cb2757792673b5b344336c6be45e855b1674826c435d1257434d3df434a0627b

Resubmissions

14-09-2024 02:42

240914-c7fvfasglp 8

14-09-2024 02:37

240914-c4gmkaseqn 7

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

4.5MB
MD5

d4a79b5d46f0931b9eb7125fd40baff0
SHA1

3a38fb263dde2251b9fe157b5fddec7acb07c53e
SHA256

03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f
SHA512

17cf94805f11d499ff12d8e42cb262ceecbeb265f56338e0837d291f6a7ed7f8135a025dbe99fdb2e2bb299f2267bed9365976ea51269aafd4c3220cffef9339
SSDEEP

24576:thgBBmnLiLArZ62BrcrnKHq/kUkBAwi9QxruE:rYBmLAehN6KK+xV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
3576	msedge.exe
3576	msedge.exe
1260	identity_helper.exe
1260	identity_helper.exe
2348	Installer.exe
2348	Installer.exe
1940	Installer.exe
1940	Installer.exe
4256	Installer.exe
4256	Installer.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 2360	3576	msedge.exe	84
PID 3576 wrote to memory of 2360	3576	msedge.exe	84
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 3668	3576	msedge.exe	85
PID 3576 wrote to memory of 1676	3576	msedge.exe	86
PID 3576 wrote to memory of 1676	3576	msedge.exe	86
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87
PID 3576 wrote to memory of 5068	3576	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xc4,0x108,0x7ff83df046f8,0x7ff83df04708,0x7ff83df04718
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3169375529882578883,13856198309096040373,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5552 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
PID:2556
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1700,13117675573144300383,3302398706898114754,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  PID:400
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1700,13117675573144300383,3302398706898114754,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
PID:4504
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1688,1060686495785272411,7649733962205518059,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1676 /prefetch:2
  2⤵
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1688,1060686495785272411,7649733962205518059,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
PID:2676
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1668,13689611457329047315,12210937773015168210,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1660 /prefetch:2
  2⤵
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,13689611457329047315,12210937773015168210,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4aa47f8e5a838afb3b70986a7dfd4f4

SHA1
3ea752f7b647f010f4532a1c3cab32ea4eddf3c2

SHA256
3dbedde1c6c9dbcd7a504d6cc267fade7d4168c09718f358f6b1addfb90236b7

SHA512
1a7526486e70330077c93be088606e4d83414739b0428216af73be9623c34e6824757f5c801db55db94d125dcf1845eafe2a194368aa2638e0660e19b902802b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30ea621cf29f1d4f4ecd175e97651fb9

SHA1
128af0f71c2c582268236d9ecb04321976799a83

SHA256
ed661127c768cd2f7139a0edebf68f160c8b740e3b7b498760661fd7e8ebe9e9

SHA512
e1274122e28064179cc42bb0551e828b29f1632190a5c004d5046241b4321c2f2bc9c76cf366e74cdcf018c0057b50a422b0ea878a61188168d40b6e0f5dd33b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3296c676a5c95302095c0255ce37fbe

SHA1
c6a6a455e9767306bcb412f4639e481cbe304c8a

SHA256
594a665667836b0b04594af9a2f1929cabbfe2acfe3d004270738ad046583840

SHA512
57b043dc7e4bd64141a3ff5c2a756122ef11fa652ef94a6e8d9c7c277f0bf83b8463e8288c5638570d587ddb59f56d1ac6f768751f23328268525d3fdc774168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
256ede51347b6fad9722a892a173c2d8

SHA1
bb1e58092915758d84f1d672f5c05167d2403a0c

SHA256
130bc0db0e34a415a28f3b1a107c1788f5b7f87c2ea44dfdb28e3218311abcb9

SHA512
0985aa0a951ce1e5faeed760e7388eb62b43bdc0e812843ab844df7d5650bc41a6f29184395ae2981b20d707aa176b04f46a6bed0f158c9656a7ac53dc180b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58c8a103332b19c82a3d8461358f5030

SHA1
2238c7d816ec2b0100925b5141d4b5f8251811c0

SHA256
cb4cdf02659a856e9955cf57fc71a8ccb33290d1e1f456ebb1dd578fffb72ad5

SHA512
2ffb9314f41a8b4557927db58fa06db3324f607523bb3625b68e3badd8fc1e5fddb165a6ffe16a3de825bd20e0c8c70e2c1db359ff20509d3771dc160b061771

Download Submit
memory/400-116-0x00007FF85ADD0000-0x00007FF85ADD1000-memory.dmp

Filesize
4KB

Download
memory/400-126-0x0000020224310000-0x00000202244B1000-memory.dmp

Filesize
1.6MB

Download
memory/400-127-0x0000020226A90000-0x00000202277F1000-memory.dmp

Filesize
13.4MB

Download
memory/400-153-0x0000020226A90000-0x00000202277F1000-memory.dmp

Filesize
13.4MB

Download
memory/4460-142-0x000002727AFC0000-0x000002727B161000-memory.dmp

Filesize
1.6MB

Download
memory/4460-143-0x000002727D820000-0x000002727E581000-memory.dmp

Filesize
13.4MB

Download
memory/5112-140-0x000001B5D1EA0000-0x000001B5D2041000-memory.dmp

Filesize
1.6MB

Download
memory/5112-141-0x000001B5D4690000-0x000001B5D53F1000-memory.dmp

Filesize
13.4MB

Download