hxxps://go-link[.]ru/jd5VZ

Analysis

max time kernel
148s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
08-03-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go-link.ru/jd5VZ

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exeDiagnosticsHub.StandardCollector.Service.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DiagnosticsHub.StandardCollector.Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = e008fbe87171da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = f05c85a53f71da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0d95b97b3f71da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b8bb8da63f71da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b22b527c3f71da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = eab1c0843f71da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ec4d748c3f71da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6dcb117c3f71da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exe

pid process

4788 DiagnosticsHub.StandardCollector.Service.exe
4788 DiagnosticsHub.StandardCollector.Service.exe
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

2124 MicrosoftEdgeCP.exe
2124 MicrosoftEdgeCP.exe
2124 MicrosoftEdgeCP.exe
2124 MicrosoftEdgeCP.exe
2124 MicrosoftEdgeCP.exe
2124 MicrosoftEdgeCP.exe

pid	process
4788	DiagnosticsHub.StandardCollector.Service.exe
4788	DiagnosticsHub.StandardCollector.Service.exe

pid	process
2124	MicrosoftEdgeCP.exe
2124	MicrosoftEdgeCP.exe
2124	MicrosoftEdgeCP.exe
2124	MicrosoftEdgeCP.exe
2124	MicrosoftEdgeCP.exe
2124	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeDiagnosticsHub.StandardCollector.Service.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	3320	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3320	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3320	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3320	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	784	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	784	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	784	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	824	MicrosoftEdgeCP.exe
Token: SeSystemProfilePrivilege	4788	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

4660 firefox.exe
4660 firefox.exe
4660 firefox.exe
4660 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

4660 firefox.exe
4660 firefox.exe
4660 firefox.exe

pid	process
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

pid	process
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exe

pid	process
800	MicrosoftEdge.exe
2124	MicrosoftEdgeCP.exe
3320	MicrosoftEdgeCP.exe
2124	MicrosoftEdgeCP.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MicrosoftEdgeCP.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2124 wrote to memory of 784	2124	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 1964 wrote to memory of 4660	1964	firefox.exe	firefox.exe
PID 4660 wrote to memory of 4756	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 4756	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe
PID 4660 wrote to memory of 2872	4660	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://go-link.ru/jd5VZ"
1⤵
PID:5072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:800

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.0.461575624\1779914197" -parentBuildID 20221007134813 -prefsHandle 1692 -prefMapHandle 1660 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e36dd41c-8d98-4ac9-99ad-a73acf5064d6} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 1792 1d3cfcf6a58 gpu
3⤵
PID:4756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.1.1567407865\902238322" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7202bb51-17bc-4299-98ae-59d30824adb2} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 2180 1d3cfbf9558 socket
3⤵
PID:2872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.2.770216259\626929637" -childID 1 -isForBrowser -prefsHandle 2804 -prefMapHandle 2740 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36f6f4a1-8519-4cfd-9182-f67ddb2555ca} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 2776 1d3cfc62c58 tab
3⤵
PID:2592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.3.1261549753\1461607201" -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3536 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92897cf1-494c-4f1f-9b26-f89910fe98fa} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 3552 1d3c4c68758 tab
3⤵
PID:4532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.4.1183629759\915190974" -childID 3 -isForBrowser -prefsHandle 4320 -prefMapHandle 4316 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5783c764-c0a5-483c-bf8e-6fbc5d164e59} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4180 1d3d5e9e858 tab
3⤵
PID:5372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.5.1112491105\107880547" -childID 4 -isForBrowser -prefsHandle 4876 -prefMapHandle 4908 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {981d1c9d-69cc-490d-8e95-6a3a0f98f37a} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4868 1d3c4c2ff58 tab
3⤵
PID:5792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.6.191960660\1322884162" -childID 5 -isForBrowser -prefsHandle 4748 -prefMapHandle 4732 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e65d32d1-f1fb-4cd3-b516-078e5a821f5b} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4660 1d3d61edb58 tab
3⤵
PID:5800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.7.431421586\222059933" -childID 6 -isForBrowser -prefsHandle 5164 -prefMapHandle 5168 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a38c8f7-071e-45fe-a5dd-dabce45427a7} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 5156 1d3d61ee758 tab
3⤵
PID:5808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.8.1192969956\1742640067" -childID 7 -isForBrowser -prefsHandle 5512 -prefMapHandle 5520 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {feeb4768-0beb-4b5d-bce3-705f6812b7ec} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 5524 1d3d2651158 tab
3⤵
PID:5432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U2DI4E2V\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3OOAVUGH\CommonMerged[1]
Filesize
320KB

MD5
33c5999f7460abdd7a49a8f39f3b5010

SHA1
f161b934b2b9e1fd385172079d919cbc1379034c

SHA256
e0b98837000a4b0e7b5a9ff4459505a3a3f79b9ead29baf9e5968f8861d0c019

SHA512
f332c94265b806c8a4cb4e07eb3a2a759e40f3664f714cefe618c3e3c45490c7dbd40cc2bcaa220b1ca31de2d860c353e2092fc9f3330c1f7b04df8c6a39b815

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3OOAVUGH\jquery.min[1].js
Filesize
86KB

MD5
220afd743d9e9643852e31a135a9f3ae

SHA1
88523924351bac0b5d560fe0c5781e2556e7693d

SHA256
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

SHA512
6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\J49V34V0\isDebugBuild[1]
Filesize
126B

MD5
db73f776d86f34f1b1a868fcd913ba0b

SHA1
e523e3ae23da5e659ad0cc60f65ef42765c5fce9

SHA256
f9d7461b859197d4bb01a9f6bda6b8644fe19da7098a2abbe4cabeb6068b05d3

SHA512
0d3f12acb10d570dfa0c026fdbeb8fc4fcafbd41d38667ea4dd911fb7be3e5b2f3c52e27057ed7fde7c5a41935ab19a9b29f32fd005a108bd95234370516e820

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\J49V34V0\plugin.f12[2]
Filesize
64KB

MD5
0467313b4dc3f33c9836b8ad4d2d4a03

SHA1
e700e09be085bcbdf980e4a51b9a202b748e0726

SHA256
84cc9273b2dcbb303753566e5d574d825f267fb549111beb3ca1ec37787763fb

SHA512
6c08282d3aca247f1258a54d0baf92672d20905951d96e057d48f957418edd068e5c8bfd44d3066bbb694709c360bbbcc6c596db2450d75ba566b007a20a2ef4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6QXU7D2\controls[2]
Filesize
21KB

MD5
a4a318511d80be37665e73ec973b81e1

SHA1
920d4c59429eaed48793adf1b2a022f02845dfae

SHA256
487bd289a6ab1696dd8a4131e450cc750705ccca1a8c2ccd72877ccd1bb64ba2

SHA512
7ff0ec31a5286633b7c76dda03437c61f1f8ef792e46a600443c6c8ed2a717540ded82f3b4bd10d34a4f13a912e12afb07d221d4150e7ff4e761945e0ec95afa

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6QXU7D2\jquery-ui[1].js
Filesize
458KB

MD5
c811575fd210af968e09caa681917b9b

SHA1
0bf0ff43044448711b33453388c3a24d99e6cc9c

SHA256
d2f0522008bff05c6434e48ac8f11f7464331436a4d5d96a14a058a81a75c82e

SHA512
d2234d9e8dcc96bca55fafb83bb327f87c29ae8433fc296c48be3ef8c9a21a0a4305e14823e75416951eecd6221f56fbbb8c89d44b244a27be7b6bea310f2fd1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\F12\network\settings.json
Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
36b220c808e0c940f593df9a2be1fee5

SHA1
dd6da25632c4c78919288d3ba4f4713dd48a7b7e

SHA256
f8f2186951980e4a4b5044796990e51bb06a9b0114b56c8d721d1ad1de188481

SHA512
25938c15d4788f665c4293082dda80aaa63cd394478d43e5f24a67077dbf1fa55b2b01c20636213dfc0f5592ba10ec1061164c777768d3de847536cebb39e428

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\datareporting\glean\pending_pings\62215045-eac0-4fee-a7e7-5da86a6da23b
Filesize
746B

MD5
250be3406084d481b9883b51a4f1b980

SHA1
aaa7893b0afcf5e5b867d7222e8a73c9fff60257

SHA256
1d44c544dcc3be74fc1ef4379777a8b703fed138e52a44f5763d74d2bae4078d

SHA512
f101070e9de086386570b20849f8cf9ebf4a3a93245a5535e6e8b40e7dbd757cfc94ca1dc1c6a4d638923bd557003e225f8ed0209116ad4b2a5f545c604772a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\datareporting\glean\pending_pings\b2db6209-cf86-43c8-8eb6-4c075bc3595d
Filesize
10KB

MD5
41bb120631c1ddebcceb2cb65e250d66

SHA1
ea846887cbf857bbfed73d10da52fa8964a960e1

SHA256
ff99b4fd31feb798ab1cac6524c5875419b898c2b3fa77ca0c8730e36132600e

SHA512
beaee1e13bc48923bfd123e8b2ea54df9873929a5f1146eead6da3706bbb8a92548754ae117afcd67d11a0649b5220a5a81d4d5172aaf2daf2dfbc62f52fbcb1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs-1.js
Filesize
6KB

MD5
4e6c79acbdc82296768a99d25564de41

SHA1
133d2e9213ed0303355af41d63cc68cfc594d159

SHA256
390c8c9ae693765ff08e6c3a0c5b7efeef9ebdbe39126510a5949b86a981dfbe

SHA512
e709ffcd0c581ca95d9c3430754ff8f60f5c8258be2dad4fb3f175692ddab2a246d445396700be2221a69b5e10b0642e5be1dfc13c6c147f25b434365ddbb6e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs-1.js
Filesize
6KB

MD5
921d6f1adf185bd2677716575ace2c5b

SHA1
36ff69d6b478eb08213a2e244189446f331acce6

SHA256
e65b933183958646048ec77d048d110b80a3581072711bf7d2bb9fb44c7ea681

SHA512
38bed3b4a7e3016bfc9bd849545af18276e2ef45bc22e50f1b574fd7f5f87a2f3c0f2bf1766efdf5c9c42254be4e8e6c1f98f8b116a0ac5ee28ec0ed5302976c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs-1.js
Filesize
6KB

MD5
bd3a22b21ca85f43e04044b8ef77a769

SHA1
e80e3cd2487b4032abed225a4b4dd520569f0ec1

SHA256
feb28df32c4ac163bfc3327144d0b141c09585e8fc6b4ca07588e3e66140698c

SHA512
64f66314884e530a1aa2cee62d75cf2af1df6ed47ffaa650d2979f3c819e0498dabda2ebb10c53cafc3418b142ad880a9c887289373bb19eeeecbc64fbef5a0f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs.js
Filesize
6KB

MD5
0d04c3bed2f893b92743229c956f5402

SHA1
7f52ecb9b203e9a654be5960e58935a5ee21b3e4

SHA256
a8689892cf5aa1b9c764a2da7168747d7b3bb82e314a048cbd2fff724dceb95b

SHA512
678de900aec3f0383c4137998b0617d4383831156dcabeb12a14cf4c2ed6106d6a6e37f4cdc28dd230722391dae114088c126448057b5192026de1cf02069349

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
9b957509a602e78f8c779e8d3b46b97b

SHA1
badd9ce30d5ada712ff4ef48504a77d911b7602d

SHA256
3391a81db3beb85691853b6bcd10245744b44a952ac43b110c453cd8f901357c

SHA512
3497f7d180a683a0b4a383e6dfd3431bf07e1e5fb8651639cb1fe5564e4f265579d867a28332b8b6b52a1e1ab347c9e7a1e694e6d6fe3af859f0164144091439

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
30c2e91091fd3b73eaba9f0586c6d7f5

SHA1
d9cc14091e78675a6f241de4fa79d9d81c36c86c

SHA256
f7b5427b1d26bb24b0b7d1a595dafd456aa32773a68f03ab629464c987292726

SHA512
d69524e40dcf84999a081ea4b1a2d55ab505bac101a66522fbf4ce31fa466baab0952428a83fd3be5f915d771a7bb25059b5b5ad1dd9b4cb0b806a161c50dd17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
44a9472c62a4ac7224fefae433561f0f

