7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe
Size

39.2MB
MD5

7d0697549405fa4a37663fd1a5fa27b1
SHA1

baa4e2cedb670b5cd0d4997365634681296750fa
SHA256

7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add
SHA512

a5c089b6407690f1308c5a1a4efee7c0ae53d27f95eb5ced3fdfa7d796b63396520dbd5b5f8d15fdfb81ab20d25106df3d6ff8ee1c4830a281c63a8cc239e47e
SSDEEP

786432:tYl6iTfRwFOU8ofAl2jpyJk5cDxvVIyaPZ+:If2V89l2YJYcD1E+

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe

System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
discovery

System Time Discovery
T1124

Processes:

msedge.exe

pid process

4672 msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 579196.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 579196.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2868	msedge.exe
2868	msedge.exe
4672	msedge.exe
4672	msedge.exe
1040	identity_helper.exe
1040	identity_helper.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4672 msedge.exe
4672 msedge.exe
4672 msedge.exe
4672 msedge.exe
4672 msedge.exe
4672 msedge.exe
4672 msedge.exe
4672 msedge.exe
4672 msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exemsedge.exe

description	pid	process	target process
PID 912 wrote to memory of 4672	912	7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe	msedge.exe
PID 912 wrote to memory of 4672	912	7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe	msedge.exe
PID 4672 wrote to memory of 1636	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1636	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2880	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2868	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 2868	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 700	4672	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe
"C:\Users\Admin\AppData\Local\Temp\7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - System Time Discovery
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8aea246f8,0x7ff8aea24708,0x7ff8aea24718
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4984 /prefetch:8
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
95d2b756ab3d5431fa0f35858a2abcb1

SHA1
1df02d285fb1be97a6ca90496cf9a2087411fd0a

SHA256
b088181cd47c0e374db458838b89c479d844e127bd541baf69d7b8f5551144ab

SHA512
1b004b1d6ba20c841c038e53330048bf64f26baa814b483c614eaef4d4ee01c9be351759ceda0f1da58c0fa256d2dd3c4714ea782de50c846e4a9a738937a936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
c8fe5dc3edbb8ff8243c36c490cf4899

SHA1
7aa7c864a6c171f6e9d072b1346486d86182ed78

SHA256
49c188dee26873180d501f98e93a1ca8153225c8e006b93d019709cffb8817ca

SHA512
f08b91c2ddf4ed5d230aca6e57c0cd0f821bdf0384bbfe3ba6eadce74eb65fb44da94c8cff55c645222d721715bcb04365d73807493eb9558f87de8b36c4e7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
33d860dcae7c41f012cde8332b43f026

SHA1
d3ad71d66cd259f8acb7a5d129683632377162fe

SHA256
db7599499ce3f07a7895a0b0848d9e600db7464d42be2bf8825e56ec878be960

SHA512
9991977679a4e4b66e6aace9ff66cfcf246b21fcd517cf20530d9fb15ffb41644ea36d0a5e7a03eacb77f61b886b84b76977c665270b4b44b903b1de4c51fa31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0aa3bd1d1353bd5bbe3c1200f6b3f0c

SHA1
3b2dc4e0c43bde1b7bb63256bf07fc00f0ba8589

SHA256
93939658b80166d3b589bc11dc820cf83a9ba924da7548c9ab669799b03f7332

SHA512
025c3fc26b94205d542c964b0381e0455347591ef32821e2fc231ca2a90450baa8914018c739d4bc0efe7d46aa2940c83d62f97e2ef1e4b0181973140f61339e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
d55ca148245175dc257f714ec1ed8ba0

SHA1
c0269b467a0460b43f368f6e654bfa32879c460c

SHA256
d2801d0ca33726cd05ec45a83907cb7f031ef00d1906e3138ea47bca7d3337a3

SHA512
95c5b5b5d1188c61c2806657570fb6f5c3b53d6065321228d6379ce8e334eb9b7cb1be656cc1c2822ae74dfda587ed588fe7eff62e0fca8f3c0b2216647e99b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
7d1da86df3ef2e7fdbd57a8e5acd9592

SHA1
089a4a4a1534124a6378d30b9d143db0ee93befd

SHA256
954274317d7076e0e101de7b81fbe4970c83be1aab6bf8d995642a3dbc9ed069

SHA512
ca47231462a03e72532d87e6163226e938710db2c6c6c489a688fed8eb23317dc58de188e139a9975405bf6522ed4b9cc6f86a8574d13c7b3c6a1e951a6a7f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b84f.TMP

Filesize
539B

MD5
b8232f453868af81273cffbbd80a9a21

SHA1
a3f895d5965cef8f5bfa853c370e3904102c71bb

SHA256
646cbfa9eda07686b36db805dff6b6ede52c2d3e5800dbf7712c8b28c2ec094a

SHA512
506377d1f8532cc5776a14bd3ba0adec111654b1f919bc703c165ce519cec289f2413a89893888ea1ca76f5d21c15fcd3634845f2cca6885720311b0eaf97660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8184a118d427347e8fc0c5b9468d7a9a

SHA1
c3d8bbdab3cb7014dea2de3083596d30862c890c

SHA256
a8fc76b23d43c11272a24118a211cf41f644dbc124fd4955b8670d88fab69e81

SHA512
5a60191d7649b28f1ec9ef71d73e4d58fcf868033c7d09e553f5ea162a927f839005acb54ea43427a87dae9a8a8f158c86e6988cbd161270702298f3ff0e2e28

Download Submit
\??\pipe\LOCAL\crashpad_4672_NOCJIFDWEPAGZLCN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit