hxxps://drive[.]google[.]com/uc?export=download&id=1aDQ93KLASV-LqhzplcipjdT_mpeYyKZJ

Analysis

max time kernel
0s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2024, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?export=download&id=1aDQ93KLASV-LqhzplcipjdT_mpeYyKZJ

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
97	api.ipify.org
98	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 4088	1100	msedge.exe	83
PID 1100 wrote to memory of 4088	1100	msedge.exe	83
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 3868	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	85
PID 1100 wrote to memory of 2324	1100	msedge.exe	85
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86
PID 1100 wrote to memory of 2876	1100	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/uc?export=download&id=1aDQ93KLASV-LqhzplcipjdT_mpeYyKZJ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1fc146f8,0x7ffa1fc14708,0x7ffa1fc14718
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6160 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17951420352720481727,14864959353038933990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1252 /prefetch:1
  2⤵
  PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
953d1613222d8040cecd1a6ca05fe1ce

SHA1
1ffa097d3738d8983dbee9263be0d26cbc90e328

SHA256
0b8b09a4194c39bdd214183f49aab039e7b6f86c5e2e5bd3c331937047c60acf

SHA512
c0646de82779f39cb3352c9ccb4f958e845ac34caca4ee3df11d31aedbeca8c3275db4988606a18440c003110e0a1e3a1b74d73f80061715e9cefcec0da66308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ebe6f8cacc3e468759dda4da26416fc0

SHA1
2bcd4266d8f43384e816792592943fd371e6f0cc

SHA256
677f945b8a10a480b0fa29fed0bdb98c1429bb843593027d0caad2ce2c36ca27

SHA512
05c0bf5be24a9c0524106ea021e220b5383423e7d7370e40caeb5acc6e1ca5e772cabb1dc503a420c50f363be83e0c426f6e348ebe21b45233d5876ff41cee48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
67386f19484c79e70096a61653543d8b

SHA1
de02f96ce7d090a3378b609aa3699140c1897c89

SHA256
f28ad08a9f2c4cf5023e6a042632d12694d6c17685fa4e62f98674f77853d1cc

SHA512
f38c12759954a95aeaa7ab3df79ca54f48d4ab6876dbe4da387c801ad25615c6a200e988353b1ffaf6c0a6b173474a0621d1db726e2fb2a2c9097f245ec432d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
872B

MD5
fbe8ed74498b78dd58553dfd0b6f9dda

SHA1
838a8eb85c994cffc33b96e0f9a06d4341805045

SHA256
8048667514b2966cbe4500751d968f01e2075e24de1f66c876a614303f9e25c2

SHA512
e9582722d5082ae93ff370a7fb04c702bd7514405eb8af52fc9b02d0f4004f13f70f72fb55d223b4e6cd9da46e38bb766ce7c75fa96750dbc9e459ac374bdb32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
18a699ab917bf9940215d8e1757efb5b

SHA1
093ffa8e1003297ad5ee01c6ac7a54b829299742

SHA256
5852624eaae536f9cbbaf54c1f392ed3b7b409b4eef45386721e6ff121ff4066

SHA512
a2561936b90ce42ad846c1c1542b684020278450f786ff6254ccd5391d9dd3a43c958e2c0c971bb7298ba91af7e4cec3fbb0a230b484c970f7ce5ce3b4a7c4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83172d21368701fd18c552de3ac69152

SHA1
84c552a61dbfb40f834fca3b1c62ef02ae55b501

SHA256
1e02dd64931ee1da6e898103910977d5eae89b80f6914a77052996ad0f15c46c

SHA512
214718f7aca5ce92a3901eb01cd8d63e3676122b02a2d77e51f7761286131744a0990a3f652196f60fbd1f7c56b5a2a511a1eb833dfebf6ecaa5b267149f67b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19b3b390a75b1167dda45de03591a4b0

SHA1
647403aefe81eea8fe4050ffb3f04b7e7ecf87a5

SHA256
809e19a039bc88cb9b94f9ae4367a68157b7e2cfc1b690beaf655acd7d22889e

SHA512
841171f21c50efdd9a1acaf02743435841d5d147a6acfd20244f589a264945f052db50612e930f89d9999a996905f2d1c929031457c6eeecba3fc147b13467f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8536de5eb783ad82a96f2ee128b915cf

SHA1
0906ccb3d79d80f58258e9c3bb5553a6a587b6c4

SHA256
81a26460a923affd76c2430833554ed954afadf3576c931d065d0a9588df63e5

SHA512
3eb8354f3754211add4d0ae579b4013c73a25b89b79fdd69fe41b26ece1e69d457ebf1c22dd693ee02a6180dc24b1b3250041b49428fc9d35abf0853cbcb698b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7428ce6285359f8c52f887da7e92f3aa

SHA1
1fae00303b77b410400c174bdab9a5270565bc80

SHA256
39e286a4345788a592630a7ea781bef91e6351f212dfe7003545c2ddc8c6d755

SHA512
a20ba508854537d3e6546e2f65350521d3d354b21e9486bde7d886b061593b4c0f4368ad6800a688e1caf6fcc724b24495b0a45fa2164e730fe2595470e76db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
400a41e1aff38e2f9284ae6cecd3631b

SHA1
a953f01dbd52a49d8ad29253881713b9189fa16e

SHA256
d91c4107868bc8949cecff09338b8901e8ca5c8fb741c167b2fde21a9535e504

SHA512
669dd85a1eb893c2e0a4d8b2a2815d57ab44fe6c47496c0be9a196525d8f5dc032091c462058d80409a16d085cf356828b58d242a3d136226660d236537add6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
602148f24ff8aabf578f5db6ea686f6b

SHA1
33956d0bd3a1498be323488ef2522f1a6613a9b2

SHA256
ca0a62e0e80b7a200ce0a8b1d6bd0741b253887ab049af4b6f2ca859b5eade77

SHA512
14a296794003ff5197d0e04cc827bed9908fc052f1413c3f5f49155f1e98249b172c3e809338dcaf862af18b760ff0a7e265fee31d04b70fe3f25f7e7dbc361f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
c01922e1675d1ace99ee4a06a7675497

SHA1
2cb8f54b2f9500adbe147193e3326258dace8adf

SHA256
f772156e9c0de0a28c5b65de151a4865089a9f04c67e5353181a195a8d063942

SHA512
88b3c3150774b7e6d70e5c471dcb8af5e0a01eea4cdf4ff4098605e3096f7e1756e5f6a61ebf1ab04a4d5aecaf04df475b3191328cacc8fa6ee8f72664becf45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
094c895c7d735806e97f4936cf44136c

SHA1
6360197e334968e8cdd5b0aa3b5a25c185035034

SHA256
aa4ada7dacc30655e146d2698f074f5aa40b10b3ec8037db516766eb439a8abc

SHA512
2e3ef1f6fd2358954d843df46c0a4db7a7d3a3745c15739f1456b517fd1915cee18bc68383b3b21e622b2341fc9caa0051733464853f069e5a6f59abdbf7b0ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1248456097986bbacedb9dfc1eaa0deb

SHA1
351503713efa564e5d013aa957e6f4481c18009d

SHA256
0ba3bc1cbdf97f829021d44427a76a898b73b9a9fd0a32d5531f3acc7da5aabc

SHA512
d61c23408b365dc1428ebaf0697e5e9c6902ff605868661ad59c4d7d96d593e18005a6e67008c8f91bef615c6c1ea0382583d15ab6eaad12b0f32bca57946e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6b25f02b8fcb12dcb07146026f479e22

SHA1
ab4291bb0000562365759eb4d879947d1f744810

SHA256
80d32d63b8b5167985fba0e901da56d0d374d33ddff0f0b6f867fefa1870c2c7

SHA512
dfd92e7f1954331835d209269919ce0a8cdbf8d37991433820cee61427dbef1c8f45f557bb845c8aedce998bc2f945d17b821e7484a3d94182e12af69fafb774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e995.TMP

Filesize
371B

MD5
605c2f2a9cf1f7e437a1550f77f3e949

SHA1
3cd87caa4f0ca6eb22da5f56000bd8ee2ecb62a1

SHA256
4008080506e577109b0f9076db47b92efe767839d14f49548570df132762be62

SHA512
6fdd0cbbfc7cb89afda114fdbea2b30eec0cb242dd0f684b3f0da87060f884a40dbc90eb6a39b472c5516e9f18ab2f60ad28b7980b94d905c95ce821425bf725

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
50fd2563a03e91ef14de4db1066cc35e

SHA1
7af314dd5e993976ca3c7ccd0bcaa0c5f4487e27

SHA256
79473d02712dce34a0dbb25872b99d5ad55c3b7ff180a7281c199f58d411fb4b

SHA512
c1316c867a447de9dafd80f9bc7f68589b0b19872e2c1da7057384ed735a8ef05355c9108e10a293ce79b8c0c5b4d6cc3954f7ec07547c53fc614f66fda3aa92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit