bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42.zip
Size

41KB
MD5

1df9a18b18332f153918030b7b516615
SHA1

6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA256

bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
SHA512

6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP

768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{38956E50-CDBF-4297-8CB6-B59E46490042}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
1056	msedge.exe
1056	msedge.exe
936	identity_helper.exe
936	identity_helper.exe
4924	msedge.exe
4924	msedge.exe
3696	msedge.exe
3696	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1988	1056	msedge.exe	88
PID 1056 wrote to memory of 1988	1056	msedge.exe	88
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 2724	1056	msedge.exe	89
PID 1056 wrote to memory of 4260	1056	msedge.exe	90
PID 1056 wrote to memory of 4260	1056	msedge.exe	90
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91
PID 1056 wrote to memory of 1712	1056	msedge.exe	91

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\42.zip
1⤵
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffaa2cd46f8,0x7ffaa2cd4708,0x7ffaa2cd4718
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1516 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12849311090254101289,10270004723877024807,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
23KB

MD5
ce3cc830b1e038999dd41be7ae9e1718

SHA1
ebed20a6d1e3b98b2293a90880d6e9bd5a503bf3

SHA256
5bfb0304c3a1d1128796a32c3da1b1d773dbdebecd7947364553b201300b2445

SHA512
74e649b2ebc3c5443feaa548e5f55e403bf99f27a8c5709e0247e89090c53b0d084903d57ac2e69135325ba7d97f9b7d8284df49fb42b28d53dd51b41bd21578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
94756a19598a161b8ba6445e2904cb11

SHA1
69240e824db03ab96b1f5c0e09849b7a4767e182

SHA256
50f79a8188f6ec3ccba447b4563b4f5d2efd4548a7fbf8d74d045680fe189048

SHA512
67b010f9ecffe102006de3b8dbb110fdb196d70823e3b622658af0a613d0bcb228e8aed5bccbb9eb5addd63f71a7c0bf216f8514d7b191d26292a8b601f039d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a30b0dfe6e4b4c21954d4ee5a646e8db

SHA1
559eef92a15a022182e412c90679d2e439f9c65b

SHA256
c2faf6f29b13e651609219099e28a5c79a258b60678da3bd4e221bf38a533f59

SHA512
846cbd7b96d444e5e9c0973c80eae86014de643aea312f74b66fb9a5cf05e84a0f88ddce3e7ec07b2b4f595c37c38a793f85c38887f13df2ec6e9f3c8f30aea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9ae4d4ff432988abb5b79e5d722d55c

SHA1
e0825638c0470838085c7dabb223d73c48f6a52f

SHA256
95ebca34764de23dd8344fff590ca048cba85ee5fd6632f3e6ba9166474057a5

SHA512
63aa31bd162c1b080f40b02ed21abf99f572943b4dfd8478426c3091e9a888ea3e140f31ddd581541503cf5467305585eaa84a217d040f80f71db46191f44ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b16f947c6eb87c5d96a9a49502b56dc7

SHA1
6ca689e9809eba0ea23a2b22968e8d0871f0ee10

SHA256
e298eab2f8fec337497c82584448c053a888b8bf881ed211e156b91fc9d2c8c9

SHA512
a8335d72738bb0401bedc78cd54f95c179e3744b347bb9ed1629a88a6fabe8bf5a32809cba565ded1ac7e06024f9bd32bd419c31ae0487ac3d37f6452bc01976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d73bad522b58a8ccd08ce701c274470

SHA1
4180d6ba73503007d1506b29e5311fff345b3363

SHA256
d93c1c5a3b4010329bd1e49a118f23e9cf3964b5aaafd5d1d4d04a8accb6b058

SHA512
e8960e888334d1a7690d5601fff67cdcfbcf9941ff68a1f2f7dd575a088b99eb13a1d2064809504d821725d0a94cb829b0238dc3f9549c8327fb99352e6c165c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e86092318ec38154c9cc63d32e9ef53b

SHA1
3a3868d3e3866e446d89e3161768d46586d1afb3

SHA256
72842f81513cac2c70a04dd1637451ebd45e73f1a69ca912e5fe43013134104e

SHA512
092f83a75320a5257f2e386b1f10141769a7cb7e654733728d5c897c9d23680236e9ffe5c492a2ba659f0b6bcef97b6aa4e1c01c8f5d6f0b59934a375a85be4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d66a34400aebc83f6f42e48eeb87d942