SHA1
48d2f064e93ec5c7b9d24e8ec90fdc40757e6799

SHA256
7637ce75e87c49ee67d15b9270e01e8f004fceaf08def55eef0415597d666ee2

SHA512
1b8e52e40fc12cba99bf3697df4979e6e88a5c0647726663f2bc9af7d66af92f5c0fafa1b2cc6ff72d196234380c1652ae23d2fac485816aa96a7a86c2daea01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
6baea7fe4a15637a77d1281c46c0d490

SHA1
bc0483dbb283c05e5b0c8bfb3b797e29628ebba7

SHA256
030509bbf2aeb46a409eafeeb4d99808ae8a53ee3a017707c065c68e2f3cc315

SHA512
04923c859eaddb61df9c81fbfd009272c9960a1729005baf99f0480f6592d8d149094494fd2c093a1c45b3634ab13af8220c210853e6aacbe6616b5ab57dffe1

Download Submit
memory/784-143-0x00000202493C0000-0x00000202493C2000-memory.dmp

Filesize
8KB

Download
memory/784-131-0x00000202491E0000-0x00000202491E2000-memory.dmp

Filesize
8KB

Download
memory/784-58-0x0000020236870000-0x0000020236872000-memory.dmp

Filesize
8KB

Download
memory/784-66-0x00000202368F0000-0x00000202368F2000-memory.dmp

Filesize
8KB

Download
memory/784-334-0x00000202474A0000-0x00000202474C0000-memory.dmp

Filesize
128KB

Download
memory/784-68-0x0000020236CC0000-0x0000020236CC2000-memory.dmp

Filesize
8KB

Download
memory/784-238-0x0000020247FB0000-0x0000020247FB2000-memory.dmp

Filesize
8KB

Download
memory/784-130-0x0000020248740000-0x0000020248760000-memory.dmp

Filesize
128KB

Download
memory/784-240-0x0000020247FC0000-0x0000020247FC2000-memory.dmp

Filesize
8KB

Download
memory/784-136-0x0000020249580000-0x0000020249582000-memory.dmp

Filesize
8KB

Download
memory/784-187-0x000002024A370000-0x000002024A372000-memory.dmp

Filesize
8KB

Download
memory/784-162-0x0000020249490000-0x0000020249492000-memory.dmp

Filesize
8KB

Download
memory/784-159-0x0000020249470000-0x0000020249472000-memory.dmp

Filesize
8KB

Download
memory/784-139-0x0000020249370000-0x0000020249372000-memory.dmp

Filesize
8KB

Download
memory/784-146-0x00000202493E0000-0x00000202493E2000-memory.dmp

Filesize
8KB

Download
memory/784-155-0x0000020249460000-0x0000020249462000-memory.dmp

Filesize
8KB

Download
memory/784-152-0x0000020249450000-0x0000020249452000-memory.dmp

Filesize
8KB

Download
memory/784-148-0x0000020249440000-0x0000020249442000-memory.dmp

Filesize
8KB

Download
memory/800-0-0x000001D247A20000-0x000001D247A30000-memory.dmp

Filesize
64KB

Download
memory/800-35-0x000001D248BF0000-0x000001D248BF2000-memory.dmp

Filesize
8KB

Download
memory/800-16-0x000001D248200000-0x000001D248210000-memory.dmp

Filesize
64KB

Download
memory/824-517-0x000002C6FD300000-0x000002C6FD400000-memory.dmp

Filesize
1024KB

Download
memory/824-507-0x000002C6FC300000-0x000002C6FC400000-memory.dmp

Filesize
1024KB

Download
memory/824-431-0x000002C6E9320000-0x000002C6E9420000-memory.dmp

Filesize
1024KB

Download
memory/824-422-0x000002C6E8450000-0x000002C6E8550000-memory.dmp

Filesize
1024KB

Download
memory/824-386-0x000002C6E85D0000-0x000002C6E85F0000-memory.dmp

Filesize
128KB

Download
memory/824-353-0x000002C6E51C0000-0x000002C6E51E0000-memory.dmp

Filesize
128KB

Download
memory/824-297-0x000002C6D4640000-0x000002C6D4740000-memory.dmp

Filesize
1024KB

Download
memory/824-276-0x000002C6C32A0000-0x000002C6C33A0000-memory.dmp

Filesize
1024KB

Download