a12e0ac33a927dc5d7596c903a21672a7fb1c1d5d1602f4523b561277305a876

Analysis

max time kernel
1768s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-11-2024 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

115KB
MD5

30524537889d5ad2b25d9c45d2a8b3aa
SHA1

a6bd57f8cc10714f44b06d9e8a33b5984450797b
SHA256

a12e0ac33a927dc5d7596c903a21672a7fb1c1d5d1602f4523b561277305a876
SHA512

9603239ba363c7ff40f14a1d05bd66aae1a8e159f90504a80008fd4abeef8698c71426322832d769458a894ed94c93c8dca15aabeb590ae481d12bf4be086590
SSDEEP

1536:8g1gX/UtGZ/X7ItkGpSlqKquBKquBKquBKquXbQQEMiAO6CIsd+Gih+p6l9x/0:yiGZ/XskGslybQPnI/Gco6l/0

Score

6^/10

steam discovery phishing

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	discord.com
16	discord.com

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
1948	msedge.exe
1948	msedge.exe
4736	identity_helper.exe
4736	identity_helper.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1428	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1428	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3032	2312	msedge.exe	79
PID 2312 wrote to memory of 3032	2312	msedge.exe	79
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 1928	2312	msedge.exe	80
PID 2312 wrote to memory of 2136	2312	msedge.exe	81
PID 2312 wrote to memory of 2136	2312	msedge.exe	81
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82
PID 2312 wrote to memory of 1384	2312	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc19bb3cb8,0x7ffc19bb3cc8,0x7ffc19bb3cd8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30185977-fed1-46ca-924b-1242596e45b2.tmp

Filesize
6KB

MD5
8c6d2871923a6a8196c3ec8cce00667a

SHA1
be40ed75c796b894b52a2ce8cbb2f0db6244cdb7

SHA256
abb4474c25404727a18fd468efd0dbf82303bf1ae2208e5164385025a8ac4098

SHA512
40c6dd76d50f1f27bbf8e51a9d38f750a85439ac251dc792be341abec849567683a2a38c3451255915968fc8fbcb0bedc6a2c4e355030e5cc8dba87429cd57d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
067cd05048429ee523668d696b1269dc

SHA1
917cf371676f14ce0e547f72766fd4b6b9c68dc5

SHA256
91e440b0b98002400a173c7b58de0745d67aea72954dfdcecbcdd0c19e0bc107

SHA512
7fbef4615dd111c6ba85de5bc02260f9f5855421768f84788418f56ac1acf42b51d1c7fb5c4665bf5a4a7f964a08107fb5305af3c669b625383900e7cbcdfff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a0522fe0178bfb3359bbc493fb5e0df7

SHA1
06a09735b1fecc07214c61e305b02091aa4e6f58

SHA256
2c711d9974cb19a0dc00c72e81b65e0ae45da44b71acb49c1ad660c6f8a13363

SHA512
a1e2fc20cdb2ca7bea00e28daf40514a99c0d1629872ed806672449fbb339accd1f66e7011b9342ec76f0fc2461d1e75652350a167e1b3d01190bcaa18499562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
95eb39df4131efefc955f8603ed0d0c0

SHA1
1e8e1101c4ecefb20788cf0edd1dd290eee1f6db

SHA256
42fb1d05c918c5a9a0731a30822575fffd20b22c2ab5df919b6a8c0c11f20307

SHA512
8b86204d0feb3230c0fb8267cb7695e51e57f32a5ad9d8560ea7a3eb070917fc53839e18e2fad93c5947827284ef12d3b2b953b8fd81e40edc36ce90cf387e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58a3743ef4f99ac2dc3ef1d1fdbdce41

SHA1
5d2492ab4ec621ae55a84ff4b43abc32eb75c0c4

SHA256
9be57abfe6ea002c3dad066688c6966fa19ba6e9463ac787e8562a3440aefb5a

SHA512
77099a00d0a6569c35878a08537389ac64d4e76a8b79821eb1e8315155d1eaaa13dfe369bc5be0d09bc525f662abb2e414d8ec745d0f5cb4e13fe0136bf50178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
df5f76bbf2877163d7bf7cbf609897a1

SHA1
2f49ddbf73cf354dc5d52787711fb86cb6fdb4b4

SHA256
e199430431f3e7b46ba42de2a949e2d8e4dabb30f4acc3b69c142a45004ecb26

SHA512
7e1c8bb84f50ce68e80b9bb2f35426dc5596f67ad76bd875de8fb1c870456f8b9a893e7a1fcce29bb9c72fb25dfe4a44e0696b2a651d8e26ddc24a65d16d2c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
edeaad218a73ba01fe166481438859ae

SHA1
7e7d1b44a776148f516900360d678eddc02ebc9d

SHA256
26411333b62bca6c46dc9e846bebd6bb9c09b7cdb6377ff6306c8d603d2d4ceb

SHA512
8cda5f08fdee217eefc77b3d96edc2a74b3e4af5cbeb8c4038a12f5d453ad5fc8a0c654f781f73580ecd4acb8fe71110ac50501b62d04df4521827705e5a0342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
251434403c8a192ef3b9d84c88e18e8b

SHA1
273fbac777a970691a0c378b7a625c318cf8f851

SHA256
76afd994602d8119f34d5c1c9ab7eef4760b8c45ae411b41932e4e901b9115f7

SHA512
fd214cc0fc25d85ab4e35c6da78a0219f45fd4515e0f8f91c51e9467c881444eaccbf5fc268a796794a14c887f594df5c3dcc0a9b3836d0d6bf7e14a42691909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7213c6f83d0cdb5050383a55e3d8c3f2

SHA1
6b67782a884cd0439820323023c6334979c00471

SHA256
06d9bb9440811c54312520f855105955f38567443eb7b683a4a2547ecf27bf91

SHA512
cee6cd721565787abd2489f8bb2fefd3e2449a42458be1aa8b43f963cc35976b812e05b588a82e09edcf39b5deba8c93ee8d0386ebd35de31705f11da3ffa017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e908.TMP

Filesize
370B

MD5
869dc10d84b71bd041f6fe96e67f4ce7

SHA1
9518387f791d0d21ae0715c10e5445ee814166ec

SHA256
c21efc1da7adec99658df7b2f3c62bb6d8b50a6104d05cdd1d9a9e4e9d8d37bc

SHA512
b8bff7d2ac5218c8f1c309a18723648cecd01735de2d6af7c0133246f248e787fafef6e6f4831f676acbdef4fd6069a1d22c077c2a140e25e71cffafd57e7764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0034dc0ee88e9387aac59107e99bc504

SHA1
1bae825ba9de9192cc010a12c5d499659901a0c5

SHA256
a53b22c62459cb905f0853005d1a2266ea053b815d0ca87ce8bc4d01e48c1f87

SHA512
c2b9f94708a0d7910a10c94a8ad7e135c78f7cc39120811c5efe05fb333b785f6cc4c9e31dcdbb7bd18e088cc1e1e49b5ff7a439d2377bbdd6f9476343700eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e4e615ab28597d96596ba335986e17f

SHA1
9129075928d1f40b7ffda795ae11927aa4fee6d7

SHA256
2769b9c63007e27095f7163b10a3966fa41e10290b13907a3942bdf3249bb709

SHA512
710c78eb09d960f4bd1d5e39eeb98ee96a919d0b262c4ce0be3cb6daa78a729ee186a550606cadc7cc34bf20fe862d642034022d4e8e17de90ecf3bc675feb30

Download Submit