hxxps://github[.]com/Endermanch/MalwareDatabase

max time kernel
229s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
115	camo.githubusercontent.com
116	raw.githubusercontent.com
117	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
3832	msedge.exe
3832	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
1612	msedge.exe
1612	msedge.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	taskmgr.exe
Token: SeSystemProfilePrivilege	2512	taskmgr.exe
Token: SeCreateGlobalPrivilege	2512	taskmgr.exe
Token: 33	2512	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2512	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2608	[email protected]
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2608	[email protected]
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe
2512	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 2140	3832	msedge.exe	85
PID 3832 wrote to memory of 2140	3832	msedge.exe	85
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 1152	3832	msedge.exe	86
PID 3832 wrote to memory of 4880	3832	msedge.exe	87
PID 3832 wrote to memory of 4880	3832	msedge.exe	87
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88
PID 3832 wrote to memory of 4300	3832	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9addf46f8,0x7ff9addf4708,0x7ff9addf4718
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,12179823357431659081,12328575937485803836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3304

C:\Users\Admin\AppData\Local\Temp\Temp1_Hydra.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Hydra.zip\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2608

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\770c0cf7-46fe-4960-a060-cd15689baac9.tmp

Filesize
1KB

MD5
aab2faaf906c6abb3576a16ced1cfe25

SHA1
edfe3482ee74b91b8db99ea68f4d25bfd4052d2f

SHA256
46416fd8d4af1fa56548558175c0ebaf67983d3d785d1db895bc8682bd453918

SHA512
8e531b174cb32eb449a9ac3ddee421eb7099908057816e6c82e98c163feb3dcf08cab5d038162c598fc33e95b97d5f8a456e5ffed36274977307ad09ed64eb7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7bbc1700-cc7d-4f90-9757-904bc0261e75.tmp

Filesize
6KB

MD5
7846473149eb8c30478291dbc6c6da18

SHA1
c0fa7f7aaca23af09afcca40b19bd68eecf0c6ab

SHA256
565cad5aaff6a57ea64500c584cf563a75e7475390ea4399d403d9d5c5c539e7

SHA512
232f8f96a4ddc34fd98732d1a8400b5dbf8e72cc39254b11db84976575ae6efac9c7a711a283e792c51013f402b578d851083ee226bbc236491cab07cf37a40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f4840be-b887-41f6-8192-2139006a5bfb.tmp

Filesize
1KB

MD5
87e97f201d3c88f9539efd0cb861bf88

SHA1
29dfe379066f767ae63671d63604a2fb22a96b22

SHA256
c30cf2d79b3832c409f52824aaffede6f81d9d4d3a7703dcc5e9c442456b7860

SHA512
cacc364700d3440e0811c21e8acc09d560d2dfbcbee56d8d3cc61cd7f9a631ca4b9d4ff2476f80075fbda5720942f29134299e2bc71858a840e85b54d5a68788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c789f0704be8bdb02d4352530b885e29

SHA1
54d532dd43dd75d17dcad35c600eecb9b39e2870

SHA256
a16dfc24ac8dc8b3b0927bd3b5d67528eb22ac7159df017da1baa26b9195113f

SHA512
02c624bfbd72e2698250afbae4f3f6ab9d715f6ba708d22d546aa1f4fbf0fcecf3063e709b3359b6e9f299f6c5895e8aee00b054fed1dedaead81c897a53651a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ef92bb3b6ab1a195ac96b889cf2c5005

SHA1
fc55fc3805cdd080939f304478bf39d5d0092dfd

SHA256
8ed9bcdf74038ed1ec1557ccc39543e72f926becb4e8ac3ee927e71c7ddaf417

SHA512
a475f15e922883dfba882e44a5c63d801ef105a895fff989f22ffaf78b3e8442ac5aa74ee9bc37a39fd0269ae5200d551188a0a386d449f02e508bf786da6798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
d4c46ae160e47b8e5638323df0eddd80

SHA1
5a0f0cf97f9ffdf00ef86177ed74c27acccc7054

SHA256
9ecae06af7ccb6ec9a8826d37b6fd2ca90a7b58c2daf84497b582141db80b4f1

SHA512
056a890b5555af784a7c350bb8dc5ce62c818fbeb61a0ce4ef91396683d6b774db960cebdc1da55ddaa671631c733aeb30393ac588afd8a2d71d4914846666f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
d51e02e66bde484c18b3e221cbfea412

SHA1
5e219e5d1c5d050220415062c4317bae644cf9ec

SHA256
e79f9667951a4170007fb5b3baddd8c652e666a9a1d151bfbfdee2f18fbc73cd

SHA512
cc45eba84213c916d721bded5f2e968bb8035ac6bf0e3da90f532b88150455809ece3bd1c50b330bdccf890cb206f5a4c1aa799d75c1acb7cfca18ebd513ca34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eac35842325241982cea9f8f8095701c

SHA1
3ba504068d2991ac3200c5ff39a10ea201231c7b

SHA256
b8205890bb9bda648b5d1390393a7cc64ee8d297a5060ce0e311490a1a747794

SHA512
9fffe4b533025435ae02c656bebd73be8832eb0f6df61b6a5b106f563bcdb513ca64c1ac6e839abfb89e5b4ec962a1c44d303b150b8466ded497342ef52b230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d85828e24ba81a2fd09f05ecb1c6c300

SHA1
23475d1375be9811c8cc2507a58f89b9c7aacc4d

SHA256
fbad0f5a84cc13f1ca9ae31d8104f0fb5b5464c16fb8b31beba9fa5ebc33840c

SHA512
c4004c88dfbbfa5da039f7ad3d6b43749c478815eac28101d5ad3d2b29a2614a2f5d7b84c7b3230a6e35616e4657f6b899df7861fb3ef7a63323c875164407cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
71ca6649c6eaa63fae4eaadb55c4b8af

SHA1
860366e76052367e982d5d1710610efafbf30aff

SHA256
7645137563ba33de31b2a1d41829978281cb00c98dddaf064674a6e94ad99a1e

SHA512
2e3985d0603af57f06d63cf4daba34f395e9e29e2c7a4e2ce1d569f7b3218526ab8ecd78311b7ef91e8ccc35afb6388dffd8a299b38f231ee8ae3b8c60ec3c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
3b8fce0a13704aa4fafe5b122bdfec92

SHA1
897e864cac4ed718c6090cdcc0b662bf2751cb91

SHA256
36b2ae3a71122dc4e2b73a08937fc9d6cc470672ec9f902b384ea41f719885e5

SHA512
215ac2374067f04eadd0bf8d0e96f735cdc0cec7576a133c4d861c09b48c85a5b29227737abcb5859903afc6f021a7b6f22b179e0eb6cb32d911925f7a29857c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
abe140be95ac2c2411168b222c21b380

SHA1
d8ec370fb52b866ff238fcb6aa78346b0f11273d

SHA256
e815a712c5e0df47b4713471812bd031cd8fb971fb5ade9ac61ff356b40ff463

SHA512
627e5e1f7008428312b796bca53d520ddc2a999c9db06235bd2203aacc38a9990337f98060a81813a76d2ce2b7a1bc664f1b2d7184fb2c35ce518f0245b6127f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5523956aba157232817b37ff980719de

SHA1
1cfb60b6e4a72baa3d92b7b5adb7dc868dffcdd9

SHA256
f78f1397009568dbf8002abf3cd8e6de52fa9b7d42ba61850d58558546c156fb

SHA512
a72ecdbfdb34831fd568a71b5f0a1494dd0d53eafe18ec0f76265b55bef50f02bab40f5dc7a3b56b0ff2755f9bb293fffad46090de8cfb96667d8d644462136d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e119.TMP

Filesize
371B

MD5
5aeae6fa50498dcc1f7fc1abca06562e

SHA1
9450e493c9b6e2a4982db90c48768029c97bd14e

SHA256
ece2091ac44a303661c54d3a3b0719255237bac7b37cc720c5df1796dd223f14

SHA512
1464a457e6b125ee00d502f6a5f19312c4d2ca09dda2640f5297432c31f49c022a10e2c13f76b67c7fbb4bc01f8b331a50e16f3e07fad21786b041331f4717c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf96f4fa-5913-4bce-8a37-3b1b718c438e.tmp

Filesize
6KB

MD5
640891b3c7d905b9695f02b5e864f182

SHA1
9da849d5a67dac80bca0d802ed02aaf4c7c27ee2

SHA256
7103f3f85bda2870136537040105fceedd5d393be2cddd43ea30c52dae69809b

SHA512
6c1391637fc81d6d508df2bb137aff339dc195de05df8d3ec2fbbbbe54ab5653f043b02504fc724db545e56a60a4456fed0ca3cd0ed9512c67aff5262107ddeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb317ae6-3b4a-41fa-9164-d5b0c7a9b940.tmp

Filesize
5KB

MD5
c4eebaa7d998b2076c021ddcdda8c115

SHA1
6d82a1df711c0abd77f652ad1d01a3345c80474f

SHA256
ae41ba21dcac3ba1337af3d234be3669784e5271143e144236ced9d1df37c11d

SHA512
8040fca464bf09588500d6deda209f6254676a5b33e63171a444a8c61f0da3e79b265928e816049be3596b289fee667c7b7216474c489df0995b30bc9e0086b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
61d405f91146ee7eac962e6c00df472a

SHA1
26863a66f164c7481862784e613c679e9186cefc

SHA256
91307e3ae4efc1ee74b45ac0a27bd4f4e689ec91fdc29c702d97d88b1b1542fb

SHA512
4d6569819d7b7881c0a6dee67ac331e142323caac84088a6eb8195e097b03bed9381a7e0b09ef0dd202b4f0b7f2473f5ce049ce94364cfbc3bb328fda2c1ace7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d8ecdcb7b5b854478feabd20d606e334

SHA1
62106dffd788002583358cf5337f4aa6bc434544

SHA256
69c79a74a2dfff244cf0506ee9dfc79296bff61ccb3efd9be25c91788626f8e3

SHA512
a2097027eddddd6f492f0e34a9f9798b31c430d4ab6413118d675584b316aab011e33e4a4a8c25ee1dc91e9c65d91f8b9eda6e28aef886ea78429b4c291f9fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4431d9e8ac5b23a632bb526602ce4b98

SHA1
c8f254d7a834f7f1dde3219d3a66ca0b3e69f8f0

SHA256
24c508b8323b65366f7b7f3c94317a8298513069516ae787c5c1effa4590adf8

SHA512
865a9959c736d3cce4e8cbb52c7743bf751ce1e2c1d8374c8fdbc9ff1a8346334695071a0bca8cef0d32090a40ae6606999e88ac193f25660b92e7f1f172269e

Download Submit
C:\Users\Admin\Downloads\Hydra.zip

Filesize
11KB

MD5
357593a30fbf34ce95d7db2a5e71d90a

SHA1
153d3e93b95fecf22b9660660d376b0bde042140

SHA256
75f0265017e4c7d6df8a9087af92ca3e8f742a4b19ce5539e25f95316f925275

SHA512
8e96b7803d11b5a567361be18d24cff46c2e908202c067ac6f25b809589884abc327cecde7a46a0867a2b26888e9b2edce1466e20a5136272883bb60ac245cc1

Download Submit
memory/2512-552-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-560-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-558-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-557-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-559-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-551-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-550-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-556-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-562-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2512-561-0x000001DF73710000-0x000001DF73711000-memory.dmp

Filesize
4KB

Download
memory/2608-440-0x00000000053C0000-0x00000000053CA000-memory.dmp

Filesize
40KB

Download
memory/2608-437-0x0000000000960000-0x0000000000970000-memory.dmp

Filesize
64KB

Download
memory/2608-438-0x00000000057A0000-0x0000000005D44000-memory.dmp

Filesize
5.6MB

Download
memory/2608-439-0x00000000052F0000-0x0000000005382000-memory.dmp

Filesize
584KB

Download