SHA1
559734cd5345144e8eee227da0a9232626733cf8

SHA256
9f88346cf2d5e1ec0d011cae75f5e23a36dd029218e2a1fa83da425cea12efcf

SHA512
455df0e2f888084b6fc87023c03df53e4c157898e26f7e2888f6e155389793a18e780fab6cdb3ef6c1b30bbdd7217d7300f2312b536d8047afaed5bfdc10eec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6e5c63f8b00ee0674def805f2f9b8ec0

SHA1
c64cb0ccaf66a80890926b0d0488327b8ace5f1a

SHA256
bfdd667d55aab5691b04b4f2428b02611d0ba6a0c072874c842f969b77e24e62

SHA512
d881aac08c32ae32c0009a7a3c96f4fb5fc2473e17cacfd7229e51bab776dcef458447643ca6a457c3a721deeda2ada67f20d3863a80c4e72b7fd48678955166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67d3c39053dbc253eec38461cdddf547

SHA1
d6f0eae5bd8e04c4c4eae3ec0dca30784c6e538a

SHA256
ead542062837a1e16a1a68c433e7d188f2ba72d318825c95ebbc13e4e0b600b7

SHA512
359c9b89561682e4979f50c314bf6fbff70b15e317e5d39a008b456df9db5e1cd0419ed3d6ebc8d14d151950a96b7be378c18b9cefb3c53798e9fc8d15492a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e7ac.TMP

Filesize
1KB

MD5
6f3060a8ca34b5f51beef1f0f6fe1a7a

SHA1
a5d38ca28e3110dbc3345f9c6baf11a436dc49ad

SHA256
e45a9bdfa999f06831cb5589b46df7bc4ea99a3905b8be0a8433350899cd84e8

SHA512
1c2615769d7e6dd3b1e97b397f4f0a15173aa57c4b3ed6558d3790d13a4005b7143c5c8e72e0da31f35c35a5ebede90bed6247f0fbb49820f1c0fb979453cf92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6af78f015ad275e2af09fd334396b95c

SHA1
1c178baed19c709cde1c2c8342c3fc740d8549c3

SHA256
2bc716545229234dab40738ae391e28cc7ebcddc1b050ca1b0c33f49f301bcc1

SHA512
989566d2e8112f9210446f13339062d9451820d83bdcd7840cfde34931024233683daeae134cb5211df2ee03fa96ca1e0b4152863eb71d837f10eaffb0d4f8ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9079b9f8b98d4d86f6bf165d4b46e28b

SHA1
bf97bf38018790df200dd20df2c807468ccae4cd

SHA256
0112d7c58a2d76720fc52b2ad794d754191e81e9edebec664178c2c57ec330c6

SHA512
6559e6f9a2661595e23a7a0989977d962cf416dd4e2f3a369e98e01e3164d4ad38d653b932ca9ab7582f9f53cbd0993fdfa387679fdc3f9adc018cc24cb4557f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c83a56d64a68b6135f4f9c99104c8be3

SHA1
19e52c3bd6e2f4b583ce2571fdde6c75b2faa0ee

SHA256
bee2fc599c3c9d22802ff88a0d5f7006dfc57d03c1a51bfb782d43d0d83017cf

SHA512
90ec78110aeb18aec08d03b6317db11e455201b186fcff074167856475e038bb943d37ef8a9467945cb96c946c0de08734c690f230fe2f500ccbc5eb63874138

Download Submit
C:\Users\Admin\Downloads\ZOD-master.zip

Filesize
41KB

MD5
ae6438a5a41352e5b7b37918259bea69

SHA1
684f4e642980875422c1e666ee349d9aee5c337f

SHA256
d53a7858a392b314ef7e63d5d8d2f7fa8b6067dc0b9cc926adf219c0c4c0b768

SHA512
28b14be2cadcc3d37afd2a501e553bb5d8df42cb376609c587348a2bfd3eab35e81b76ff2f61b1951a606739834eda607f9dc4334ea60f00bb806edb269c9784

Download Submit