hxxps://saveweb2zip[.]com/en

Analysis

max time kernel
65s
max time network
68s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2024, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://saveweb2zip.com/en

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-801878912-692986033-442676226-1000\{9E37FE21-5471-42D3-9F09-5FBF60382C41}	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
1044	msedge.exe
1044	msedge.exe
3728	identity_helper.exe
3728	identity_helper.exe
1212	msedge.exe
1212	msedge.exe
3788	msedge.exe
3788	msedge.exe
2012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4624	1044	msedge.exe	80
PID 1044 wrote to memory of 4624	1044	msedge.exe	80
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 960	1044	msedge.exe	81
PID 1044 wrote to memory of 4916	1044	msedge.exe	82
PID 1044 wrote to memory of 4916	1044	msedge.exe	82
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83
PID 1044 wrote to memory of 1224	1044	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://saveweb2zip.com/en
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x48,0x10c,0x7fff2ecd3cb8,0x7fff2ecd3cc8,0x7fff2ecd3cd8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1916,9224123989092591960,2298288720664953800,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae7fbf62fc07f0bdb15169d2de3dc768

SHA1
9155eb973df31a7d6fb95f03058dd523171b4f0f

SHA256
ecfebc84b01ed9071cc68bc2abc4eae4f891e1dea41a16ea6010f7acfd6cc624

SHA512
1539bd6c522e56685399616d9811435ff0197c9471404361c53370a261feb180a38aaec9aacd38ff52c94b2cac2e4da19a3de50a9b6541f6f3fd0497bf15bcae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a5e869975d65ad786022d6fc8b47b747

SHA1
14b030f53bc86bdbec766b2f3942804ca742043a

SHA256
d5f8f63c67fd06a2ae7da80cbe8cc96bab5932087eb70432df9147ba818d758f

SHA512
fd8d2b8ce13f4aca312f4856096edba99310a78a5f4c4148046a06e873a3d2514fd2dd9b4515fc89e83306d251929f2ef9c78863f85a3e017a3029dec63d98dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f6226a37583d3dd96f0ab5328d34fbda

SHA1
85cadf5d1e4c070615740f3dfb9027d7d2a9a710

SHA256
57743c161f177fc580ed10a45205fdb091a85a53b0eab2a72a5d38be879c11e3

SHA512
8b88e324f5c98222a5cc9cd2812f83dd109171e31a076cd58486e3a564d03b39dfdf7aff94263ab545e3e03b40a45e68d9b55eb7e4094af56b129b5bb4613d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
fd99d07a079c9c49eae93048ef0049c6

SHA1
59de4a7293c25ae618e38bb27df632fed8c39551

SHA256
a78d5fc7cd7d0a15c2a665acd4210bb96f7e5f5b1713b6f958e5bb806afa3d11

SHA512
51556c78f91fc8d2a2db8fcd40d0c612bc7e3bf5e0a1944b0171ed436417a4624c500f61d1e1718d474efbf13098956b67d6b35c599f7cc4bda1dc0c270747bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
595450db3943ab106f12b49bbc4cd081

SHA1
7202b2609b6136f51f029cdecdf744e85c5190b8

SHA256
15dc4ac1d435c18c4ab026a31c41298736ed325cd95a8b51b3ff2dd7e42b928f

SHA512
8ef8bc92b063d025f48175729ffdfcb00d56c4497cc0b1076e26f77f806f84e13b358abb6f22b80ce47ae63f32334095d05ff182f7e39a4e164a229583783b01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1c7d221b085b14a3d02ab85ee81eed1b

SHA1
d23d612ffadf511ff0d0bc9dff81b32190255fb3

SHA256
560a8570ba051986e9423f9b6285c85ad8456c19e06c74e398cdd4bfdf1e6a7d

SHA512
242b0a23c351ed826280f9358d605d5ec9e156c850ba057cbefb6eac2868718b4988948ce791ff279c3190faa585ed8efbda0c8af5984822fd9031e775902bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa259b37720f3f1dde1f889f7b9b1749

SHA1
4d27905cdb8c88977163db26600606494948c3c2

SHA256
42f41162b7906abd73f8820dcfc770b7af57b2617b39ffb427550a848d13fceb

SHA512
1cca7cd93bd97c6e28a41b019441d0604298efbd6adfee7c4ba53095145a0e50f8acc5c11be3e115076e9dc513c2a96cb91fc5839541894dd003868f2a3a1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ff6a69bcc6ddf9b883c8b8bff0310de

SHA1
dbef7c7d90c899be42d6fa1000b84159a86ce754

SHA256
2605a16b8c1991c541517430329b9f5d581189cfe51dae223951e28caad8943c

SHA512
fd8d8f56e71587ccf1698b02a9011bc5caee9b08f7f0c2820ec54255c2d150ac97788fd951b5b6d30303d4591a19d45b2802409175f9f77fb07d6a2cc746c6dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
69bb7e5d023ec60425562e5ef5d154ab

SHA1
9bf8e450ac8f3e0661edd25ae0c1594163ef25f7

SHA256
54545944b6b81fc49b5b5517738f1c6d0335adf226c08a85ca6adca6c4b5d1e2

SHA512
54f560ccd1dab8cb78300bbc5dca4baf805ba31b6bd3f9d2d8ffb98b3544aaa4340ae369c36cd239163bd4447f6b00e5525c50ffb6f6cbc32fd4711d7b0c89c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
81fa68d9fd3b60380e318765c85f3d81

SHA1
89b9cb4e5f4c3dc0e925e533cdf9284ca943e83b

SHA256
7be7ea22e9b7a7ac45ff972430b3533858c295a2fc65f3ee09f2df545d906f33

SHA512
987c80c11caa57dd6d2250a9b6de5c6024260fc010fdbfb52f000ad8c8967ee83a8bce793c6747204be378363b57bb634c007fcf1a6432abf25895a246721971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8062e332fc47b0532ae596e42344bc79

SHA1
992ba791b8db2a8bc6727fb9c6d46f5905f73f04

SHA256
479434bb8f98af0053e9fc94ba493b61aaa1e5d3d7b90452363b15a7bc57c26b

SHA512
8b219a15d7d19697be0f35de6311b5d7dd326aa1c9dc571c05190b1b900eedc28f2bd99b001a73f89eed9227cbbb3cdf120b7386d570098a89e2e6f9b8dcc396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fc2dc695645aa29ba479dafac85c13dc

SHA1
e33d93ea59a0cbd0a608f7f2eba0d51a18dc17dc

SHA256
060c317a411d197bb40538c62b8c248433971074740be9091f23f0f3dc2d3711

SHA512
6a8ba890db0e69c182fc02e7a33e8a9ff974168cb1f6b946c70c0ceedcbc542510c70c9d89ff787140172a5864782d95ed65c9367ad1b1520c3c705c1f02630b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f01d.TMP

Filesize
698B

MD5
eaae85e6970c3107f67db0ba43054624

SHA1
7cfa64027be3570a95da87f1d84e65a0e53c33e0

SHA256
5d6fc431c4e5e4e0adc76f6276705eb91e3b996712a6ecb8c344be9cf68fd096

SHA512
23363736c664ffae36d2e71aa7893263657e02184493d8d60cf31ad4e12d55d57a0bbb24738057e875de71e5c44b759853777a7b07a7c8eb2714fb43cdb1c320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ecc006f357b354883c39b056fda82059

SHA1
622c016a5d2bd7151263d1683a7e224c7b5e5334

SHA256
1335255818b10de5fed7d26ba07b0b81dfa2bd585d09d87e4217f88a3007e555

SHA512
2c5bffedfa2a09ec3a67bdc323505a33a822351cb456c1cfb86a88f06455e9a4cd63315f10cd3a3c6e7ee708225935cf3b3606b3c169a13a79d477e56925cb23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
36ac0021198b86e8cc1e74c59db2b564

SHA1
d89c98566fc7c7d9021e2c4e2174ce8ddc4808fe

SHA256
0b3bb6ee4472095b8be0ba9d726623c5d6e1536500fcdef120c797a71a786e26

SHA512
ed6c0293b3501fac31715554f9580104e38e788bd2547af054bad508c1610d738ac7cdfabce75dc57601344bea3f57e6a38465a87942f1e9361e7b6bd2c4647f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit