6883d387517418ff6b66ab38727625d95466731e96ff7dffdb11774725e58f7e

Analysis

max time kernel
476s
max time network
477s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
27-04-2024 22:08

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

$PLUGINSDIR/app/index.html
Size

20KB
MD5

c7b752acf6d1e10f3aca2c67b1ccf4d3
SHA1

ab793cb43e0c2b5af0fdcbf90d0d29d5d3e164f7
SHA256

69b9f99f6611f953d94984ac35bdaf9e9817f689e1e3614976bebe3465c613fc
SHA512

120addd79b7ade4f35b426c02631c8167d81080fde30a01b989453113f7547784e525d53bede41ede0c9b3caca8513060753ba51f75bf6936d32ee597d642576
SSDEEP

192:8sdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8D:+WNaM8UnbjPk89+mppHL

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

Processes:

UserOOBEBroker.exe

description	ioc	process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "78"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
1948	msedge.exe
1948	msedge.exe
2052	msedge.exe
2052	msedge.exe
4500	identity_helper.exe
4500	identity_helper.exe
3736	msedge.exe
3736	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid

4
4
4
4
4
664
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2052 msedge.exe
2052 msedge.exe
2052 msedge.exe
2052 msedge.exe
2052 msedge.exe
2052 msedge.exe

pid
4
4
4
4
4
664

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

OpenWith.exeLogonUI.exe

pid process

4140 OpenWith.exe
5052 LogonUI.exe

pid	process
4140	OpenWith.exe
5052	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2052 wrote to memory of 4396	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4396	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 4400	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1948	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1948	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe
PID 2052 wrote to memory of 1380	2052	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb2b643cb8,0x7ffb2b643cc8,0x7ffb2b643cd8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11323875367828804842,14093393189919908471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4488

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1412

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:4992

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2972

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2620

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:4508

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cb855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e498afe43878690d3c18fab2dd375a5

SHA1
b53f3ccbfe03a300e6b76a7c453bacb8ca9e13bd

SHA256
beb39e9a246495e9dd2971224d23c511b565a72a6f02315c9f9bf1dcfae7df78

SHA512
3bf8a2dd797e7f41377267ad26bde717b5b3839b835fe7b196e748fec775ffd39346dba154bb5d8bda4e6568133daaa7fefa3a0d2a05e035c7210bb3c60041a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8b53ef336be1e3589ad68ef93bbe3a7

SHA1
dec5c310225cab7d871fe036a6ed0e7fc323cf56

SHA256
fe5c2fb328310d7621d8f5af5af142c9ce10c80f127c4ab63171738ad34749e1

SHA512
a9081a5a909d9608adfc2177d304950b700b654e397cf648ed90ecac8ac44b860b2cf55a6d65e4dfa84ef79811543abf7cb7f6368fd3914e138dfdd7a9c09537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b611117384c497f7cc0410d6f3ff9af

SHA1
5a286a11170b5b8d84b3b5c2c76bca72411b3c9d

SHA256
b6e2a6fac627588afac8640dadff2f4364476684a0df367e9ceb0d338ac7c444

SHA512
903d15f04694af977be235a4d6656de75805d268245acf1a576cf8501df6c1c7089b22dc88fcbe3ff05ef1a29e97e1c8a57d139749fa6433cd8ddee518415b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
96d2a2bb5a422f2d9ee6adc08193168f

SHA1
b2d54e420abd9eac5e3f889a30806d0c1caec894

SHA256
55fe8a88f9e90a510ce2e91c8c58862a7b7fe87c3c8a170f6901dc5331903cd6

SHA512
00b1d2545317b7d00a37da62cb1258758fea263527870a373257be5ce3c6b98de762e14f39013ce55349191412fe483f35a7a4ebd831c6e27016c7f691868ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d64691e7fb7ab91bb0969d8973de77a0

SHA1
3df6c49985c2de529bc531d3f363cf5db5fd9c0b

SHA256
02bc87851d3d0e7f23c9f9262a2cf1591c2104e04176050cae554e72cae79d0d

SHA512
89ca96cbe2c385f9c0725b4189001d0b1b37e5b9b2551fce611a1d43f6686bd1f29832a34575675d7a52cce4b4eb38dd83c8c4f81c5e98fda27bcae7fc150708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b40e07e00936c0a2f69dc4d4f9ebdbf6

SHA1
79b7f3ad76ba9129d1ad49dc3033234e0cecdb7d

SHA256
162f22f38f23038f00b03e9841970e2b1aa68216e9d08134a6c39675deb83a8c

SHA512
c870a6806919f4e3fe722d42d118ec895d2244efb59515309326b856972ac11f7d93dcdd27b0e9099a60b22a7c742e83007638e39cd47020cced667f5350b4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2364bcd6c9e5477bd79f49014ef050c9

SHA1
f40de61ccda358900348f1faf557ee4aeffbc74f

SHA256
6631d297b133e8fbc8143c6bca4d9d6e52baad12e9561449088bac65083e0923

SHA512
fb01af7c46debaa174f29db23287786ce17433963f8574f6dc6bb386bd423918cad0a0584a355b203e0a3fceb53dbd20e5e5920b5d5e0e13e543b8eff84c9a19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a8e274a5c4ff657d05ddc5c473fcfabd

SHA1
b1201e41ce6d0c089a9caa3b2f0deb4d9d25b4c4

SHA256
2806e4eba2c2a86dca88eb9dc7c67d9d55d2d0a7e255c352ff5b86fc99175a2e

SHA512
609f607d987dd72190cea19a0ec904552d927940dd2ba9dda969a159364b3a5b37a4f2845239aa5c44df045d53203469135a6e4a00625721feff3b0d4aaecfca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-4-27.2214.4556.1.odl

Filesize
706B

MD5
52c26c36988ea0a6fa272eb47a875bab

SHA1
820708baf992c867208b3f47456af1e15d1bff89

SHA256
41cc0e75f46c8a141d4704c400d7bd83e65b568f68b7f9284e4ae52e242f58e7

SHA512
d34e98df603c27d89bb487dd93786aae5fc3694e9cbc351c1e5e679905f12e1372b6565f9d3b8f40eb5425b1204946cf5eb8199f46b7143945561a89947ad01e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-4-27.2214.4992.1.odl

Filesize
706B

MD5
b95443e321c51942b26f50479ccc7f22

SHA1
4dcbca786a425c77771f4954ee314e3e0566a303

SHA256
7f392d05f716841ab4a93026b2bfeb2c8fd4cd5e6fd21e549650f8c803e0400d

SHA512
d3d85b9621bd15422bd63ee492b9489306aa6d18652fb5df75d110dffeef30d3fa0f6fbb425ec01da8c8d921a33598131a1cd1f0b1d358186a50dd9f585183b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-4-27.2215.2620.1.odl

Filesize
706B

MD5
fc413e6c4bd729bc11902ba16be9df4c

SHA1
ed0e5ab57661596e737799aa22d11c361516e209

SHA256
9e66b2fe6d8925f35b992c4677ee44dbb549dd2b69ae3144cf260fc01afe35da

SHA512
7b7cdd711b6a1b8f35f4637f7a4d1ae9b22516da0039530330f64d87db27522efdf9148a1ee91604cf9343aafc6a694f2c86d83e272f7b3f725f87eeb23b3482

Download Submit
\??\pipe\LOCAL\crashpad_2052_CIZPMGJXPMMJMVWF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads