hxxps://fitbitdesktop[.]com/

Resubmissions

21-11-2024 16:47

241121-vaq81syjbn 8

21-11-2024 16:46

241121-t92y5ayjbk 8

Analysis

max time kernel
61s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://fitbitdesktop.com/

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 166638.crdownload:SmartScreen msedge.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

468 msedge.exe
468 msedge.exe
4012 msedge.exe
4012 msedge.exe
4268 identity_helper.exe
4268 identity_helper.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 166638.crdownload:SmartScreen	msedge.exe

pid	process
468	msedge.exe
468	msedge.exe
4012	msedge.exe
4012	msedge.exe
4268	identity_helper.exe
4268	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 2944 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 2944 AUDIODG.EXE

description	pid	process
Token: 33	2944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2944	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 32 IoCs

Processes:

msedge.exe

pid	process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4012 wrote to memory of 4036	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4036	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1712	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 468	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 468	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 5004	4012	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://fitbitdesktop.com/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1d5946f8,0x7ffc1d594708,0x7ffc1d594718
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1188 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,13958975247894313429,4480544986494597311,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x424 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
67KB

MD5
ce58019b091dbdb1895be63d765b1177

SHA1
37a38458a92835c43b270069c0629c6975b2ba69

SHA256
8defb86fd585d1e578370bac22698f0de49d509d7398a0e83fbae7a9d11e0fcf

SHA512
36be843dd5630cf0c76219459b2ff946fa91ab90be31e3ac62452642a79a062b9d7aaae14a0ad8fd92b1a6d468394f1aa8bfe45f262f33e34048b46e046a1b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
20KB

MD5
e92faff58b6be9dba9bc283c4f4c8513

SHA1
49588273a413dffd248cd35dd191189ed2c2343c

SHA256
8c6c6736f4650f9bf7af6fe14128a3d173816f3dee2e02c5552240c04852b691

SHA512
52ddb77b600f519eed2343d528b9c9bc03585c82edaa91c63e8850d19be23c2f645bc8faea19c3d75ccffb30e4e69a3605883106fb1783346a8883465051643e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
31fa5d4e96953eb13031cad16818adde

SHA1
c403b1dfa55645700921cc07a2c508c93913c0c7

SHA256
567091282ab439800081530b3a6048529cfa93c16bd7e4e4612f4045e0f1460a

SHA512
b9c5b34e3be78f66a7f233c506ad5491b57d7ab53fa0f74ec4e11f706c0064c1db5e777d5f104ff1f1ad6cf06475b8cceeb61a019632bb10908f14ff7013ffca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7b410cb3bc2199d5f9984a6fd00e8c40

SHA1
75a17ee5e00783918604bbd76e6ec0fd40bbe181

SHA256
52548c3b4dc4dc466f40a0386b12e4866f953ff812ddd3d4987440729199e86a

SHA512
9938b23ad9bebff63853d59f184b2d4fc8994603296f16794be54ac1cde442a360d68266c17e06b70b2e17722739f9a6224ce7355d2e3efa528e4ff0d55d462f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
01c89c8be686819f119afeb3d4bd350c

SHA1
2b300130ad5c38f7289f3be516b6bd2b254dfb41

SHA256
fed69d36c4bad068ab1aafeb3158571f8e1fc27e38d9518ff9d931654aca0f76

SHA512
194c949fb04b181f1420f0faab1d626845e8ca13d9d9e5bf692fc6829b6f953edb8a60ab0057233cb5fd7a7d5111e03f7bbd7fafe5d678a5bef2c6ff2c04daa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
78e3daf68560d96a6417e7e54965fd11

SHA1
db8ebcf11b98697796d07c64991d8cf33be424d8

SHA256
7129c0c6696292863b9afea88c7ab4190fd20d71021c5556834932034e4c19d8

SHA512
b6914415d6740ac4d5abea274c1a8c700fff4b69857d33bfe4c38d48569ae709c0cd145db11c0be702bc135272a2ff48ee9a5b292f582a2ebae8baca062af98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a19f8cce6f55d0d8f5475d1c2dd61525

SHA1
e617430b73ce433cd12d5f1434d3b252288a2e19

SHA256
911de995c5fb7563d59afbaa27c52bcf6ea993df4c01de466d26281393043871

SHA512
d50d0298bc7eeac6a45c61697cce635cfabc5a11257179a2c08c9d87c53aeb9fa3a6cfe2c9013bc1a64dfa555b7774083affd576ef8cbc22c8bf2905b8ebc5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
79dd6271708389ee7cf0431495a1fba5

SHA1
7944da27244c191abcab87bfbe52ce908c60a4d6

SHA256
d7be9d97cd50303afa0eba7f759854aae5b23a2e5b09a91668edef1fbc8a781d

SHA512
ce06048937d0cb8dbbad931d4bc21c28a010e62680bf290aa0cb81ae4dd80085b035ec6a2fefc1aa2c3ab2f8cb4857e8e6d068a9279b229dcfa8892a6be12d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58125a.TMP

Filesize
538B

MD5
efee3bc97ec9563df1090963720eea2f

SHA1
3ab1bf55772398715b3004f5cd7d639e7d27d5a0

SHA256
1c0d149c8a3c46945a0a5126d6a7b0ab4a005ca0fc478133ffdb1e0ec98e2235

SHA512
166655d75bb3f496251606d92fa00b755bf9752a62eb3e900bcf67681b17dd33a2fb1d0214228fd9bd76ffe5fa174c9f6e1ed8cd1bb2356d533afc8e1ec85f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3250098-896e-4d82-aa28-c922159003c8.tmp

Filesize
10KB

MD5
ae365c67bc46cff1882a7de1363494eb

SHA1
d1ab45e7ea51af60a91b53c7d0c2cca2f25ad228

SHA256
b4be74b6ce3e1e14fc0bf15a4635f80613349b975cb02060476241ce6f957a85

SHA512
06b8117e2fa457e380b63712c5918128a49b1dd3242afb381b3baadcd31c2a89142a928406c5a745fd19ffa0fa97022ecb049511e8f010dfc1ed98f5d85ee458

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 166638.crdownload

Filesize
1.2MB

MD5
c9db6b5c84be13a43ad23cc204e4bc52

SHA1
94bd6634303205715fd04f8aa10d75158390e4d9

SHA256
77200156d4773175d341aad11ab23bd52445065cd95060348da17d083dc27688

SHA512
9273493c5e5ea24b2f5ee219fdf849546e85b3f5cc24c970f1ab6fdcfe961d96ca6fd41c96f9d915892ab24ce7ff409f0f5a6569b0225e95d36afba51615f8d6

Download Submit
\??\pipe\LOCAL\crashpad_4012_VWVAYFIGWELCHCEA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit