e4606439b649d4635746c9a408e78492759398c12b952df2574ca871740002ad

Analysis

max time kernel
71s
max time network
80s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-09-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PhoenixMiner_6.2c_Windows.zip
Size

5.3MB
MD5

c90c586712ba8196c3471db532c139b8
SHA1

b62bb4774de51b97978bd389dd284e4d636ed950
SHA256

e4606439b649d4635746c9a408e78492759398c12b952df2574ca871740002ad
SHA512

08cf479aa03fc53d698b7ad703f9e09a5ccd57885cd6613526f9d0b7166bd4fddb380ad03be870cae61e9be41894c9cf7b1dd936fd99a1c4f68e01df6077553f
SSDEEP

98304:5+WELtwI+x88/G6/bv2CK4Xo7/qnuu86CESMcgNfXTm9j7jXPjPgxm22YaVI:5+WDIgHO6/bvlkXuHylc7mpExm22YaI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{EFB260D3-89E7-457D-8741-BEFE02A276E4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3244	msedge.exe
3244	msedge.exe
4836	msedge.exe
4836	msedge.exe
3796	msedge.exe
3796	msedge.exe
1640	identity_helper.exe
1640	identity_helper.exe
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4836 wrote to memory of 1672	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 1672	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3364	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3244	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3244	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows.zip
1⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffaac33cb8,0x7fffaac33cc8,0x7fffaac33cd8
2⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
2⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
2⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
2⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
2⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
2⤵
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
2⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4712 /prefetch:8
2⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5800 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
2⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
2⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
2⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
2⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,972616972346811114,13346622103483855833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
2⤵
PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b1e51f1-7665-48c6-a037-41ac09e225c8.tmp
Filesize
6KB

MD5
b6c8a5e601fbe460703aa0afbe27261b

SHA1
48dfd2d3d905ab9beb5e92bd1053e3e636db9cb5

SHA256
a1090bcb80379dc605c47e2b8ac9b1374ad84c4b1f8ba27de6644e33d86a2c05

SHA512
a851fac3bfb431e0be111f66c48db02011dcbd7bebeeadb14d2f61b09421be39214ed795ec96cd45b211a98be41f7ec94e67d4423d8ca427ea58e3c8e587e08d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Filesize
879KB

MD5
3c3a5dcacc650cd0160b39e88fc909b0

SHA1
398552bb69459f99f0652a6b1f9d199cfa6f9a1a

SHA256
b2a016e5de0b7cf5addfcf6f1795306917e3a49ba2cc71814d5542647912f9fb

SHA512
53ceaa158ac8de646e8e947c40554078c5f30911def3f718034e8770f1266ffaf6711be009e41c443b3e76da471b880661afb2e7667e7ef3d162da8c657527e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
0a5df027acb5630ffcd51dd1c4f38c0e

SHA1
b24af1420dea4ac20c394d04c3668160cfb9984e

SHA256
efc0ddbdb1032a5c687ff6a3490380f659ecdec4f60d74e9cbd8675f7257c633

SHA512
88626d205d50d3d7249491239b93f9302631c03b8697f8b60d5b060f7d3f424d6bce73a37dc574df9baedd193a7fe3b4a8cc3feb98bd14d5c9ba2d76e4d9c168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
76c6f1a400c6dd0d3e2c925848b43e97

SHA1
23be8dcbd3d39daf6cc92aeb91b9747f827688c5

SHA256
1fa26fe98122ea1e5a12a14aab08a16cf886d08033a60a89b8d1c22ad6c3a91e

SHA512
1a4cd1e6623e91e5cd1330a5377d4c023743ea71b3d20feb8aa8269bf0449b1ab70e4520774ea3b3cc5616f26c3238974d9fc7b2f42de9d914359711950d84d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ca408bb1b68ef5b02944a5a721c86e31

SHA1
dc86434b24ed25604b492b8221c9bcd99af38974

SHA256
f5ebe014721886b794fd1efa4207b850de1d643dd6d1b05bc166d74b38e24ded

SHA512
eb134a04965770c643775060ac20238ec31427698be801a9e55beab89a5133a8850ae275013a72567de29d2bc03512bfa32437c7b0128a8146ce686d63d898ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7a6510de0d6114c46391f63c9e81144d

SHA1
8f497af6a6af6a4874224edf3c85df2df11a2a57

SHA256
4fb7b9274890ab87b71184187b8c7a406aed6cc0efd4802f6f24571e0ace2d52

SHA512
a275749ef95d5b8004c714e1e4045c0858a5e07dfb4c2d372793a370a2666cabb8231ae977c66b6e85502328c7ff13adc799354e59b80cab391cca811008e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
a87840c158d9cee309b1c314367e2b45

SHA1
3a078ac3a8fc4c0d1349087fda6ceed4db1bb64e

SHA256
66617827447d6b8b715f5e7a27bfd2c1bb4491f8c455a9564ff017d1b82061d3

SHA512
a33d1d8fb8e90e550703cb5546aa46e7ab29ba03d2bcde5cce0831dc37966bcf975fdc9c71091159f89f34405187345f5b50cbab5425d7794121cc78ce4fd4cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
6cc85143cc87cd618928445a7bf4cc39

SHA1
d18c26979c005108d54ed842c0c0b2fcbeb34039

SHA256
dbf614ed720303af80a31027b718938c1d01af2420c3539fe106bc66c4b08f82

SHA512
732cbc528bb03e656ae1a45db6748d7e53fcc411f2a5212abf40466b97fd14e698f9c3354d775fb9368cbe0a6936509d262d8232286a311bb16b9fc18054a577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584939.TMP
Filesize
536B

MD5
a1012a8131090f01ed2cdc45a83ac795

SHA1
fcb78f07cc11c14fbfcdebbd48e9c87306bdf36c

SHA256
f00d496f1f07f2d23aeed6bdb2384d582089fac804b516295e1f942495715ea7

SHA512
62b56d12c73e2d3e98b54689b0aa758649e1910587136b09e0d5ba66b6596723486e8e8c8bd28adb02ccfb46bf3a213be62d36e9a709ec213af202fb66efdef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
06bf14da6ce3f720bb4f39fdbfab0d90

SHA1
6d2b806dbbba31029a32da79c7a79f4b6c1d6994

SHA256
f134b924c4e0482d1d32c08145dbd1ca8431bed8d4b26e519b5009ff7fa815cf

SHA512
f54f856b5ab75280856bd41f512550baa8408cb9e38d4a2e9fdc8b8d5a666146cb0c36520bd13f476aacc3aa5b3141a8c0824848f45257f0ff4b6213ed6da5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
40b96effbd65138d55b61291cae7a2d5

SHA1
e5d6156c4183881df064dcbaec75bffefda2f1b5

SHA256
c6c3159798b24157372f11ed1727f51244412eff96b8f46a51c3aab88d746a19

SHA512
1bfb8e8577427d23337cd7bf86e651767d59c53de89fcdcd709d2af9c29df190318fd87467d32e314d7e0fccc228b896080e33da1923254740e37986fd06983b

Download Submit
\??\pipe\LOCAL\crashpad_4836_UCDYXFHFNJKXFJUI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit