4635c9af7921ff99b0941d3d62574d39c4fc15f4897471c68734427d6cb8c49e

Analysis

max time kernel
924s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

OxygenU.exe
Size

2.5MB
MD5

2f2fc53950b5074a9a2856dbb0cad192
SHA1

e6fddad494269767b2f3136b1c5c5793c8d5c627
SHA256

4635c9af7921ff99b0941d3d62574d39c4fc15f4897471c68734427d6cb8c49e
SHA512

1561c200e2f0126e3b9d6a8e2e4658f428c3eed8eef4fbbad3c5edeec9c04b4331ccfd27985ee763630ccbd3185e3beec550dc7a3aad7d6a2b36cbed8761fb85
SSDEEP

49152:F26vCbY8rkxYOPo4gtUUxJerbY8zBkqXfd+/9ADqanUWjuh:1CbY8rLOAmUxJerbY8zBkqXf0FhWK

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
3068	OxygenU.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com
261	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3068	OxygenU.exe
3068	OxygenU.exe
2040	msedge.exe
2040	msedge.exe
4732	msedge.exe
4732	msedge.exe
820	identity_helper.exe
820	identity_helper.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	OxygenU.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
3068	OxygenU.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4732	3068	OxygenU.exe	96
PID 3068 wrote to memory of 4732	3068	OxygenU.exe	96
PID 4732 wrote to memory of 4668	4732	msedge.exe	97
PID 4732 wrote to memory of 4668	4732	msedge.exe	97
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 1448	4732	msedge.exe	98
PID 4732 wrote to memory of 2040	4732	msedge.exe	99
PID 4732 wrote to memory of 2040	4732	msedge.exe	99
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100
PID 4732 wrote to memory of 2460	4732	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\OxygenU.exe
"C:\Users\Admin\AppData\Local\Temp\OxygenU.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oxygenu.xyz/KeySystem/Start.php?HWID=55bbc67a040c11efb52d806e6f6e6963
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd05b846f8,0x7ffd05b84708,0x7ffd05b84718
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:1
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5497433023272500711,2848483278270627650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
108KB

MD5
01d099cf1c80e91732fe9b1b3a534832

SHA1
d0b28f5ab5f131a4347c20bda1d2370abc707c3c

SHA256
c6eb0413ceeb082e3790a9de028823568b31015eb26d28b203ae36ff7a79adf5

SHA512
8c4f7d5fa45c4a0dde905f0a22f9e82450c36ef833d93121c147965d35b6be086d0e964f39d156a7dba2304247e684cc365d62f4b93b880c397dedd9dd2d9f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
299KB

MD5
130d7bc0511c56e0494312ee4f828a33

SHA1
eecd5548cc8937e5d4fcc65074d6593cc52faa64

SHA256
5a49f196d17f458f02697269fb37e1ad354f771d7438883ef83aed9b2ac6e6c1

SHA512
e4a2dd819563c9a857909ba8a091da1b5f9216c4c780789a10319336f6d43ecdb9a5a1184fcc333b66c404985a21415f6b7318d85f2af997cf2b9fc227f4d924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
71202723516c348682d31c6c50865dcf

SHA1
d36f73ca3acc43ef8c28ddc4c6ef58f2cc31819b

SHA256
b2fc5851a6fd334076471541d30912b7247d730c8557b717d0a7de4f4d7f2bc5

SHA512
04d3d8030b24582095291da97bcb2fabe31269234e1b014c450e819268bc34cb6d805614c3ec25f5e35379d48dc9b078983e94c2081baf32686aed8dd53950d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fd674bdc1c54a71c0e834869a2494630

SHA1
549e3a5a7ffad31f7cf2f5cad085b7169d4d2c7d

SHA256
ead80be05d018e98773198c7832e444c3e7f05d3012a9bf46da5ad1b0c2101c6

SHA512
4e8a64e8c8ef0c8fe93f36ea417790c689189792b2abb2276cc702936693966695007a47a1047c59767aa27d8f0b9f9cd70ed5bed15924a9f616baa3e8e9ac49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
2b4b7be8df2647d4515ae55c0a976f8b

SHA1
3ee587c4ac3599e0ba276ed8fa8a9ccdd3dc9815

SHA256
c0f0f51a88a458ef7aebaa3ce1901e362e27bca55b6f7b80d3231b52b0971fcb

SHA512
69f4a364057a1603a6ab0809c01113a05f7495caac8c8fb60007eea0dbcc8d89f04ef5e7d5b4932cfdfa214c0c810c0654692f77de036045b736086d07072fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3326cc0b16cb3b12141bdeee7a4c707f

SHA1
c70cb4011978541b8f62b57ab8f7f9347e7f201f

SHA256
a03963e587861a67bbe6777a2ff1be29ae40e0d69714af27fe531724986a3fd9

SHA512
88f7f911c3843316ae33d0086ec5dd8f19c81768935a974f150fcadb8a7f67a38549f63c656ce06a1abc54c7f1fe6e789a197b8df874ec70be6e9fed876bb180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
646f072b3479acd33880d3652350e64f

SHA1
47b54c426165ddefa020b5f070731b87fba0c775

SHA256
8ed64a86929c904ff6aa81f6eb200a66cdb9bcab69a2e823a6eeebbc86d940b1

SHA512
6c3e9c1ee5424e3c4fe55736169432f78f1bb9e7c742e7fbde3c01584d207905796e44c44eea383c6ff1d45c922209b0bc62791c448a00b7d7faf538b12a29e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1def5a49477943643e166101d6c4a0a6

SHA1
4c381874472438d86e08fad221724911bd06d630

SHA256
6bdd7fac28224e321e9e6c6ec0e36fcad15e59bddf4387f7c7731ced0e6718f6

SHA512
9171535a9576007d6dbc07babf8a311433c5a8f1ec1910292394b40d1b760deef043f32e5634b4ee92d0ce2e7d65f8ba05ae27ed13597c40b2335a3d07ed09fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d2077461a6bd5a35856e08454cd09d36

SHA1
9fc19c7a29b4412d3fcf543896a32430ebc32871

SHA256
aa8c18c5eb9d9f97bbaf30c35a34b5d6ce4991eba39db6627644632a1bbaad3e

SHA512
b580911570763985b55dd5388b86a5fa0ddab6aff5970867a687a53cfbe465191f8d98ec9fe93d64a423e866b057197a2bb63346b9c5f1baa298bd22658f09b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe952f8ca40028527a61900720860de2

SHA1
4b76bb9f52c6f7c7af6d591353241bc41d990acb

SHA256
ab5208876e39168ee8beaf5aacaa98e5aa67b01fe11ceec3e2dac9b4bae09e68

SHA512
968f3cf69a73f010be1d172e7b8f393c425b1057a6e725317e7c13ae1d62d006acefc4587083a52763f53cecfde94b76b7af91a4aea5486dfea69fa8c5afc655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34ca8d320683d5ece2fe95bae4933c20

SHA1
5dd2521ffde6585974b47274bce20c70f0b52951

SHA256
ce2e7508d56d6f4ab69fe9848dadca16014a31fb1f0b56cf8742e3fd20e46558

SHA512
a9d19953690e26e95a9889e215445bf990be8b483ef654dca5614035d990aca22feff933954d83ab17104bb912b504498c8cd7a6b496f86d379496ee487233ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5bd3de51dbf810da645bbcf6c6731399

SHA1
1c0faf786b729f104568f19a94d6b2ac34da7234

SHA256
68a90d8f2ebd0f33f56fa4648f169c171264cdd42382198b48dff0a12a92671a

SHA512
4dd56853da6ff9c0dd026699497543532fe2da2fccab88b6fa9273dace1732a82979eeae7aa3b1917fdeac53a51c0671f7380ac28c1b198414d7291c86031f11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\74b0282e-4086-47ed-ba87-e6eb451ddeee\index-dir\the-real-index

