token: 34	3220	C11Setup.exe
Token: 35	3220	C11Setup.exe
Token: 36	3220	C11Setup.exe
Token: SeIncreaseQuotaPrivilege	3220	C11Setup.exe
Token: SeSecurityPrivilege	3220	C11Setup.exe
Token: SeTakeOwnershipPrivilege	3220	C11Setup.exe
Token: SeLoadDriverPrivilege	3220	C11Setup.exe
Token: SeSystemProfilePrivilege	3220	C11Setup.exe
Token: SeSystemtimePrivilege	3220	C11Setup.exe
Token: SeProfSingleProcessPrivilege	3220	C11Setup.exe
Token: SeIncBasePriorityPrivilege	3220	C11Setup.exe
Token: SeCreatePagefilePrivilege	3220	C11Setup.exe
Token: SeBackupPrivilege	3220	C11Setup.exe
Token: SeRestorePrivilege	3220	C11Setup.exe
Token: SeShutdownPrivilege	3220	C11Setup.exe
Token: SeDebugPrivilege	3220	C11Setup.exe
Token: SeSystemEnvironmentPrivilege	3220	C11Setup.exe
Token: SeRemoteShutdownPrivilege	3220	C11Setup.exe
Token: SeUndockPrivilege	3220	C11Setup.exe
Token: SeManageVolumePrivilege	3220	C11Setup.exe
Token: 33	3220	C11Setup.exe
Token: 34	3220	C11Setup.exe
Token: 35	3220	C11Setup.exe
Token: 36	3220	C11Setup.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2496	2060	msedge.exe	91
PID 2060 wrote to memory of 2496	2060	msedge.exe	91
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 2976	2060	msedge.exe	92
PID 2060 wrote to memory of 772	2060	msedge.exe	93
PID 2060 wrote to memory of 772	2060	msedge.exe	93
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94
PID 2060 wrote to memory of 2728	2060	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\C11Setup.exe
"C:\Users\Admin\AppData\Local\Temp\C11Setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SaveGrant.xhtml
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff84a9e3cb8,0x7ff84a9e3cc8,0x7ff84a9e3cd8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,1227253663808937002,11284405872066133112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4508

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D4
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e5a2dac1f49835cf442fde4b7f74b88

SHA1
7b2cf4e2820f304adf533d43e6d75b3008941f72

SHA256
30bd1e1bafb4502c91c1fb568372c0fb046d32a4b732e6b88ce59ea23663e4ce

SHA512
933ac835894ce6cb8aac0261153823c96b6abec955173653dd56e534d644efd03aec71acb4f8cb0b9af871962296ec06cd03e570a0ac53098b8cd55657543786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e15af8f29dec1e606c7774ef749eaf2

SHA1
15fbec608e4aa6ddd0e7fd8ea64c2e8197345e97

SHA256
de9124e3fddde204df6a6df22b8b87a51823ba227d3e304a6a6aced9da00c74c

SHA512
1c9c9acd158273749e666271a5cdb2a6aebf6e2b43b835ebcc49d5b48490cbbf4deddef08c232417cee33d4809dec9ddac2478765c1f3d7ed8ea7441f5fd1d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0265aa80543d83fb130d00cdd38605e

SHA1
4f0e926ff0ef2c74c0572da829ef3ad75b209e31

SHA256
a5ee70cb986ab5a26ed3872af5815fec55c277933bd974feb96b651185a0dc79

SHA512
ff3a410dc7513ef8409cf0432e7c9b037b1fb0276a582557ecb9f101175a26dadaa9c9661ff93f07fa557a9ed33c074c15a07021899b7c63882dbaa150388390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4077790425284a719970dff4697dee2

SHA1
f749d3d03ccda4b2e2f116c39bf7d4ac171efc2d

SHA256
fba69b2433f93551f72a347816fa37a46774d4175e99842a15a794c0ca6b358a

SHA512
00e85b30b8ad6154e8de87c1a3b888767ea77931eb7282aee485753b0aad3d010a98561f77905fdb15f39144c76b60dad75e3ad53717974360f69b356d942084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b77004da127152c8155d5a87946416f8

SHA1
479aa4a928f9ee1eba6511ca052b49c87f53b251

SHA256
05fa8223802546a552c5f7ae5364b33052adc6ab41965de850cf94d0f5378534

SHA512
60c80131ebeaa7019d259c8348a6fd7cdb8bc7641a3cdcc5ed5756395b08e2d7b2e4b2939c0b05f3c3882e82448069c735d41adaa892cdb2ab3b16c8f7c6ea38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c96de8dfc51950a14568f913b0b98cd5

SHA1
faeddbe38c4e18e8ae723220f7ffc1f525140027

SHA256
3ac649535470cabb842e00cf4b1ad902d474b95d7df9ba28464ecf243f9daec6

SHA512
50cbf22234a0e44cb5dfe999cca8495f786f3bdbb6e7298e2d7a2ae91069c87d87f2f4f608c7b6a8d318d21e3ffaa583152893387768b60727697478cdca461e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3e1d14d4bae8a732d0e8a31c0d01729f

SHA1
3a91bfdf9770636386a3b208dd5a27085a2b09c6

SHA256
c5a739f38be67df5693d7d693a3c6be42af5effb9bd86828d439d2ad6ec322d2

SHA512
1c108b59e672eb23749823d949997a943e67c8d657563e87ca6b9848bd3893257db7463a5beb12ec37bf4ac49e19c0787dfba454f37b6f5d77fe7c3aee65d0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dbc11803-8a4b-49ab-b457-6b6a5d9638b3.tmp

Filesize
12KB

MD5
9f813d90d076da0cbafb7360d149eb40

SHA1
9d96e97d1a6ba95c148f6fcf4627e5312c3e684d

SHA256
8a18cb2498ff88d3882077f5bfa408d359074e336edc666f6ecc696ed41785fd

SHA512
975a038d8878cfd3f576ad7ca522b444232c6908aacb1a435ac3b2a7335adc5bcaaab022774cff2b90eb7e3e4c227ecb6864ed6927e538fb4e57942cc9727447

Download Submit
memory/3220-0-0x0000000000CE0000-0x0000000000D24000-memory.dmp

Filesize
272KB

Download
memory/3220-4-0x00007FF84B1D0000-0x00007FF84BC92000-memory.dmp

Filesize
10.8MB

Download
memory/3220-3-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/3220-2-0x00007FF84B1D0000-0x00007FF84BC92000-memory.dmp

Filesize
10.8MB

Download