hxxp://youareanidiot[.]com

Resubmissions

08/06/2024, 17:14

240608-vrz79adf711

08/06/2024, 17:08

08/06/2024, 17:07

08/06/2024, 17:06

08/06/2024, 17:05

08/06/2024, 17:03

Analysis

max time kernel
104s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://youareanidiot.com
Sample240608-vrz79adf71

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3107365284-1576850094-161165143-1000\{FA80499F-DE6B-429F-B83C-B156DCBFFAFB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
4880	msedge.exe
4880	msedge.exe
1760	msedge.exe
1760	msedge.exe
2760	identity_helper.exe
2760	identity_helper.exe
2436	msedge.exe
2436	msedge.exe
1072	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1240	4880	msedge.exe	77
PID 4880 wrote to memory of 1240	4880	msedge.exe	77
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 1576	4880	msedge.exe	78
PID 4880 wrote to memory of 712	4880	msedge.exe	79
PID 4880 wrote to memory of 712	4880	msedge.exe	79
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80
PID 4880 wrote to memory of 332	4880	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://youareanidiot.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb4403cb8,0x7ffdb4403cc8,0x7ffdb4403cd8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1880,3852794275852680558,8927420522660505285,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell wininit
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- - C:\Windows\system32\wininit.exe
    "C:\Windows\system32\wininit.exe"
    3⤵
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e
MD5 6876cbd342d4d6b236f44f52c50f780f
SHA1 a215cf6a499bfb67a3266d211844ec4c82128d83
SHA512 dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800
MD5 c1c7e2f451eb3836d23007799bc21d5f
SHA1 11a25f6055210aa7f99d77346b0d4f1dc123ce79
SHA512 2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34
MD5 SHA1 SHA512

Submit Download

46cdcceb-467c-4416-8677-2654159211a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46cdcceb-467c-4416-8677-2654159211a7.tmp
Size 5KB
SHA256 318522b240a6802ca5715f3316da8a6313dce42f13336942bdf9b5eb74d3a820
MD5 f28061eabaa00d271b04d18f4710c24b
SHA1 615eb0f8c7ac6c813aff28c4832c02521ea65c51
SHA512 00e8de14e787bf32183732205b2f4d970652dbeef9685492945ce582232f054af868b290499eb406c9709ad9dd107cea5b94a476dcdc3348e1c2938be2434012
SSDEEP 96:nwk3O3Ww0kevywSv0MoiVmdHINJt0WQyV+VuziX3wI3:nwk3+Ww0ke6v0MAIXtLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 69KB
SHA256 0cda72f2d9b6f196897f58d5de1fe1b43424ce55701eac625e591a0fd4ce7486
MD5 aac57f6f587f163486628b8860aa3637
SHA1 b1b51e14672caae2361f0e2c54b72d1107cfce54
SHA512 0622796aab85764434e30cbe78b4e80e129443744dd13bc376f7a124ed04863c86bb1dcd5222bb1814f6599accbd45c9ee2b983da6c461b68670ae59141a6c1a
SSDEEP 1536:O76uwIZe9NVY6Nj/5StV8Zd3CcQWfeVmNk9nfNJxJIsAuB+U2:O7Dw2eLF5StKZgc5feYNk9TrB+l
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 41KB
SHA256 5ba906d58895a7581b28b218990561b2d704c29fc217901ad9c8dd1827737efd
MD5 0c674dc729b4561e1aea051f2a692e13
SHA1 7bc5e3868ed1d2b8f880417bbaac338b21b2d7c7
SHA512 82e29f4cf1c2fa2cc70babb8a0c05ed92dcd703f3b4b84e19985785e0db0ddddb1a9c7cdceaaef4c317d3541968fc3ce4cd50394371eef5760b0845c53b28d55
SSDEEP 768:5qnl5oaKdY18ncSqB66WNM2FR2zAbh0QI6p0zfO7ZUeS1U7kSGb908Q7aHnt:4boaKk8nKMM9EFpsfOq1U7kF4GN
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 19KB
SHA256 381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
MD5 76a3f1e9a452564e0f8dce6c0ee111e8
SHA1 11c3d925cbc1a52d53584fd8606f8f713aa59114
SHA512 a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274
SSDEEP 384:OdEDMO3OT070pXDaeGj7ZDghRm9nyj4uIttWEDh2dvFBbUDfgAU:OiDM8OTE0pTal3Bg+9n2pItt7d2dLbgy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 1.2MB
SHA256 41b601617afa569c0a42d592341bdbc062b2480bc61f6ab89d85c43c1b2987ac
MD5 b48e876e91ec89fbaaef68677fac8058
SHA1 90d1ec84f062ed577f423c44dc8bf04bde44d514
SHA512 2d07f78ffdb9ed12e560c9ebf64fdccc4ddf89b7866d28f5c8ccb862ddd56977d2aed1e82158f6f7f444664b4417e96a7923994c51052acc8ca1d6739f7ab5d4
SSDEEP 24576:ArwK5o7bQsfjSP9ppy2jUIF+udAjBxN9Qbp0sjEb3YT903FCoF3D:Arzov/e3py2jUAdAVmbpIbWc9Fz
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2cec7b65ba2c748e3aa44baf9d958827ea1269ee9ae5b740c73d521235d98b42
MD5 8830651e3067b63d2871374d6213b045
SHA1 248a4418d2c595e1df2d3b0c352533bf7e2851a6
SHA512 47ebd7f60fb22a5b74195834c297300f52b888f50a256d6291412f069d4cbec86d0c244da82e70d5d864050795d1f85e7d1fb5da9dc42f7d747a67b623aedf5c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 3c483197110aa97ae8d23d4deaf9bd1895617081e9dbf6e6c391f01a4dc77692
MD5 3dca901186f445c194dcaf05d0d06281
SHA1 fef19b0488f741a51f476bb9858c63ff453953e6
SHA512 c000a8b3a487b017cfe4d010612a891459f19667b247d7236e6edd3242c073fa5cd258d8ebbaf8e23dbf6e5a1ac9e0bfc248e81d84be1501c605db074c281f57
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b13a2f8f02b16376105b0a5f3096799db204db77641cfac232fa1f1bc69f2289
MD5 065b6e95a2a49742abb1efe70e96aae1
SHA1 dd907749dd15436bb432b750544da1faf70e8036
SHA512 3300f2d8621838dc1880a007cdea4f74d8787bf3a3f6fe9c207efec79c0ff60ee44a8957222e5bd11697a896ec98a305fed61d056f8053ead8f724d3a67886da
SSDEEP 192:nwk3qWw0kb6Xs0MSUqu2iui4ZA52I5rLe93:nweq50kn0Xq4o5rC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ea0bfcf00699a11fe6499d4d64b383984bc95e8019c95a4ae4f1b70b7b4f4a9e
MD5 ad2776a7afc7efbcf0cf4e3aa80e1c24
SHA1 9162582e1e8a1e3efd5dccb4ccbd4c35eadd8b88
SHA512 ff9e79d3c595546046a2e7294b4b74d0fe9e22b22ab9f945d4ced71ea9e15e8b6084630b501f16491865083d0430a9eb2bcdef311d5decd4ce4a0f9a9a925f1b
SSDEEP 96:nwk3C3Ww0kevywSv0MoiSRqR5md7u21rAIvw2ItJt0WQyV+VuAiX3wI3:nwk3CWw0ke6v0MSUqu2ZA52I3tLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 255aa5f96f2bf2ad14a1a10cf6405627993c3eeecdd690e5f32ea7cf49137373
MD5 7c54e4d20f4941f370e514b817c72998
SHA1 e384566b392918237e99bfd47f014fc6909ac7c5
SHA512 2d3cf285a63740a9085da594421f9f12bdafdb8571b51db28c9274e28ade4453bdab3304f61ec86d99f8215931e0bbe4472a25f48431c24b273386bbc3ed8b1f
SSDEEP 192:nwk3MWw0kO6Mm0MSUqu2iui4ZA52IstLe93:nweM50kz0Xq4ostC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4c2c790a832669ef520b874e5ba01374d8dbc5b9189e08fbdd95ac4fcbaa538e
MD5 fc6d3ec6479529dd926be155272e4785
SHA1 a6657e0b9405077fc76ac477742f8f6e07d92963
SHA512 4a846b8b7f59e9635186ebaca72dd9a4890bebf2129c16bb1e06869189aed511875a450164c27a65ff68477d1335f7451fdd8c9b176573367d51f621a2dc5efe
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGZsOse2RUkQSOyUm7YvmljEWR:M9iIxuERzA83h09RZxASGFydQIUm7YkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ef5dc1a64bcbaa5169dd04003758849be482bc43a5e8160e9bbc7252c239469f
MD5 06178607aa95c3664b4be43e8d36dc9f
SHA1 a1c748b27087548ffe7d077f9deab2d1f54c275f
SHA512 20ebf5235f157860df6c6f62285f25fb52da7379c1a13947c25fa29b4acda77bf3834cb9ef9b136c631627ee10257b807540e7e58d4c3283e3906eee7d7f5809
SSDEEP 192:doCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGZsOse2RU71SOyUc7YvmljEWR:R9iIxuERzA83h09RZxASGFyA1IUc7YkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 766cb96ac9e16c177525cd5bfd9f8bb1c706b6bfcef5f19f77a8de33ae1f7c33
MD5 f705a113bdd663972d4cae99518e1b8b
SHA1 c5ba3fa2afbecbf71b792ca0125b2d68ff57f78c
SHA512 244cd3da4d7ffe0841e950ea71d6bef7423ccfa8969648ea825b8ae7a73b3e109b5cc8a84e48852851247f504e2529e3e677ab6b76c9a08afcde0064464b7832
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3nOse2RUkQSOyBI7YvmljEW5jX:M9iIxuERzA83h09RZxA3OydQIBI7Yk9N
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xp3smq0p.0df.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xp3smq0p.0df.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1072-565-0x0000024DBB730000-0x0000024DBB752000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads