phemedrone | hxxps://mega[.]nz/file/HccTVRRR#vN0cUJcILuzE6ziZSDbruaGqr8fEbvJSNnbg_5N_3g4

Analysis

max time kernel
266s
max time network
251s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 12:00

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://mega.nz/file/HccTVRRR#vN0cUJcILuzE6ziZSDbruaGqr8fEbvJSNnbg_5N_3g4

Score

10^/10

phemedrone spyware stealer

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot7250665686:AAHW0YznZP8w-6An0q8-OF3zVVfXyjQuxLM/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Executes dropped EXE 3 IoCs

Processes:

lite.exelite.exelite.exe

pid process

4652 lite.exe
2988 lite.exe
5820 lite.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4652	lite.exe
2988	lite.exe
5820	lite.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "205"	LogonUI.exe

Modifies registry class 2 IoCs

Processes:

msedge.exetaskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 570612.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 570612.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exetaskmgr.exe

pid	process
2040	msedge.exe
2040	msedge.exe
3664	msedge.exe
3664	msedge.exe
3316	identity_helper.exe
3316	identity_helper.exe
5796	msedge.exe
5796	msedge.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

taskmgr.exebootim.exe

pid process

2336 taskmgr.exe
2288 bootim.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3664 msedge.exe
3664 msedge.exe
3664 msedge.exe
3664 msedge.exe
3664 msedge.exe
3664 msedge.exe
3664 msedge.exe

pid	process
2336	taskmgr.exe
2288	bootim.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

AUDIODG.EXEtaskmgr.exelite.exelite.exelite.exetaskmgr.exebootim.exe

description	pid	process
Token: 33	1236	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1236	AUDIODG.EXE
Token: SeDebugPrivilege	2336	taskmgr.exe
Token: SeSystemProfilePrivilege	2336	taskmgr.exe
Token: SeCreateGlobalPrivilege	2336	taskmgr.exe
Token: SeDebugPrivilege	4652	lite.exe
Token: SeDebugPrivilege	2988	lite.exe
Token: SeDebugPrivilege	5820	lite.exe
Token: 33	2336	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2336	taskmgr.exe
Token: SeDebugPrivilege	5408	taskmgr.exe
Token: SeSystemProfilePrivilege	5408	taskmgr.exe
Token: SeCreateGlobalPrivilege	5408	taskmgr.exe
Token: 33	5408	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5408	taskmgr.exe
Token: SeSystemEnvironmentPrivilege	2288	bootim.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe
2336	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

4708 LogonUI.exe

pid	process
4708	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3664 wrote to memory of 2264	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2264	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2380	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2040	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2040	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe
PID 3664 wrote to memory of 2852	3664	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/HccTVRRR#vN0cUJcILuzE6ziZSDbruaGqr8fEbvJSNnbg_5N_3g4
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d18a46f8,0x7ff8d18a4708,0x7ff8d18a4718
2⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
2⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
2⤵
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
2⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
2⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5048 /prefetch:8
2⤵
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
2⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
2⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
2⤵
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3532 /prefetch:8
2⤵
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
2⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 /prefetch:8
2⤵
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
2⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,8652282338108841127,3972407080773349539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x150
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6008

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5504

C:\Users\Admin\Downloads\lite.exe
"C:\Users\Admin\Downloads\lite.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Users\Admin\Downloads\lite.exe
"C:\Users\Admin\Downloads\lite.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Users\Admin\Downloads\lite.exe
"C:\Users\Admin\Downloads\lite.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5820

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa388d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:3736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:3508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:3356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1220

C:\Windows\system32\bootim.exe
bootim.exe /startpage:1
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lite.exe.log
Filesize
1KB

MD5
4272497d3c3536eb06331f00a9c5ad96

SHA1
a63406b354c660c8284a07f9812cc953968ce5aa

SHA256
181052c912dc4377b7debfbd342ad17da67d7af140026c008988af728c0bacb1

SHA512
f0c37354f03f9133b9b38309e44cccec9b982d6868daf36600d105530015edad3f8ac5fdbbcc1e3845351ccd2d8043a5b3e12045914e803d33878ae9d4c8b8d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
5b79318f2909625687babc1212a65833

SHA1
d849d0fd024ccd0c07292405461e8ab9384b6233

SHA256
8f940f5ab4cb161d3e9326b1b9cc9187d83a58842a40bd3759e7448ef3515ba5

SHA512
76ba286fb5333f94f538f75e9a39bf0b255753d01421c9e0de096c6dd0242c67c7acc12fd6a78bc116a666b59bf2ca3e5b7500ca1a6f74b21d61842cbc01899e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
94dd01649d5443a9311db4eed1a668d2

SHA1
bad919a496d44ec4eb42f4c7ec24ba6c3ff617b4

SHA256
053a037cc449418321210879f3e9adb4e785961dfec212de0b1802ac5e4a53b2

SHA512
65620cc6926679ca1a97ae5f18323e9213379cc1365705865386589f8ef207ce7aae171e6dfaa547be069f596f3b9a2b8f51cd1ada797d1ef3a21ff605ae2326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b1ce3c0ab23f33c6988118d06adf3a61

SHA1
1a18b9702bf1481bb021a2c3b6b439af276dd399

SHA256
337bb5a507a44b050aab894549a4ed3f21648d2d07ddbea5f4da736a531651a5

SHA512
a4f82eb35ebe8439053e83df4c38c915892c5394eda28beb94ab8e67979425d7fd1dea1212d5104e0ed52833e1537625ba4b204829f4849e552c69ab1f4a7abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
535712b73ac9a869ecf56a38ff01f3a5

SHA1
420056dcbc741583e4b9590ac8621544dd7432b0

SHA256
a16242b5b0e36c642ce107a90ccfc6b90cef47b76c9a3c6759bf2ae1405254bf

SHA512
4aea90ffccf86c45a29b74bda5ef98840539d9902c04024fd7b9002c9c9334afe3a9e291e862f89b14fc3d62562eaf1e84bdca53fc486aa5371d2f9fb99fddb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
427269e71e03a5f1a77cb7cef0a5612a

SHA1
8842f34015fed60ebdf5a93a1394e73944ec1c14

SHA256
c1893834f9aca91537323b95c8e8251c23ed591d67351ff0c5347f5147667ed6

SHA512
505db3dfd1cf04d581f5af4e0229ef4ad2ff58c7587e05f664c622066627f50efd8a4b8340404e0db7af39d74383f586d86dde7345a7c86c5af13c7b4673bc76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579858.TMP
Filesize
48B

MD5
c1602f161fa2ff7a06e4792684998ecb

SHA1
e976c682cad14c9aeb7bddbc4ed05270e1354e22

SHA256
7d20a02c33a0e11c9b9240e83cd96bff3061666624936697655c6fd4c2666382

SHA512
b26e43289e6b4f3532f0208e6f366adc800622b7cec3b65b416cb75aa9eec1880ee6f82a7272d7fd492c445b584e075099717f827c10597241ba0c34031adb8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
6d2555bad30b2dacd343704a54dd1284

SHA1
b12c22b9ccbd058337cb5abff74e5a21c09da980

SHA256
d7eb92212ba3cdb23e7895e5d4a0c01c233416b3d7b713aa59533fb2664ed671

SHA512
ea74210da869cf93deffe47321bda71c56ffab90f5401672de0985a9a6d10c5ff4fe6d065ae85f430ee9fc6e904d2e1eaf4311880d83e423aedb1e8dbcd6d2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a3d9b9c0673ef3e8d3368c04c3d7bf10

SHA1
4d2921b517a33751b5b481bb381769e532cdd011

SHA256
ea6e364ac5951af5e9ffe669a0ea45566a8a7b937c7142039168c511aefbd8ef

SHA512
98b61f6f9c48dedbebab95acebd9e6b876212af72094c78496fdc4ed99f2f3015c7f1edc5af1d5a5c6ae125b6c0dede4cfdd10dee32672a725633cc218c3bc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
14fd9bbdc1082accfa2883557d212c72

SHA1
87189a7e04bf4f45563be4f5537caecff2db860d

SHA256
5fba09a2dffe549e778f71b51c36c7ad308f15cbfea9384ae2c20d26e6f3bd92

SHA512
630b6fce5519d092ade49d7d23e43b9572a239571867ba471f74395713519fdb94bab920ac0638fd2cac4fb6ee5437fc1ba91c6f5f40650aeac8a4f1788a551a

Download Submit
C:\Users\Admin\Downloads\lite.exe
Filesize
116KB

MD5
9957ff72b98d2fd3819a1c3a5bb7c266

SHA1
27ee49406e1eaaf4ca84e9119baf83d79e199df3

SHA256
103b15ed69b33225af3886c39dca69d542aba6907567bea4f4854a80fe9ca34e

SHA512
52e8cb098534a39b7ad5c251db05fed8b414012f824ced61ba6dd53e29cb8f08e870c19a74906112f2fa3ba60abfcd1d7f3170ac27481a918b1b818bebcb251c

Download Submit
C:\Windows\System32\tdb9jf.exe
Filesize
7.2MB

MD5
f6d8913637f1d5d2dc846de70ce02dc5

SHA1
5fc9c6ab334db1f875fbc59a03f5506c478c6c3e

SHA256
4e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187

SHA512
21217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036

Download Submit
\??\pipe\LOCAL\crashpad_3664_FAXFYBOEBBMJPGBX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2336-321-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-320-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-319-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-318-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-322-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-323-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-324-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-313-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-314-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/2336-312-0x0000013E37400000-0x0000013E37401000-memory.dmp

Filesize
4KB

Download
memory/4652-327-0x0000000000280000-0x00000000002A4000-memory.dmp

Filesize
144KB

Download
memory/5408-338-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download
memory/5408-337-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download
memory/5408-336-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download
memory/5408-348-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download
memory/5408-347-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download
memory/5408-346-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download
memory/5408-345-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download
memory/5408-344-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download
memory/5408-343-0x000001A0039F0000-0x000001A0039F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads