hxxps://cdn[.]discordapp[.]com/attachments/1234979747243626567/1234981511166431263/goldgoldogldolgoldoglgoldfoldgoldogl[.]exe?ex=6632b5a9&is=66316429&hm=1254bec85e6ddd53b28e20364625491c6e1bd116d4714e90468133db34fd3071&

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1234979747243626567/1234981511166431263/goldgoldogldolgoldoglgoldfoldgoldogl.exe?ex=6632b5a9&is=66316429&hm=1254bec85e6ddd53b28e20364625491c6e1bd116d4714e90468133db34fd3071&

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	goldgoldogldolgoldoglgoldfoldgoldogl.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	goldgoldogldolgoldoglgoldfoldgoldogl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	goldgoldogldolgoldoglgoldfoldgoldogl.exe

Executes dropped EXE 1 IoCs

pid	Process
640	goldgoldogldolgoldoglgoldfoldgoldogl.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000200000002296a-37.dat	themida
behavioral1/memory/640-70-0x0000000140000000-0x00000001405BA000-memory.dmp	themida
behavioral1/memory/640-72-0x0000000140000000-0x00000001405BA000-memory.dmp	themida
behavioral1/memory/640-97-0x0000000140000000-0x00000001405BA000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	goldgoldogldolgoldoglgoldfoldgoldogl.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
640	goldgoldogldolgoldoglgoldfoldgoldogl.exe
640	goldgoldogldolgoldoglgoldfoldgoldogl.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 709450.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4588	vlc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3384	msedge.exe
3384	msedge.exe
3628	identity_helper.exe
3628	identity_helper.exe
2356	msedge.exe
2356	msedge.exe
640	goldgoldogldolgoldoglgoldfoldgoldogl.exe
640	goldgoldogldolgoldoglgoldfoldgoldogl.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4588	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe
4588	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4588	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 532	3384	msedge.exe	82
PID 3384 wrote to memory of 532	3384	msedge.exe	82
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 1088	3384	msedge.exe	83
PID 3384 wrote to memory of 3032	3384	msedge.exe	84
PID 3384 wrote to memory of 3032	3384	msedge.exe	84
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85
PID 3384 wrote to memory of 4504	3384	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1234979747243626567/1234981511166431263/goldgoldogldolgoldoglgoldfoldgoldogl.exe?ex=6632b5a9&is=66316429&hm=1254bec85e6ddd53b28e20364625491c6e1bd116d4714e90468133db34fd3071&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce95446f8,0x7ffce9544708,0x7ffce9544718
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Users\Admin\Downloads\goldgoldogldolgoldoglgoldfoldgoldogl.exe
  "C:\Users\Admin\Downloads\goldgoldogldolgoldoglgoldfoldgoldogl.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11185413285580742977,15171169987032711696,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ResizeMerge.vbe"
1⤵
PID:4776

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CheckpointWatch.snd"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c95ec35baba36d58936f4f290593c30

SHA1
490f226d86b393f7e601948f16fd25484f2a66c7

SHA256
0765702145f36eb97f8d408ad5501447b8d53b051b6277d29fdbe1792086f36e

SHA512
111805dd267cfe6c8b83fc82fa0872b108d631f5b3298afc35852dd3e7199a0a8964c393538f42584b4a3945d2f6513e72e6b47b8aae7191a877534b6ff70ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dc81211e39d2bb83569e54fddae9db5

SHA1
286195da9867437c1199b4f2ac5acdc42042ea1c

SHA256
8290ed6ff992270f37a17c8995869ffeb3a4d51f0e01a16f1c2257bd7201cefa

SHA512
3c70ff2880a24333be1ffbf2a9788ab287889d1105162899de29a55218c73759ab44d2a9098f7496a633befcf07b9245a4d41ab33659512ff874324f63670150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f45babc067c52765d47f7babd6614f58

SHA1
78ef0d7d01b90ed5e72abfdaa703b0dc2226e933

SHA256
16927c1c7b851cd654911e8f9e081186915406b43e889eaa81139c18fb523657

SHA512
9b3436a88362f4107a64c34d598e55c8e07f41cb84f397135caf9ec1d689bb23905578c4e4ef54835d49fa0073e7dabc343316fe538a988264994ca70da53b0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
376493c9096a9e24c951eeb1913c7ff3

SHA1
818aa306608b02bef301f51870da35ea47ccc25c

SHA256
3777a64c3cd4b7990e756f8683598e5862c409971961eb76620c10255db3556a

SHA512
a2dcfe193e45d78259e1e83bbecad7324b666e90eb5dc22ce1bdbef91a863f3c5375a471710107b99871f2fd35c4949a1bd7119730721897113b21e2630722e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf5c017a977d1d27104b277208a45f72

SHA1
5b18070c395512d935c802d408e41ed2cef3a7ae

SHA256
faad7783f8f4b54ce5473d4ed99710394e70a5a1c3d8dbfb3cf7629b1de49273

SHA512
8ebebffa79d5e0d7bf7148a3afa6fac114a102da17b9f4cb0f45dfa276971a8e2a519706f74bd48025852f5e80790f9db889d9a6a5f87b37608d650d92850c55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf50892edfda69aa8bf144d208be5ff6

SHA1
fb9282422ddb7867478b277a244f65911cda2e21

SHA256
af326794087080a7db24f5eaf7c9a96d0906c53710b0fe10e3932c0b1b504200

SHA512
503f5f8ef99c3db488c1c4ee3e5a426e24b495e6cf59d7f55cbae43b66a3d5016d34ef7a6155af5ac5e3c74aa3930bcd90099d1f2b2fabbd2bcd96099ea37fc2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 709450.crdownload

Filesize
5.7MB

MD5
d1537172b59fb75bc967366a7753c09a

SHA1
b425193c73307efb699d35aa2fae1342870a7dd1

SHA256
88595ad1c40c4faca9fbd5e6ca7b9a6362528fdbfa81d73334a9c1ce76beaeeb

SHA512
0c13c4da8369c351fdf00ab41c6b105e9eaf59352b914e762da5c5d5c648d579527d26c7c45d38f804f931565fc9f46e01b7ceb7f498f5a34cc0f44d072bf132

Download Submit
C:\Users\Admin\Downloads\temp_file198

Filesize
830KB

MD5
633efdcf48806762d6966f68e5cd316b

SHA1
684a3515961fc122822281ff6d8794e2973aec3b

SHA256
9587c902fdc552fd8a879dee885a0194f33fac8bac5ac99948cf7357ad4998b7

SHA512
e116dd8c7717e695c51cf7bc96485968d2b79379fd0ab47392d968a63a0765e63811b0f23cd4e8ddcc2be7213fb27979629a4cf6de2eaad934de2d61d0351d0e

Download Submit
memory/640-70-0x0000000140000000-0x00000001405BA000-memory.dmp

Filesize
5.7MB

Download
memory/640-97-0x0000000140000000-0x00000001405BA000-memory.dmp

Filesize
5.7MB

Download
memory/640-72-0x0000000140000000-0x00000001405BA000-memory.dmp

Filesize
5.7MB

Download
memory/4588-165-0x00007FFCE8E30000-0x00007FFCE8E41000-memory.dmp

Filesize
68KB

Download
memory/4588-173-0x00007FFCE8D30000-0x00007FFCE8D41000-memory.dmp

Filesize
68KB

Download
memory/4588-157-0x00007FFCE90F0000-0x00007FFCE9124000-memory.dmp

Filesize
208KB

Download
memory/4588-164-0x00007FFCE8EA0000-0x00007FFCE8EBD000-memory.dmp

Filesize
116KB

Download
memory/4588-163-0x00007FFCE8EC0000-0x00007FFCE8ED1000-memory.dmp

Filesize
68KB

Download
memory/4588-162-0x00007FFCE8F50000-0x00007FFCE8F67000-memory.dmp

Filesize
92KB

Download
memory/4588-161-0x00007FFCE8F70000-0x00007FFCE8F81000-memory.dmp

Filesize
68KB

Download
memory/4588-160-0x00007FFCE8F90000-0x00007FFCE8FA7000-memory.dmp

Filesize
92KB

Download
memory/4588-166-0x00007FFCD6270000-0x00007FFCD647B000-memory.dmp

Filesize
2.0MB

Download
memory/4588-159-0x00007FFCE9770000-0x00007FFCE9788000-memory.dmp

Filesize
96KB

Download
memory/4588-158-0x00007FFCD6480000-0x00007FFCD6736000-memory.dmp

Filesize
2.7MB

Download
memory/4588-156-0x00007FF66A390000-0x00007FF66A488000-memory.dmp

Filesize
992KB

Download
memory/4588-172-0x00007FFCE8D50000-0x00007FFCE8D61000-memory.dmp

Filesize
68KB

Download
memory/4588-171-0x00007FFCE8D70000-0x00007FFCE8D81000-memory.dmp

Filesize
68KB

Download
memory/4588-170-0x00007FFCE8D90000-0x00007FFCE8DA8000-memory.dmp

Filesize
96KB

Download
memory/4588-168-0x00007FFCE8DE0000-0x00007FFCE8E21000-memory.dmp

Filesize
260KB

Download
memory/4588-169-0x00007FFCE8DB0000-0x00007FFCE8DD1000-memory.dmp

Filesize
132KB

Download
memory/4588-174-0x000001E926710000-0x000001E9267B0000-memory.dmp

Filesize
640KB

Download
memory/4588-167-0x00007FFCD51C0000-0x00007FFCD6270000-memory.dmp

Filesize
16.7MB

Download
memory/4588-185-0x00007FF66A390000-0x00007FF66A488000-memory.dmp

Filesize
992KB

Download
memory/4588-186-0x00007FFCE90F0000-0x00007FFCE9124000-memory.dmp

Filesize
208KB

Download
memory/4588-187-0x00007FFCD6480000-0x00007FFCD6736000-memory.dmp

Filesize
2.7MB

Download
memory/4588-188-0x00007FFCD51C0000-0x00007FFCD6270000-memory.dmp

Filesize
16.7MB

Download