xloader | 4603e9b4de577e9a750d57694f79b502c0eacb9c154bc0a874a39056727a27e1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCC_PO001070322.exe
Size

831KB
MD5

3fcf09742679131c0e4a202b27503a5b
SHA1

89a9926ffa6e44f4a38ea5a6f5ea768d29be0715
SHA256

2710360c68d0074ff1ec1eae99a680106bd6076b2602ad94025bdeb5b2779da0
SHA512

3342ec3a1a80872937d3d71145ad8f0e4d830f6dca69890c985081fb9b876319637c7a0cc63d7db2bbe9e3dc038385482171b483ce64f61527367755b8eb2f3b
SSDEEP

12288:Z/xpFtK4DZFUswOeoQeuNNZz0PytzIx3GPvibvUWORFkS41a6EAmD:9vFtKKZcvo0z/9Ix2XibvlTa6

Score

10^/10

xloader yig8 discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

yig8

Decoy

lifecallingbootcamp.com

atlantamobilethaibodywork.com

pear-works.com

ffmagic.com

thenewivhubboston.com

bemusedwsettr.top

beausoutdoors.net

tminus-10.com

pinnacle-legal-services.com

maralgroups.com

easywhiff.com

dentalimplantspracticesbcan.com

monokrom.art

fadak-njf.com

eco1tnpasumo5.xyz

gites-cougousse.com

pittsburgheyecare.com

acami.art

highlow-bnr.info

azienda-agricola-stellino.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4008-35-0x0000000000400000-0x000000000043A000-memory.dmp	xloader
behavioral2/memory/4008-38-0x0000000000400000-0x000000000043A000-memory.dmp	xloader
behavioral2/memory/2496-50-0x00000000007D0000-0x00000000007F9000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 4008	2032	DCC_PO001070322.exe	90
PID 4008 set thread context of 3532	4008	dpapimig.exe	56
PID 2496 set thread context of 3532	2496	netsh.exe	56

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCC_PO001070322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dpapimig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe
4984	msedge.exe
4984	msedge.exe
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe
784	msedge.exe
784	msedge.exe
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe
4008	dpapimig.exe
4008	dpapimig.exe
4008	dpapimig.exe
4008	dpapimig.exe
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
4988	identity_helper.exe
4988	identity_helper.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe
2496	netsh.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4008	dpapimig.exe
4008	dpapimig.exe
4008	dpapimig.exe
2496	netsh.exe
2496	netsh.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	DCC_PO001070322.exe
Token: SeDebugPrivilege	4008	dpapimig.exe
Token: SeShutdownPrivilege	3532	Explorer.EXE
Token: SeCreatePagefilePrivilege	3532	Explorer.EXE
Token: SeShutdownPrivilege	3532	Explorer.EXE
Token: SeCreatePagefilePrivilege	3532	Explorer.EXE
Token: SeShutdownPrivilege	3532	Explorer.EXE
Token: SeCreatePagefilePrivilege	3532	Explorer.EXE
Token: SeDebugPrivilege	2496	netsh.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	DCC_PO001070322.exe
2032	DCC_PO001070322.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 784	2032	DCC_PO001070322.exe	82
PID 2032 wrote to memory of 784	2032	DCC_PO001070322.exe	82
PID 784 wrote to memory of 4304	784	msedge.exe	83
PID 784 wrote to memory of 4304	784	msedge.exe	83
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4940	784	msedge.exe	84
PID 784 wrote to memory of 4984	784	msedge.exe	85
PID 784 wrote to memory of 4984	784	msedge.exe	85
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86
PID 784 wrote to memory of 1496	784	msedge.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532
- C:\Users\Admin\AppData\Local\Temp\DCC_PO001070322.exe
  "C:\Users\Admin\AppData\Local\Temp\DCC_PO001070322.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yip.su/2VBBt6
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfcd946f8,0x7ffcfcd94708,0x7ffcfcd94718
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,14790708585413884164,3573732681500556460,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:816
- - C:\Windows\SysWOW64\srdelayed.exe
    "C:\Windows\SysWOW64\srdelayed.exe"
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\dpapimig.exe
    "C:\Windows\SysWOW64\dpapimig.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4008
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\dpapimig.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5598bc55-36ad-4ac1-b6ef-0e7de6239d91.tmp

Filesize
706B

MD5
156498b46416bd0019cf1ee1eba7779e

SHA1
78e942a2d70a92253687c20a7a409d50be839a1a

SHA256
e2088e143211d8f9948b52b13072bd527d5cfe4e3fd662184386b4942fa9146b

SHA512
8cf5152ccbd5981c32ba51890311d954145f85abe0b5cf3d695c75864151920fcde757c5d8c15c41b784cf280e0808928414ad26e3f968dc276edc2cf5860539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
e558e36fd6e4bbcd0c60f741dab4eb77

SHA1
8e935fc9900e517a084787610dd4d4051067383b

SHA256
1d2435f5e30c7a90c305174fe19fd1b5674f1244c100f96116452decee40527e

SHA512
cafb297b5137e2aef3cdc9be8a1fd37c329c4b326a18fea599866dd4366e7382af04307bdfdcedd1f16fd4fb9c9985b3b5afac00fcd9d12e019eb297267b0374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0d5d22bb44ce3916922ce9110b3403af

SHA1
da33524d96b1a996432a6fbb26fe9115295bcb39

SHA256
4a7975d6e74bf5803ecf858e27255c3b0102a6f93bd1ada12aa787378d335add

SHA512
4f5994e780e2d75944bb5b87b72405bdff8f7669397e68b7fd1a6ccf64a4f0b957afeaf69250d0d6eaab76fad7f0a7ce3b82079b3c2b560406d729bafdcfd510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3739f7b77d4d95738c930e01e0d8e5d1

SHA1
da33f88ac80b3116dbb6fdd8b9e3b613e67e8ae6

SHA256
16de7c025c8e87873b88f4fdf3100b37d4a1ffbf71a316cd6055e49bbfe5429c

SHA512
ec17637a09a77d0d4793b8debc27ead2fa868bb1cbfade66e625f870befb3414f73244247dd1d51c6cc3984d2bfda29699b4cce9a8394822b0f8518190908bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ad35a2283ff859169929f5569957f9f

SHA1
5508893d624c31fe9485cc52e59d7ebce5051629

SHA256
c74302512ace6e5613ce7d3fececa2e0d2062e9970e9663187db95c92a0a1a69

SHA512
7032c4c940afbb1022a0e4b2b42c71ec77be44f62bb6e9fb9772bf6359a3b1a8f3dd9ecf53fdfcce05ffa724b05e79d47860b9be39fac005e4164a9c4ed93f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1cf8ffe0fd91898bae6368282a786196

SHA1
327e26c82c95afcd8bd9f358be3c872d638693ea

SHA256
6003c3e4c67e0b6d0c66d579879b707cc6a4efc541223e028c1cd56d7747b6c2

SHA512
30fdeb0a8f0110979c4d803f02379f71c23964e72315ec04ccdf14bff48ed951701e51083c1bf2d5af67e05660285b001bfb62e408a8f6f78ca483f8e2051b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
981f45d45476464a16842398a21a9487

SHA1
e7bd00491f633fbcbe5e08e22fea632a8f138c57

SHA256
e2d1cd72e41fb6f7281048447f9573160e78e3ab503f9c71d363aadaaaefa3de

SHA512
4dd9f6c0d58c74e2a04b60eeaf39d4c4d1dfd29935ae0c5056c429c3a52523e7546413584b335b6ab5b3280ebbb7bffb1dcec821213303425c6c510da5c9a8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
221205abf37a8eb0dac75e978f7be087

SHA1
ab91e37ef99714847d0d49072605c6b65f6a54ca

SHA256
11620d1524e25467d15cbf9d52123596960e25263ad3c1b73dc01feaefa9d4d3

SHA512
151fbeacb050798e571ff300d25283a3ab3d53c2cc20ecc783592dc607b4375f667e94c210c16323cd9fd886243887a28b07252abfb3e4c827b77d3b7841317e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b70.TMP

Filesize
539B

MD5
3342921fc61074ab23a73e5decaec8e8

SHA1
4b5c895d6a5d2f0afa2915e7534528d34d085430

SHA256
58ce1740553d9d9b18e64ea7c1b06cc90aba9a54b64824eb9760a062d6b3a10b

SHA512
8cd4b42a9d02cf2a9b0c80a7a26650e7a847e2fa6e0d59a1a001f4049428d4bcb7daf56b65cf17572bb4708db0a71bfddbffeb4dc7f506d1d602bbb7758522df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ab81c283ea2775c9d133fd440319f588

SHA1
422bec8b3fd8080fed42338f63926980d8c3deb3

SHA256
39b135001bb360c31b7b6356d5ba0b52ccdba16ab396687e75522b64309d9500

SHA512
796794c484f1c77c6c87a13855d9249b01a86a372a79aa47e58f00f2ba28e5dfe81ab8745f7ae7dc65b51bbfecc30393fc05f9f9b296d43e37c2eb0b8b9e5b99

Download Submit
memory/2032-10-0x0000000074A70000-0x0000000075220000-memory.dmp

Filesize
7.7MB

Download
memory/2032-7-0x00000000050C0000-0x0000000005116000-memory.dmp

Filesize
344KB

Download
memory/2032-1-0x0000000000310000-0x00000000003E6000-memory.dmp

Filesize
856KB

Download
memory/2032-2-0x0000000004DD0000-0x0000000004E6C000-memory.dmp

Filesize
624KB

Download
memory/2032-3-0x0000000005420000-0x00000000059C4000-memory.dmp

Filesize
5.6MB

Download
memory/2032-4-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Filesize
584KB

Download
memory/2032-5-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Filesize
40KB

Download
memory/2032-43-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

Filesize
4KB

Download
memory/2032-44-0x0000000074A70000-0x0000000075220000-memory.dmp

Filesize
7.7MB

Download
memory/2032-46-0x000000006ED45000-0x000000006ED46000-memory.dmp

Filesize
4KB

Download
memory/2032-47-0x0000000074A70000-0x0000000075220000-memory.dmp

Filesize
7.7MB

Download
memory/2032-13-0x0000000008800000-0x000000000882C000-memory.dmp

Filesize
176KB

Download
memory/2032-6-0x0000000074A70000-0x0000000075220000-memory.dmp

Filesize
7.7MB

Download
memory/2032-8-0x0000000074A70000-0x0000000075220000-memory.dmp

Filesize
7.7MB

Download
memory/2032-12-0x0000000007EB0000-0x0000000007F6C000-memory.dmp

Filesize
752KB

Download
memory/2032-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

Filesize
4KB

Download
memory/2032-9-0x0000000074A70000-0x0000000075220000-memory.dmp

Filesize
7.7MB

Download
memory/2496-50-0x00000000007D0000-0x00000000007F9000-memory.dmp

Filesize
164KB

Download
memory/2496-49-0x0000000001200000-0x000000000121E000-memory.dmp

Filesize
120KB

Download
memory/2496-48-0x0000000001200000-0x000000000121E000-memory.dmp

Filesize
120KB

Download
memory/3532-137-0x0000000008730000-0x000000000884F000-memory.dmp

Filesize
1.1MB

Download
memory/3532-40-0x0000000009020000-0x00000000091A9000-memory.dmp

Filesize
1.5MB

Download
memory/4008-38-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4008-39-0x0000000001380000-0x0000000001391000-memory.dmp

Filesize
68KB

Download
memory/4008-36-0x0000000001470000-0x00000000017BA000-memory.dmp

Filesize
3.3MB

Download
memory/4008-35-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download