hxxps://steamcommunijty[.]com/gift/6388299377

Analysis

max time kernel
81s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 18:10

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://steamcommunijty.com/gift/6388299377

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "94"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1790404759-2178872477-2616469472-1000\{526BF3AD-E8EB-401D-960B-DBFB79027F52}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

1608 msedge.exe
1608 msedge.exe
4976 msedge.exe
4976 msedge.exe
640 identity_helper.exe
640 identity_helper.exe
4424 msedge.exe
4424 msedge.exe

pid	process
1608	msedge.exe
1608	msedge.exe
4976	msedge.exe
4976	msedge.exe
640	identity_helper.exe
640	identity_helper.exe
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

2760 LogonUI.exe

pid	process
2760	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4976 wrote to memory of 1556	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1556	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 632	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1608	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1608	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2020	4976	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunijty.com/gift/6388299377
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb621946f8,0x7ffb62194708,0x7ffb62194718
2⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
2⤵
PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
2⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
2⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
2⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
2⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
2⤵
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
2⤵
PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
2⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
2⤵
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5488 /prefetch:8
2⤵
PID:656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3160 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
2⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17591268482995641365,6165684692937467246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
2⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa394e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Filesize
115KB

MD5
ce6bda6643b662a41b9fb570bdf72f83

SHA1
87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8

SHA256
0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6

SHA512
8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f
Filesize
31KB

MD5
f11ea88996343792763ca879be59da5a

SHA1
b83d41c5d1cf5d4d0f6f12c420871dbd7a7b2909

SHA256
60e4d15c3c8833b2733dedccfdf2eb38025be0078c3ee4bf2d439aa166362548

SHA512
bd330b3d4d8009ea02c1846a4cd9de78e49fd0cf888819edffc40f1e2eba903f8441055c1abbf29ffd066417cb53956074ec350c2d1cd550f097446f1d45f24a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020
Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022
Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023
Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024
Filesize
1.1MB

MD5
d307ce6ce114ea2d363c2e709df6f9c3

SHA1
e8173b7467489dbcc7fa23bd6dc2557a70624ac6

SHA256
ddc9046c4d6ff62e0859e12f84c4c2e7e154fbbb230dd415a788e132dba831df

SHA512
6e10b866683259c13aa5f956d50450866bf1e9f6401edbfaf9cc1388a1b6d83fb27f92fdfb3fd01de431dfd6c967f1e6c253f776ba2d3e87268fb88ac908be11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
a1c639cc9fa2047ee1fb496b6f7fef22

SHA1
6f3d625cff3db675826f3dd84e0f5a626eb3a6ba

SHA256
95c06d39335ce31ef4ef936bb48064934ce9ddd1852b6ebf82c89549dbf8a1e5

SHA512
fed484a012c4a7e8b7e0068dfa094a2c11aa5a4f87acf13dc2921b143360b284505e8ad380c45a245e5766f9f9ccda97dcdf23452fc30da09af0746aa4e6bbf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
528B

MD5
709e3103e90f589744818509d3c5a89e

SHA1
19785c0a8721dfe6affea2279db8035fe23d02ab

SHA256
7a3bc5bc73711c7cf2b40ce54a462c5c52c79111e165ddd18479f1b250770023

SHA512
a5deec5cdc09e991376f43f6d21349ade92d37439f39a0cf36797c7c3ed7fe2362d7a81ae3202b0b076f031ac3013065b6c58a657a6ea2793a18ac2b9e4168ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
4d29523b3fc930c4d48c79c115849437

SHA1
91e784d592ac38d08b88c1a3a9e1dec2e79b2f20

SHA256
d2775ec59088832d50d4d6775373e95dc2adfe7a0a57a8ef22ba1f6f388597fd

SHA512
b16af11932a04f0abe59aaf41062c9f0a4285c041ff22682cf267b88377ecd7edbb2e45708a4ec7e2e012450400a497f72fef960299f215fa8ab4ef57db0a1bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1fe7fe473e5e74a187366748be271ae7

SHA1
18e65f96c5d0cace84ff45b02d76b6e5ae933ec6

SHA256
6bbfe7fff5b52497b6d6cd22d2562d1d1431afec171c94c02119c8828a7ce82d

SHA512
8b2eda52e1ece9a131b81da35a7d50c51c0021593ef94e07fcb53da38c773904465c2769b56dfa24c6cd005f41dd1b0eb730c849037e3ad984c35c0a62e47782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bdc53b1ec7a3037dc7fbf7b004bd8d2c

SHA1
61242efe10b4ce2af1b897fd4f502922b508f200

SHA256
66f43bb06cfa38bbb517ae01838f7fc8b00f55de23e9dcd2bdbacda0ec613d67

SHA512
58369163f98fff923d1ebe12c1c91c1ef108f12abea1feabab61ba417292b2bb9e6aae9fbf62db578061beb1526da835a58021032e3a0d143a08cb469628a0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
e6d0f8976c4163fbb7ce75dd8706032d

SHA1
2c22dbf810fa7637e1c0296d5b8858b62148b97f

SHA256
0527b9db1a1c08b695f1d0616e5ce28de052813f5188e539edba5d00505a3532

SHA512
b419b8487914a8911f657ae7da38a9d04b6c711c70aa06cd1c93e5ed599ae375d2c2d42c5e9c42af6e0c1f9cd4d8c51b45dc70d10bdac2a3be516b8dac431d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
dd59bb2358295829e14d3e2d0449f5c4

SHA1
03a4e79cd0bc2497ba92f51206176507098b7255

SHA256
d6ff436dbb39f89012a121692b2f3debf47ce9c8ed5fe5aa6b0c178f79fe54df

SHA512
90bf620fce6868e5b59eb41a94261e8c8a699cf7cd649e7a386561c7f6d73740b06337d5729095b44feb99e2f72d68f27858783dfd1d3f7cd628d25b2bbf93a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
79d8389dd4dce6cb34c9fc2fde03ba57

SHA1
effc22b8337c1ff8a762a82d71fea6ccef31d697

SHA256
db11299bd2c7c1e73684cf409e925b42d100c1285cddfc38284d78a2163d4c46

SHA512
101c0804c8a059d4319570f0bdf6a3042ecfa898abc693791f5c57804f1de618b118f415e975cbecc00451d375d94864ff2760383d325dfd403405ef2b78f873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a50e2c5d75f410abc522d11096a6c960

SHA1
6b890cfacef8b8eef517e48b7452117d29e97b3f

SHA256
65d261aa5682a9d5f0277b10bc03ee712f7ba8e1bdb4f7c600356ce66183e1f1

SHA512
2db8ffb40a3f3a771215f62c86dad118c9b3838a8508b7bb5393757374ae7a3f6827ce37f16bb9999fde4aac8ed0328e0639a56b47bc9bdeb879e63da1eaa64a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
4c8d379040142c6fc2b4bb15588c5796

SHA1
c4023128d7b67f896f765e114951b97e97b32647

SHA256
1bf0435beaa881adc9b27fd8e7b85d8d8333f5bda18cd5351180228f03045213

SHA512
653f6f96b0827c900a8a230c8f97256cd7e7d406b834e822d62d3180617a92d10eb2c34e02dace0c8556c95fc2c99ae3fbe57e127778f20bcb5c8ec28564436f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
eb0b4a9f32a4fbd32a73f348bc584ccd

SHA1
d8f5e929bcb9968066bf9942bb6ed398d0d0228f

SHA256
f576abb71967bbe0f9f7a59531d86f51770f34831fc90ff8effdd12bb7bed19b

SHA512
9a113278e367637f24c0a7e9357ba5eb59046c59fd711b23ab7f9b0f0de3c73d4719b986ec59d177b9a831c028e293a5e5f28c448178a1902f22357c60a3a8ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58215e.TMP
Filesize
540B

MD5
31bcb0feed223b37a2f7448b58d6d84f

SHA1
264e4263c5989d138c5d798b4eaa836f6b2d9fdd

SHA256
b7efabe7fb57897181532e890dc6187baa247dbdc806f98bb29c33cc158edafd

SHA512
6329c18301fca5db4279cf6e6c901d2874c5bbf96450abc54184531e995e396a1a902b35363c257454964ab8cb76340ed97b0bf48fadac3bc8b0a2b989a74a99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a362d57162c3d1d8e069600d6dc57493

SHA1
b0cfccb6f7d3f5a1b5cab110db6ba27e7ecc90ea

SHA256
77abc491a6781b0aab39fb76f539373d41da93f300516c9275b1906703f49e86

SHA512
dd80eed17c6a8f5e05e0582c53a3ed0b995618f9889d6ce90a57020b22cf13b64f292f7dc2b40cae0dc7723ee47c980820337037d6e26f3f27845b60df2aca27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
5655590df3330d1aca41a0010a4629b1

SHA1
5897e1a2c1a4591ba33ba461198bcafedf58695d

SHA256
d38beba0c606f2850b14d75ac5406589bf56475a86602988dfe698a6d8b3242c

SHA512
7dab9b6807f5f283dbf486f4393a3bd08a3a5128c3b9cf46800f3fac108623b128945ffbb5c61bc8caedf8d16bde24d7949bbaec6a80028554d786db359111a4

Download Submit
\??\pipe\LOCAL\crashpad_4976_DDSLXZBCFMJVCEII
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads