Overview
overview
6Static
static
3net8.0-win...UI.exe
windows7-x64
1net8.0-win...UI.exe
windows10-2004-x64
1net8.0-win...re.dll
windows7-x64
6net8.0-win...re.dll
windows10-2004-x64
6net8.0-win...ms.dll
windows7-x64
6net8.0-win...ms.dll
windows10-2004-x64
6net8.0-win...pf.dll
windows7-x64
6net8.0-win...pf.dll
windows10-2004-x64
6net8.0-win...x.html
windows7-x64
6net8.0-win...x.html
windows10-2004-x64
6net8.0-win...ain.js
windows7-x64
3net8.0-win...ain.js
windows10-2004-x64
3net8.0-win...lua.js
windows7-x64
3net8.0-win...lua.js
windows10-2004-x64
3net8.0-win...ain.js
windows7-x64
3net8.0-win...ain.js
windows10-2004-x64
3net8.0-win....de.js
windows7-x64
3net8.0-win....de.js
windows10-2004-x64
3net8.0-win....es.js
windows7-x64
3net8.0-win....es.js
windows10-2004-x64
3net8.0-win....fr.js
windows7-x64
3net8.0-win....fr.js
windows10-2004-x64
3net8.0-win....it.js
windows7-x64
3net8.0-win....it.js
windows10-2004-x64
3net8.0-win....ja.js
windows7-x64
3net8.0-win....ja.js
windows10-2004-x64
3net8.0-win...nls.js
windows7-x64
3net8.0-win...nls.js
windows10-2004-x64
3net8.0-win....ko.js
windows7-x64
3net8.0-win....ko.js
windows10-2004-x64
3net8.0-win....ru.js
windows7-x64
3net8.0-win....ru.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
19/09/2024, 05:02
Static task
static1
Behavioral task
behavioral1
Sample
net8.0-windows/LettuceUI.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
net8.0-windows/LettuceUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
net8.0-windows/Microsoft.Web.WebView2.Core.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
net8.0-windows/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
net8.0-windows/Microsoft.Web.WebView2.WinForms.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
net8.0-windows/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
net8.0-windows/Microsoft.Web.WebView2.Wpf.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
net8.0-windows/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
net8.0-windows/bin/Monaco/index.html
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
net8.0-windows/bin/Monaco/index.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
net8.0-windows/bin/Monaco/vs/base/worker/workerMain.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
net8.0-windows/bin/Monaco/vs/base/worker/workerMain.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
net8.0-windows/bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
net8.0-windows/bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.ko.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.ko.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.ru.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
net8.0-windows/bin/Monaco/vs/editor/editor.main.nls.ru.js
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target net8.0-windows/bin/Monaco/index.html
- Size 195KB
- Sample240919-fpjedssbnd
- SHA256 09d2c9982fd6c56643bad79bab4b1864917cd37c89c99787b1db5ea4e07ae440
- MD5 c4bad1d0e1c2eaefb44e3d5664669c0a
- SHA1 ea3313bfd5772a7151719bef9d7256ccda944b16
- SHA512 6a482df51fb127b7f85cf966a1f680cfe27174b0808a39f2d20ec6b32e334b36a67b3d584096a1ee36dd4758d14f22f3709cba51e0259eceff385c59062784cd
- SSDEEP 6144:hkQSuHluiJu/bgcWBts8TYyCoMbdU44LY2AM2PqPcujF5BVQAurwQMyyYp8QDfyy:pXwXQO5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 12 raw.githubusercontent.com 13 raw.githubusercontent.com - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 732 msedge.exe 732 msedge.exe 2792 msedge.exe 2792 msedge.exe 2924 identity_helper.exe 2924 identity_helper.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe 2792 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2508 2792 msedge.exe 81 PID 2792 wrote to memory of 2508 2792 msedge.exe 81 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 1480 2792 msedge.exe 82 PID 2792 wrote to memory of 732 2792 msedge.exe 83 PID 2792 wrote to memory of 732 2792 msedge.exe 83 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84 PID 2792 wrote to memory of 3964 2792 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\net8.0-windows\bin\Monaco\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dba846f8,0x7ff9dba84708,0x7ff9dba847182⤵PID:2508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:22⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,10888929292816745537,3610493443722016139,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3520 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3308
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
- MD5 ab8ce148cb7d44f709fb1c460d03e1b0
- SHA1 44d15744015155f3e74580c93317e12d2cc0f859
- SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
- MD5 38f59a47b777f2fc52088e96ffb2baaf
- SHA1 267224482588b41a96d813f6d9e9d924867062db
- SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 193B
- SHA256 ee0d15dce841e092ad1a2d4346a612410f8f950fdb019bc7b768f6346f2b5248
- MD5 62fc8758c85fb0d08cd24eeddafeda2c
- SHA1 320fc202790b0ca6f65ff67e9397440c7d97eb20
- SHA512 ca97e615bdcac137a936c10104a702e1529ed3470828f2c3a2f783345ebbef04cac8c051df636c714151671efea53a9b8912b6b0d0b5eafdac5fae1dfdc8f85d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 7c221e650a179c29e99bc707e92051887e0bb63032b6eda3ddefbeda54e1b23f
- MD5 1c02b538636d55b2ed0a66be5f889910
- SHA1 bcb3c69179a2fdfe9695a85bcf604fcbcff57868
- SHA512 a7fe05b9a32e6487ca8959cb973d1dabc466c4830895002aba96139330efcbe526905e0d63170bcf0035f2b0c049f5423271f186a1f8d28d46d2a9a163705912
- SSDEEP 96:nLkzh410ORwpvWMoiVmdeHm9JgUWQyV+VDCziEwb:nLkzCiORGWMXBro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f34147caeb9c45e35b2c85e0561a6c46560402db98ef4b7e803d83ff3a7515e1
- MD5 226899bb3638d9ac2aa891a31661b682
- SHA1 349b7519935157a345babc249420db1183969383
- SHA512 9d3dabba781c51e4b0b2e85eda1df5ae66ccff4f94707c6c9d6ec7cb3ba7e43c7855e9a80e58fd1e48a9797e90fb35053e14107a11fc1240296c2b59a4ce359e
- SSDEEP 96:nLkzMo410ORwpvWMoiVmdeHm9JgUWQyV+VD7AiEwb:nLkz6iORGWMXBrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 4e514486d1058cf6742ba33a7f6e223cbff4e5ae02a38c1226c4d0651a83de2b
- MD5 31d47c40773355fe2188698941a9261f
- SHA1 e7252570013968a8bd57b62457ee8e8b7a37485f
- SHA512 bf32e656a7b18962d6a79f1bcd0469ce57b48ee77f48046c0e6fb8ba237328995387108eb3f4ac5eb79d5762bcfdf4fa3261f8793e154841b6f257e90906b243
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupue2RUklYO5IcM/bo5ZxZ:A9iIxuERzA83h09RZxYwvKqZxZ
- MD5 SHA1 SHA512 SSDEEP