a6c11f14de0f3b87910785f97ae9618adda0d3b4a7616395d2b741c70881dc51

Analysis

max time kernel
199s
max time network
208s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CraxsRat 7.4.zip
Size

242.0MB
MD5

6efa31e7cd064aa2571c20bbcf76604d
SHA1

839f807154a1a0e0f13c84a90793568d1c676365
SHA256

a6c11f14de0f3b87910785f97ae9618adda0d3b4a7616395d2b741c70881dc51
SHA512

a78ac4f1e60b00604fd573e1f5bacbea0906474f1f22915950ccbbca46c284b817d42abb309d7694e702fd8f8e946e819314d54e3ae405da119561db04fefcf2
SSDEEP

3145728:+ZoFCNpZNgvsH4ay+W9BJhB+Bazyeo7JvmZT25OH5kN4NQ908t24lZT25OZbU3IK:2okjHevJHeeyeo7mykkRm0yP8SkC

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/2136-3-0x000001D246DE0000-0x000001D247E4C000-memory.dmp	agile_net

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

Processes:

CraxsRat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk\DefaultIcon	CraxsRat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk	CraxsRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk\DefaultIcon\ = "C:\\Users\\Admin\\Documents\\CraxsRat 7.4\\CraxsRat 7.4\\res\\Icons\\apk.ico"	CraxsRat.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
2552	msedge.exe
2552	msedge.exe
2556	msedge.exe
2556	msedge.exe
1872	msedge.exe
1872	msedge.exe
1572	msedge.exe
1572	msedge.exe
276	identity_helper.exe
276	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

CraxsRat.exe

pid process

2136 CraxsRat.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CraxsRat.exe

description pid process

Token: SeDebugPrivilege 2136 CraxsRat.exe

pid	process
2136	CraxsRat.exe

description	pid	process
Token: SeDebugPrivilege	2136	CraxsRat.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exeCraxsRat.exe

pid	process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
2136	CraxsRat.exe

Suspicious use of SendNotifyMessage 13 IoCs

Processes:

msedge.exeCraxsRat.exe

pid	process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
2136	CraxsRat.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

identity_helper.exeCraxsRat.exe

pid process

276 identity_helper.exe
2136 CraxsRat.exe
2136 CraxsRat.exe

pid	process
276	identity_helper.exe
2136	CraxsRat.exe
2136	CraxsRat.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

CraxsRat.exemsedge.exemsedge.exe

description	pid	process	target process
PID 2136 wrote to memory of 3712	2136	CraxsRat.exe	msedge.exe
PID 2136 wrote to memory of 3712	2136	CraxsRat.exe	msedge.exe
PID 2136 wrote to memory of 1872	2136	CraxsRat.exe	msedge.exe
PID 2136 wrote to memory of 1872	2136	CraxsRat.exe	msedge.exe
PID 3712 wrote to memory of 3892	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 3892	3712	msedge.exe	msedge.exe
PID 1872 wrote to memory of 568	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 568	1872	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 2700	3712	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 2492	1872	msedge.exe	msedge.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4.zip"
1⤵
PID:4676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4768

C:\Users\Admin\Documents\CraxsRat 7.4\CraxsRat 7.4\CraxsRat.exe
"C:\Users\Admin\Documents\CraxsRat 7.4\CraxsRat 7.4\CraxsRat.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Hidden_Blaze
2⤵
- Suspicious use of WriteProcessMemory
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa438c3cb8,0x7ffa438c3cc8,0x7ffa438c3cd8
3⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,16212225612257872492,5243686887504946820,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
3⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,16212225612257872492,5243686887504946820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Cracked4You
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa438c3cb8,0x7ffa438c3cc8,0x7ffa438c3cd8
3⤵
PID:568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2092 /prefetch:2
3⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
3⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
3⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
3⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
3⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
3⤵
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
3⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
3⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
3⤵
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
3⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4206703666875210482,11350128542739785202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
3⤵
PID:3720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1648

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\13b8328858f642d086cafd7aa16e3eae /t 4200 /p 2136
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0c5042350ee7871ccbfdc856bde96f3f

SHA1
90222f176bc96ec17d1bdad2d31bc994c000900c

SHA256
b8b1cb139d4d19a85adce0152fa3c4f6adfb73a322d7253820e848c6f82afc1b

SHA512
2efdb535fa6a06c4f9702b2129f2dd07c330e37fd10b492f2236007c660c1707773c22005d1e1fa580dbf633dc1a700ada3b7b611ef9accd9555a17a244f61ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5e027def9b55f3d49cde9fb82beba238

SHA1
64baabd8454c210162cbc3a90d6a2daaf87d856a

SHA256
9816e980b04f1fe7efaa4b9c83ff6a0fdd485ee65a884c001b43a0cad7c39d83

SHA512
a315e1336c5ec70cbb002969e539068ba92f3ec681b6d863db95227fd1808a778fd994e2fb03f28f0e401677aa5f7c66813e315b6b99a5065384c49586f9782e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83c92e73-4f64-40bf-ac7f-c3dcb22b5641.tmp
Filesize
5KB

MD5
2cb26bb5a6a22b04d0a83c052e6eb5ff

SHA1
47c947e9e89b1beb1c0c9a1408b007cc2b93ef0a

SHA256
97bf758e9bc71275ed3fd02d11eac9460c326e6f8dafd9377b3b782783322dba

SHA512
fbc065d45a6dc45ecde4052ce04b632ad032f20e0152faf3954cda152b406407509322dd66f82d7562d557d9b014f7a0e81267d1c299e06208ec1d8722233f3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
8b83d7b9e85a5031f6db45fab7938cf2

SHA1
b7b9638d23e3bbbc45726a5b95839d1ffe8fbe2a

SHA256
5d9dfdbc776974d0633822831c2fcc7a9f72b2ed4b79180b95750013479ace3e

SHA512
e2022c62568e1f6ad1fd1eae19a339aa91f67531fc04244f8c043dc4a4356bfaf0ee2e4805cdd6b84b165b46183859238afeafabcd22b3aea65e4e7cb6b54055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
17159b2d54f36fce45d378d5601a8153

SHA1
54f7feefc78aa2f91f7ea9243c726f579aed6f84

SHA256
89123f38c5169f3f36cb619fa800d7d000e43ef8d57ab973f16462e725776cc2

SHA512
fcde576805e81e58874a1efec3615d7952b941a7c7695cc913d48da5edf72cf1ec8c812fdcc0fd0e0dcef5f50b00058e698ef6b7c276df3929cc5361d30ebcbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
4d5b59f57f23cd662e5d52effe464ca1

SHA1
2baaebb93b1fdcf0e541455067d4f892ee128a45

SHA256
b2d1ebabea0e7ef3f643d33117906d00ea73ecbbad376e2d1d415c7030114aa9

SHA512
bbf070c44a7e0b562037bc9462f8725fc3fd073d6250a314fcd488d835fd5f93cf4c3e6b86129649301a0bd9aff1fbe077aa2a2ca34711bd88c98a4ee060db0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
239e2b742a2012424a9aebc79f32f725

SHA1
b23d9b5e0f1d57ee3e330ac62be77a1d2195cb3f

SHA256
07f32f49b21274855dbe342afe463ea2254a171434147abb1436eb1d96225d54

SHA512
c1e70c395c6dbd4b2d1fb7d2aac6a020aa0438f2388fe65402a34ecede2ccb5bef26e59bd225f23740866aae86503fd69bda6b8bf624deb0ce2d61b48b2e65b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb80117a-b133-458f-8cff-7d80aa82d1a0.tmp
Filesize
11KB

MD5
328c1b8bbbe6016c20ae50c994847ffc

SHA1
076abbd44164d4e0fef330c0bd49d89c80d5c10b

SHA256
b7bad30aced79c7ef4d4e685d4614ef1826e56cf5d984b182bac15af7b43fee1

SHA512
f26957654d2485df7e1cf315dba1a8ba30f405aa24df4b466f4dbab832fa5e3a43dd54dbbf1c0e7c351b01df48ccde5d2fa91127082e1c0987cfb510d62ee352

Download Submit
\??\pipe\LOCAL\crashpad_3712_ZDEDXQTSPOEKGKOZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2136-125-0x000001D2491C0000-0x000001D2491F6000-memory.dmp

Filesize
216KB

Download
memory/2136-6-0x000001D2461D0000-0x000001D246376000-memory.dmp

Filesize
1.6MB

Download
memory/2136-10-0x000001D246110000-0x000001D24614C000-memory.dmp

Filesize
240KB

Download
memory/2136-9-0x000001D2460A0000-0x000001D2460CC000-memory.dmp

Filesize
176KB

Download
memory/2136-21-0x00007FFA41D70000-0x00007FFA42832000-memory.dmp

Filesize
10.8MB

Download
memory/2136-7-0x000001D246020000-0x000001D24602C000-memory.dmp

Filesize
48KB

Download
memory/2136-0-0x00007FFA41D73000-0x00007FFA41D75000-memory.dmp

Filesize
8KB

Download
memory/2136-3-0x000001D246DE0000-0x000001D247E4C000-memory.dmp

Filesize
16.4MB

Download
memory/2136-8-0x000001D246050000-0x000001D24606C000-memory.dmp

Filesize
112KB

Download
memory/2136-2-0x00007FFA43D10000-0x00007FFA43E5F000-memory.dmp

Filesize
1.3MB

Download
memory/2136-1-0x000001D227410000-0x000001D22B4F0000-memory.dmp

Filesize
64.9MB

Download
memory/2136-164-0x00007FFA41D73000-0x00007FFA41D75000-memory.dmp

Filesize
8KB

Download
memory/2136-174-0x00007FFA41D70000-0x00007FFA42832000-memory.dmp

Filesize
10.8MB

Download
memory/2136-176-0x000001DA5B730000-0x000001DA5BED6000-memory.dmp

Filesize
7.6MB

Download
memory/2136-186-0x000001D24FB20000-0x000001D2502DA000-memory.dmp

Filesize
7.7MB

Download
memory/2136-195-0x00007FFA41D70000-0x00007FFA42832000-memory.dmp

Filesize
10.8MB

Download