Filesize
5KB

MD5
53596d8d3834ae6c4855af1cab7d0db7

SHA1
8be06a988586cfd1c8d2e9da161a5acffd059a94

SHA256
5971e2587c2e2811905aa0cef3836aa214f33f6c5155339916a9dc099844f84a

SHA512
b104d5861afdf945087391919aec78be9b83e5cbb63320c8c46d05344e4f1670cedefa0d1102fb99a8ea0d1637df49cf63ef4c1c8dd09e443c192a9f1427a3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\74b0282e-4086-47ed-ba87-e6eb451ddeee\index-dir\the-real-index~RFe5b0f1f.TMP

Filesize
48B

MD5
056aa7080b28ceec68db4db7de8db0ca

SHA1
0eddfb5ef9331341fe92f71c9e683d8dd311118c

SHA256
4f2cc35bff5cf65819aeec424f5e202cfe789ac706dce9d187c97eca1602ae37

SHA512
7c35882376f0b2a41416db962ed72563e166a4a509e56dffdb0aa37d3b1efdaa0c744feddf9f127b2f8675a1a06f9146e16f6d986b2887fdf931cbc8c4eba0d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
89B

MD5
7ff22ba9c79998504c4cc172d5adacd5

SHA1
7622c956270d2aefc9978cecf71305f2d3dcedf2

SHA256
672d9b0080935635d99be08bcaf450b7eaaf224e91a05ce9f05fd0d3a70ac4c2

SHA512
4d4cf4c2eb35e2271d1fb0b1a23ea81281f9eafc23dac11a16fe2876adbb11b858eaae6616e96b59bd1e5d9c79339bdd478efb20de2e4bf4e659615178b9fd90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt~RFe5b0f1f.TMP

Filesize
93B

MD5
1ec0c27e2668e481227219ccf5e224f7

SHA1
ce7f73a714aff8ed06da41f9d507dc25ca2421ca

SHA256
30fcfac223381e3214cf4cb29cc378f88900a6320a4b3bd22eab4630f555d4ce

SHA512
9af3efb33ba11a24f292025a2e301441aebecf5d8bf76f78462257573936a9806e46e181107f0b17c6be0a272ec964bfb248d66991d4202ba9d3d637de6b6b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c7fc2f4d9c0778d941ecb80e3fb6797e

SHA1
c9a37dcf6e67d514b64135a959891cfc5caf564c

SHA256
0918564783616d0142250b2afcbbe82d55ef43b7d9ce2a7d66e8669859bc83a1

SHA512
cc1010f6b7114677d345a69753f69b9350fed4b53e95905318a8e1847c7a8bc2250e079186600081dc1e1358bb5d6fdf5e27dcb45f1ae80a4965840a3204ee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b0607.TMP

Filesize
48B

MD5
f42b57b03f0147cabf9c32e5e53bfbb9

SHA1
f71064ef2c6572efabf2e4f3f37a0eb1775a6411

SHA256
384a8de2e257d716bd0d299b74b7d92582ede9cb8bde05be40e20d038a5829dc

SHA512
7b9330ac5750787bf9f98deb9b2fc9107aad6076f94a6a72dfad91b2318955c2473f432aae1e0bfddfd846292d94ad51e9c6b259899bfba27cccf169d0abf19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2c93af5b59ccda85dc25befb75775a95

SHA1
4143dad5c5191a9a6e313492e109f402817c62d7

SHA256
5a989e40cf12d2ca0c29057764656109f08c450733e0326daf3da9d9c543367b

SHA512
6fd44dc71f469fff7aa9af2152817b28576755a228eb95aed97b709d76f04e77a5d06ae5e4095d028cb6c7e153aa94fa35664ddd57ce4128e1e5b47edc18d997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7124f9bcfc04f622e79c0eb57b66f66c

SHA1
451d4d3bc25ba7c2cb8ad154916b36503c1db07e

SHA256
7a5e7548b56a385d7dd3950fa99a9d44b9df39059e341e51ad1ef62b8587aa17

SHA512
d86129038d02fdd6c392b788bc44077b945ff4f82e9dbc97284f3f332a0abaf1e638f14f23da7c00156f9b341a6f90f2c8fc404ac5ecb2833f9987afe434695a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
233c96b8a4b7b6adf218776e1d872d67

SHA1
6931f45b7c72915a1a01879894b59ee92d632677

SHA256
563c5bc821e6ac7e415a0815c649ab5f83661f7edc05101c5f4dcc28f1108859

SHA512
36e27a823eda92130e4cf667c41d7166047c928d5ca3539e88b76e73de17ff0febc0832ce16aae34074b85332f5edd137f7640ad1e595bbc76f2b164841481fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581921.TMP

Filesize
872B

MD5
20a0d9a5c744b4ff488bdf24ca321ee6

SHA1
46f7859f1f9dccc271d3a4c267883437c14e3085

SHA256
9aa3c33b9ccdec905ee44d054d00a2a0c1112a6be76506590b62a6366332a4d8

SHA512
c41d0f53cd6807980313fe5831abeee3943ce7747be37276c46f7fde22b1d07502e506582368382f9d904c3e12f7d446c1d62a85f7941298c2cf28e733c89908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7dcc382d0bcb600ea8814f26f214df33

SHA1
eeee5e5149ad89e08c450a0c5050fd4b76617b46

SHA256
95cafd59ecea3525b469b4b86c4b77909958f6b532c482a217a4ac3bd91e4ffd

SHA512
a215477f15beb815a51dc611aa5e86a5facb03f6e6c0564a50ee92e2b06804464deac1f6f2e21bbeae951469ebef40379476b1f5484e99023dc2ed743700dd96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0cc55899adf0b0e3e9cfc39bd06ee68d

SHA1
eabfe6204735e54caaffb8e47a3fd9c780b2002a

SHA256
f699ccde9542744a6e311a07ba5c60a1df20f0ee48bebdc6464b4a63e300517e

SHA512
bd030ccb12568116ee03d3616bc611e6f5cfa9c9b276c1789c2cc2e5b53ea9b9dc6f57ca4a80b93e694564444e36c12d741c8665f6535743fda5de58c821f347

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxygenU.exe.WebView2\EBWebView\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxygenU.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxygenU.exe.WebView2\EBWebView\ShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\oxygen_auth.dll

Filesize
5.6MB

MD5
cd3e516a5b2611997f141863de6f405a

SHA1
d1e1ba9219e32cea476ec58d5013d6c2874112bc

SHA256
48aa0793a1fc5e54fbd37268019ea7e3aa9344c6456c41854a8e2e7c3a39e857

SHA512
a43ed6168af5a8f3976c9d4a435429504674ba41f68e332c4f01c7634f0314f8356c95082d886d6ae8b760c5af65d573c8a8cc8bde2728cd029a72778e674646

Download Submit
memory/3068-468-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/3068-535-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/3068-474-0x0000000005CD0000-0x0000000005CD8000-memory.dmp

Filesize
32KB

Download
memory/3068-475-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/3068-473-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3068-470-0x000000006B370000-0x000000006BC9A000-memory.dmp

Filesize
9.2MB

Download
memory/3068-469-0x0000000005C10000-0x0000000005C11000-memory.dmp

Filesize
4KB

Download
memory/3068-556-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/3068-477-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/3068-476-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/3068-536-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/3068-0-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/3068-8-0x0000000005AB0000-0x0000000005AC2000-memory.dmp

Filesize
72KB

Download
memory/3068-5-0x000000000A2F0000-0x000000000A2FA000-memory.dmp

Filesize
40KB

Download
memory/3068-4-0x000000000A290000-0x000000000A29E000-memory.dmp

Filesize
56KB

Download
memory/3068-3-0x000000000A2B0000-0x000000000A2E8000-memory.dmp

Filesize
224KB

Download
memory/3068-2-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/3068-1-0x0000000000740000-0x00000000009C8000-memory.dmp

Filesize
2.5MB

Download
memory/3068-1627-0x000000000A5A0000-0x000000000A616000-memory.dmp

Filesize
472KB

Download