d5395f121277d2b38f4173c7df0a20a3de99edfcfe2aa697080cc81170eb76ab

Resubmissions

09/03/2025, 01:58

250309-cdv29swybs 10

08/03/2025, 06:55

250308-hp35xatjt9 10

08/03/2025, 04:53

250308-fh1ebssky5 10

Analysis

max time kernel
149s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
08/03/2025, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

My-Skidded-malwares-main/RaM KilLEr 1.0.bat
Size

3KB
MD5

ce45f129d128fb1ce6e659451fc8ae48
SHA1

44cccb5515797e51e51498a73d02e66f086f0040
SHA256

7660ba2fc3dddcdc079e20771f4f0b1fde0c1b508f32edda841993ace2f08c40
SHA512

23af808c2a413b7932668ec5d2163611e310e6d837839b0c8f96a1467c4122c702be99dfb45dbae780a026cac9a38b989b95b80f391ee9eb5d8f54044490b886

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3311003694"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31166462"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
4296	msedge.exe
4296	msedge.exe
1388	identity_helper.exe
1388	identity_helper.exe
5932	msedge.exe
5932	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 720	3312	cmd.exe	82
PID 3312 wrote to memory of 720	3312	cmd.exe	82
PID 720 wrote to memory of 4296	720	iexplore.exe	85
PID 720 wrote to memory of 4296	720	iexplore.exe	85
PID 4296 wrote to memory of 2936	4296	msedge.exe	86
PID 4296 wrote to memory of 2936	4296	msedge.exe	86
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1596	4296	msedge.exe	87
PID 4296 wrote to memory of 1392	4296	msedge.exe	88
PID 4296 wrote to memory of 1392	4296	msedge.exe	88
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89
PID 4296 wrote to memory of 5692	4296	msedge.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\RaM KilLEr 1.0.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://go.microsoft.com/fwlink/p/?LinkId=255141"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc5283cb8,0x7ffcc5283cc8,0x7ffcc5283cd8
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3256 /prefetch:8
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3256 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10706812479486666502,13604433839072841327,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4868 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25d7facb86265ce3e89835dd7b566491

SHA1
4db1197fadadd7742986efdc2ca76f89cef96942

SHA256
3d225a00da389fde7674a7eeb98e8572be2879252290ac00faa3a80ea671073f

SHA512
cbfc02ffc441edc20c72b35d20b15178a2173e2a1c54e3736f7ba6d058e1ac7a5c1b15798bf5b91ed3a8197430f0fe84aa3d75a8aba61b4f4dd85c1b3fe68bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ab6627d6da0724908361604b2b351b7

SHA1
d6e7960616dd38cd05633face9bb0bdd061e3211

SHA256
88a373cea6d7ad2daaee9168a0519f8a23ab9ec9cbceab97df4c8d39fe1544d0

SHA512
59903d7dd6da68cb4378eceb6e356d5861514b8365da747da4cd05615ec7c7a51c810cbac6a7a00256db1aeedad80ef71b6ff06bae61e1884e620cc4a45a2d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
21KB

MD5
447010f435f82c615472dde70d6243ef

SHA1
4bc82b5b84cd1c63150db5dc88c2a3432d43605a

SHA256
5c36ff118a22f22a889c6ce86befe61933a281c9a3673bdf65098ca7fd94d8ba

SHA512
8f96264c7505bcf423ab22af5787a87d90c3446b64f2408304ace112c11668a877beb476cd5aeb828e59cddf59acd18ae768a80b17832ace36b77223bf6b1812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c

Filesize
27KB

MD5
57a3566e40bf2c3929966768089e34ca

SHA1
ba57e913fae3142fe2312641052f93c151c6c0d8

SHA256
e865c7413dd4e584413390541b0c469088628f150d0ba4934ea4263001b4cc12

SHA512
d987509264ace0aafac665439af86443b0af30d2bc0f020b477298702c8c61c0485cd2142a4e10a039d720220f68a11c1edb8987821e30c2bac5ebde9192f4f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
92d246cc1097540cc7e09128f1c63d13

SHA1
f1e2410be379d0ba75ee5579b61dfb92ddf73836

SHA256
cc8551d9d3d653ab0d0682d2819b3696e29f1ee1d55502a1d6e5769b74f803e4

SHA512
8b23cd153fbe4a73968cdc8f22abbb50ffa7137d689a959a05b649f13ceef767b11cc1832008a679d37223b751866c6a203a919759bf99a0514dc84eeb47b096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9ed4740861b41c3cf814823af60b1368

SHA1
74df6be5d7a3cb48ba08abf45706f989fa0500e2

SHA256
d679c47d6a5e24530516a47120949b3eb04000e938ac22b58837e26dcbc75fb4

SHA512
3c84017992f60dcaffe44ae71894770f0116bdbffaafb35fe84a325e1c4d7bec306601c70a5c505cf92a929dd0e5b99e2957fafb3dd6f27ecef9c7f99942755b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f3e64069a57f414da3befa43384a11d3

SHA1
765cdd2c3a6effdb42874324f98729954b6b7642

SHA256
3398f87f088284ea4ca60b0feb7612ea5a029c81a090a2f296653d003e17f52f

SHA512
ab0eec409ed16cee198bb1c44820d8cd7b86b77741994290ad41a4dc7f19435f23a889d85bede299e2c88baff56b63f4680b438a960bb6401ab28b8b161941a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f3d72a6fc2695d43c481adbae0dd9ddb

SHA1
d0f3b96828d9bf2ade0b25a9161e2554461ccfdc

SHA256
da384e78c5d17f62c97dc9c8baf701c32476a57eec9cbc6d847f91a55aa27ba5

SHA512
5abe19af49477d58cef02c82c5741d92e76edb57b911b1ea2e126ac73fb23fdd1ca9d85bf07817460dede815d4e27c87403ad4e3b29bda5cd08047c62a3ac83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8814e20cfa2b86c3000f745a4d4c8de3

SHA1
7f9d5c05dddd2608ff2757c27e4fb04c45d6efb7

SHA256
91f4fbff0387fd0994fc0efadc7c3e293358605cbff179189b093f437b5b6b64

SHA512
14fe734fa423f68554803087bace92ca252af4707fd834b78a85fd36fa0fe384bb4bc52b9de6bd6d5912014bca151094e4b6baaa52b9384275d74b199c3585bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\14283093-7970-44bf-a3f8-35d8d08dbff6\index-dir\the-real-index

Filesize
9KB

MD5
7ac5c604d70b4d2d10d0a71cf0b63133

SHA1
02146ba31118319139fca1a843300e803fd960fa

SHA256
b2da0cbb98505984f3ec2b3fcf4636d41ab712a5bfc06e31a161ddc3ad064198

SHA512
bb733b78bca798461a0f4381c50cab2b99b731539eda7f8e50ab6a611aeb6825ec19b86571995e95cb2ea14bf4684088aef04b178a9503cb6305305b166d1e95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\14283093-7970-44bf-a3f8-35d8d08dbff6\index-dir\the-real-index~RFe5860d8.TMP

Filesize
48B

MD5
48cc268d2fc39854635288403d21f0ec

SHA1
2faedd1f674990320eb20cb2c3f71a8af59b279d

SHA256
7a9cb1fff3fa1f286e15f565d43c2f286872b6d00b5d6498b98b0122ff816088

SHA512
522f1bfb32c5fbe79e2fb58bf6fa9b88ee11b59195890e085765dc006ce8874337a7d9e35b9a3287771493551b060a67ee9025fba3cc38b56713dd02be174e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
89B

MD5
fd12044b1ec6ad2bd8ca6643cd7e45f2

SHA1
746533e4884b05e9e62710c4ab583c46ef338acb

SHA256
376b5e4344196e26bca993d6fa6f8e12d80eb288b07747174331144130094bbe

SHA512
627e95bfa3df12e3401c5e34e68ce9b673be9e1985c6a6f3a4bc48f579c3c061da51395b9ebb2b2c5a6f7a8a8d230029d76aa1b6a3112fceb8d2e89032d9c7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
3b1722023af092aa87d09b93b16873f6

SHA1
c6cf57e6811a7a94371df6b447f1322ffc81b26d

SHA256
cd72cc879c34bec58f2c92d4152d8ac1313b280e9f0c54f0520a558f8d894873

SHA512
8af5fcf492e34d95110baca9b5811bf83952b8f4750ce0ead9704ae1fd008665c536291d5b9598a53116568bcc08c1fd95612539c71c61e0536616182de3ad6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b6c746a636f30b282d3c839dad23b391

SHA1
eb47a63fbf599c1b24d3b33492e1ea94a2e83865

SHA256
8946015f172af67b0c94d1af6f4b3af8bbaf25b355a82f43a68ff6c61a3dfb67

SHA512
a6d86cd56ea88a0211fd8506a1ca0bf9a2d309ab1fae1f62b073104c82653f5f6c33e9d9b648edd235795a5f4ee19fbcd18235bf774635f1caae72739ef5a506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5818f2.TMP

Filesize
48B

MD5
d3fd3fdf7870dafc3d4659b3b35debdd

SHA1
92d4116f83b993490fcca69727f5ab4b4ad8fce7

SHA256
29bc91ca36beec78618e93489f5605fffb7b4178971e04cce645160e27f78391

SHA512
9eea51b18ac18d24cfc0fc47469db1cf1d7d57c878d744adefb7827577498fb9486befac19f3810deccedaf2d381cf9e8bac63dec564cd246df1d01d72286f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5459741b581f5ef92830b2106cc16a3e

SHA1
778cbcf27d5a4e3eb441d141fd04da91e1e9cca9

SHA256
b4a805f68187cd2b6ba16e3ea9dd0943b75046f72e2063c146a314c1d876b0af

SHA512
47c35568602346bcff700dc53d26b2db7e752ee0d7cb8b4417734009af5e63d3ce2b814b162c7af61c873908d6e5fc263cf7ac36bedb0aa81f43796504498740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9cf38fd6731c03bd1cb85136269a585e

SHA1
a17d126c70710c8dbd80d2b50b02d3b65e9c3c79

SHA256
76dc8376f26804b6e796151cf02f307b90c6ca414ec09cfc5c5c421ceb902857

SHA512
23fd38f6bb875a2a05d8ae3b13b0c3965b4cb97dbd353085ae480f57fceedcdc5f6b5fd95660f52776858000d9210d366194f035e15c978fd3a2e7c4f737fc51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
44c95c8e85465d1e922b09e06cef886e

SHA1
53bacdc1a8acc1bcd3a419bd2b4313ebd3ad9928

SHA256
418db43774bdc8486e10d8ae8bb9256ca47ef701d95d55e79c106e715bae9287

SHA512
48cf2a2e4087cc03659eef433a9496df7f67944c61cdb446e33850433ce4f3bd0519afa3fd3353c008b9d6017eddf7afc27d9b82f1fd89330008ea26a9cfdbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
29a937ea7abf1f2249da7240def98de6

SHA1
d3b22ed0774f18bda6d8bb35e2c377cb971fd6fe

SHA256
92b7cac21beb98bfa2346d431aa79f073db201b79d248b1f18dfd240cc85774e

SHA512
10ba5d6daafb2fae6098abc8b91ef597befe8cfdd70461bf226165f67c623739830acb432d1a4eef1c39b0fdd637cb0e3dbdec68a1190fa114c526d2f148fa8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823bf.TMP

Filesize
1KB

MD5
882d72f3c39f08e7b526e504b858e445

SHA1
605701aeb63ed4ee813ba8391c9ca9f10321cdf1

SHA256
87cdbe6d57a45b060a17255c73dd296d98431df4adcb7c32a5d346364edbc387

SHA512
6d9c31ce3c50a7d577f8c55ab5bfeb2618af045a2471b9b5dc9e2329987e6e2a6ff0aa0ec5859c2dad7cfdd9c80497f37064c442f32c3df3eb391b0622a7c960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
81a12ca6d6df875aa946320beccdead7

SHA1
eaf79925e017e940981f0e5e9401931ea2f11667

SHA256
1e68ed5c4356b74502e7f4af3a71097b3f4c5ee098d5d5989f8589af915c2699

SHA512
12f67174de830451e2e749e8da011ee0eaef65204d48deced478c4d94c7d81404758169ae023582f4ba84ada63f623b919e336296cdb41f4313739457f28de67

Download Submit