27b9c2bbe7d1d9a042707f2dffed11fec9f2bb9804a5255d02c68b5b975d071a

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ryzen DRAM Calculator 1.7.3/memtest.exe
Size

40KB
MD5

2da23869191b9b93106967d1924e6342
SHA1

ef072f822fa270026c7243e8ad4cf5fccccf2947
SHA256

637d81054008795d8ba5115682fe5979e26c3691d3a8ac7960bdf1a69436907e
SHA512

80a8560304f08e1ee7c77de19d100aab00e8932147507486d6f4558760459a57633f013e907b93263fc41c158ef0a4b061708d036165d9668ba90405de3ecf27
SSDEEP

384:YJDsy4wiAjbceYC87TfUjO1RMuQJL3LNQu/+Hqo71a1soaxFWHxujgHjKDuucNzT:YalvAjbceg7zlc9bGC+Hq+2/aGHF4M

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	3344	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memtest.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
2032	msedge.exe
2032	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3344	memtest.exe
3344	memtest.exe
3344	memtest.exe
3344	memtest.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2032	3344	memtest.exe	99
PID 3344 wrote to memory of 2032	3344	memtest.exe	99
PID 2032 wrote to memory of 2572	2032	msedge.exe	100
PID 2032 wrote to memory of 2572	2032	msedge.exe	100
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 4828	2032	msedge.exe	101
PID 2032 wrote to memory of 1848	2032	msedge.exe	102
PID 2032 wrote to memory of 1848	2032	msedge.exe	102
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103
PID 2032 wrote to memory of 2736	2032	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\Ryzen DRAM Calculator 1.7.3\memtest.exe
"C:\Users\Admin\AppData\Local\Temp\Ryzen DRAM Calculator 1.7.3\memtest.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hcidesign.com/memtest/copyError.html/ver:6.0%20flag:1%20xy:0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe0e046f8,0x7ffbe0e04708,0x7ffbe0e04718
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:8
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2444 /prefetch:2
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4352 /prefetch:2
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3000 /prefetch:2
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3028 /prefetch:2
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4964 /prefetch:2
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3032 /prefetch:2
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16500505865810103558,9310629044863491606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5004 /prefetch:2
    3⤵
    PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1244
  2⤵
  - Program crash
  PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3344 -ip 3344
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
284B

MD5
779c1d2313fccbe7d85719ab8fc35b3b

SHA1
6dfd99dc422c4137b09c93277c422daec5fcf091

SHA256
64ea9526d56739a996f41579568e9ea7e2db93fd2c0278370eb975376f0c68f8

SHA512
cc691d41d620bf1f19d4a35a98eea4306fe901a84f451e4b7795d9eff568283082daab3bbd9ea55150deb607feda382cea3beb4ba81acad37696c0cf6d9eb50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b00d597b-ce5d-45bc-ac6e-7b8a7cd89559.dmp

Filesize
6.0MB

MD5
7ae9b44fca6b5d50d7002c2dc5654f40

SHA1
d4d823c45bd32975cd547ae34be1570157e5da4f

SHA256
fe47eec8853d4e52c55e73766cc2d851c5156001dae9b072313a716e1d1d04d2

SHA512
3cde34bc957841a3e609e192812d0fccda458bc3dd2ab9d2f2cf3607dfb393f182c48e314c3a9467f25d737960e7d8fbeb2c7cf1870f36ff8468585da92cdc12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b05b69d3-fdc3-4025-8bce-fd3cc192107c.dmp

Filesize
3.7MB

MD5
3cac4cadbb3c73bf9177d89ab8c62fe0

SHA1
08d4b2a7d5d859e759084b39a2ada112ae7687c9

SHA256
d3a090e0182bee5c5fd5c2c7390a8f0b6e03e5427cf1eb161ce9eef30d65857a

SHA512
2fdd9e364d0fe1abe6c11fa640ed318cec0d68fd48287329300d648471030fc9db6e575035f08a84338a51b4452f98aafec875b47f0a4885a430895c1ecde67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e920529201a9a2663edb6a637cb62c7

SHA1
3f6ccdf17a0dff5b06ff79d56cbd3e3291341de1

SHA256
0a8c457cf6f3dd70ffdb688c719dac99fdbe76648ee38e2f680af2572a48d9ae

SHA512
5721e32db3edf88850703ca06a5337ebf7b5033af2a8cb013931f22824c2494b64f30295f0e4977f20f02ef8156a0a3cf0bf4e12b8fda54af4b5ae0a96bf0eb7

Download Submit
memory/3344-2-0x0000000005310000-0x00000000053D2000-memory.dmp

Filesize
776KB

Download
memory/3344-12-0x0000000006960000-0x0000000006981000-memory.dmp

Filesize
132KB

Download
memory/3344-7-0x0000000005C10000-0x0000000005C27000-memory.dmp

Filesize
92KB

Download
memory/3344-4-0x0000000002750000-0x000000000275B000-memory.dmp

Filesize
44KB

Download
memory/3344-3-0x0000000005420000-0x00000000055C8000-memory.dmp

Filesize
1.7MB

Download
memory/3344-0-0x0000000004B90000-0x0000000005198000-memory.dmp

Filesize
6.0MB

Download
memory/3344-1-0x00000000051A0000-0x00000000051C4000-memory.dmp

Filesize
144KB

Download
memory/3344-10-0x0000000006930000-0x000000000694B000-memory.dmp

Filesize
108KB

Download
memory/3344-11-0x0000000006950000-0x000000000695A000-memory.dmp

Filesize
40KB

Download
memory/3344-9-0x0000000006890000-0x0000000006923000-memory.dmp

Filesize
588KB

Download
memory/3344-14-0x00000000069D0000-0x0000000006E20000-memory.dmp

Filesize
4.3MB

Download
memory/3344-13-0x0000000006990000-0x00000000069C4000-memory.dmp

Filesize
208KB

Download
memory/3344-84-0x0000000004B90000-0x0000000005198000-memory.dmp

Filesize
6.0MB

Download
memory/3344-99-0x0000000006E20000-0x0000000006E38000-memory.dmp

Filesize
96KB

Download
memory/3344-102-0x00000000070A0000-0x00000000070DD000-memory.dmp

Filesize
244KB

Download
memory/3344-101-0x0000000007030000-0x0000000007095000-memory.dmp

Filesize
404KB

Download
memory/3344-100-0x0000000006FA0000-0x0000000007023000-memory.dmp

Filesize
524KB

Download
memory/3344-6-0x00000000055D0000-0x00000000057FB000-memory.dmp

Filesize
2.2MB

Download
memory/3344-8-0x0000000005C30000-0x0000000005FD1000-memory.dmp

Filesize
3.6MB

Download
memory/3344-5-0x0000000002A40000-0x0000000002A5D000-memory.dmp

Filesize
116KB

Download