hxxps://go-link[.]ru/jz8wJ

Analysis

max time kernel
230s
max time network
231s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 16:47

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://go-link.ru/jz8wJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3964	msedge.exe
3964	msedge.exe
4004	msedge.exe
4004	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

msedge.exe

pid	process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

1360 LogonUI.exe

pid	process
1360	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4004 wrote to memory of 4168	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4168	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 2888	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 3964	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 3964	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe
PID 4004 wrote to memory of 4464	4004	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/jz8wJ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffd06d346f8,0x7ffd06d34708,0x7ffd06d34718
2⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
2⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:664

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
2⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
2⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
2⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
2⤵
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6016 /prefetch:8
2⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
2⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:1
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,10338006983060567430,17056427711444145126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6320 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa394b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1360

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
192B

MD5
610411e85c4e6c1d025612118b844e28

SHA1
c0246e9b173abcab78224c568a4e922a09c1ab51

SHA256
6e849ed8de1b0e2588372fc596b6470c81d4f5d541140dae42b74dcd78d9839e

SHA512
e6596dceff0a32e23ef2992cdd59b2d2495ad73c004359369cf2403e28eb191ab3e85d7c86686bbb03a7fe80c9469d7ec158ee56e905cf7debdacadd9d71ced9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
b797da06cf88fd227491eb0c4e6c210b

SHA1
8f4e6ef9af538cf5a73f379bcd1ff3f721839af9

SHA256
48a97541106d9bd09ffa2601ea7cc1fb8175279b651d2bc9576a41a8bde974c9

SHA512
565aa5f0260679dbeb2cb8f5afde8b273f416ef8addf5e532d0fd37bcb351d32801d1ed5d374bbf02f7a032802e184d6084c5a34b4a3d585b2077891d7b7b5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
789B

MD5
ba987aca86403c7ba3ff9ac54581c3c3

SHA1
5d1c5b393999208fb8c871bafed6026b723b5f19

SHA256
c517a2a463481e1179c41511493c91a04dd56afe3ad2f5ec30f6ad1312729226

SHA512
3030100dbc9d8904e02ba1f56c17fbe25e2627ecaba08b075e53a836563e4454342e08ec0736dd12f2aaebd5339ff31c92c7a7c23d300d403e806867553e0a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
869B

MD5
21299bc0f75c05bb2db83da48186b52a

SHA1
d2c7d4e0d434e277dc319503300fe363f12b024a

SHA256
7a1e54b4484887631be0434e6c0041da9762fcc4493dc26c22fb6422595bc65e

SHA512
9e60b0ee43ed9cc8bcdba8bccf17af65177ee872d6445f6e2db1c4c6de3ae52c9010630293d631140b08343369c86bab85f0a62ad8a0ace965862957be2734a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
aad7ca9e509ca4d3de75c8e3443958b9

SHA1
70e6f22e9dde0c2570b075c5a1be2031b126a296

SHA256
242ec712bc7bc212c38db58b01f59bfb152b01a32f41ddd322b5b3781e64e3a8

SHA512
0d4b516ba17afdb77b14f9590bb9edff2aa908d242808b6697f07dbd159a5c020166426493717ae065c2f8dea1837006481ec4f8b82d9b0d5f395bd3adb0c1cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
4e511a93ab39dd244968f43fe7c93725

SHA1
b6e931f57f1eaea630f98dee286566faa5022261

SHA256
313eae9c02322158d04a9f0656a29725e71b06b0bc94c3cdc3b3387189b28925

SHA512
6cae01d9c9cd46a38f3fae9152c544cea6e483325b7082227345f6d550d8d589019a19bcfda561748e664cead405a4a785e356268b322cdc35c9da20a64b93d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
621af8830d0d8686308bd3822f1ed3b6

SHA1
7b6612b2c22e4f920fbc97049ad51a4704de1285

SHA256
d4073f73d8274876a23c924c6b8d8b845633a1ce6456872e1eabfdcaa1980696

SHA512
e47723ad9327ab7bf319a4c9af531e1ad681c95850fd68921062ea992c0a7f5f483719e4ceafcc5fd4adc97e1c8aa3fddfa200644a72bbaa5051d8a684a241e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e3d1e1ffb9e60672b49691a4302f2620

SHA1
c60025a205ec0232b4e27d9cf1949637d630d245

SHA256
a6126539be3309d23203c1024998f0ee64e4ea39b89638e38884083e354ece58

SHA512
1fc00432a55e596c5d44908fabbb57ffcf1fd3ace40ca99f2d0b57c0c10fe4167e3c81f8af5ed23732bfbf5beb2f56ee0e5940b0ca8321958780963212c2f379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
459408548c6d94cf9c70a83b00e2b2df

SHA1
06482b58332db32acf86dca9cdd0b8ebca325cb7

SHA256
02500ab58098e025a1574b5733602ffd17c8161eb1f2e7f6786b8cd1c842ecd8

SHA512
20b0dc69711020de894d5740c0fb67b01d016959322863cb087c2b3b94255cd8950332fb79560c7b311f9cc405127861d352135eb47b202e9acd188caa4a4c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6ca64cb1e15245c63c61bcfd5a4edda0

SHA1
d4c3ba6f054afd78d94b407d58e322d208b18839

SHA256
68e3889e4ab41bba19ac03a49b8f22ad4bf46ffab70dc4c44440f609fae4d625

SHA512
f704758b76cd1845992d5b426a0dbac5daf5f71d114e6d2e0a8d6502faaf48dd79638d78c6be52f4d8ea5f517d94ddfd1df58a628a6ef6807352d51b8648d1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9ac67b1975cfd7b236c6430f52a7873b

SHA1
1234ecbf11835ba7b02c19c54215ebcf4e9a6054

SHA256
59b6a894a8a5ff943eccb804a8c73c701a8744162f51c4d3d42c3b4ce7d67ba0

SHA512
dc7e86977fc65f495f6738052e6d24329e8666e8091e2b94643af6a6d016ea03104edb8f1afb7199ae6c3ac6b09eebf4c13c98afd46ba5f742bce3233bb1a27f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4638c335c295e6e47dc7bc5efa2f3ff9

SHA1
95be593591e8bda317415a11afbda8e8dd4cb8e5

SHA256
8adccd42dbd3550b289bf173b806b707419b9950601b8b155a0996aa6e0afda2

SHA512
7f3252d044260d94f54896691098a30397b85db46d7c6b92252c03ec6c220babc58f04b77199bf98c6c57c20c2e9886205f390707fcc339c5a9223ee2030c916

Download Submit
\??\pipe\LOCAL\crashpad_4004_ITWGTXTDEPIIJXYH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads