31746c1bed3adcf3eaf1f1f2684bf1287e3d5f48a4d4c93087a48dd328907364

Resubmissions

11/06/2024, 06:02

240611-grrn8axeqj1

11/06/2024, 05:59

240611-gpv9maxanc7

11/06/2024, 05:56

240611-gm684sxakf8

11/06/2024, 05:53

240611-glfd1awhqf8

Analysis

max time kernel
102s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Скачать CS 1.6 Skrudgemode — Сборка КС 1.6 для ХНС.html
Size 20KB
Sample240611-grrn8axeqj
SHA256 31746c1bed3adcf3eaf1f1f2684bf1287e3d5f48a4d4c93087a48dd328907364
MD5 e53d19ec9c66845784ebe0963e8d9c0b
SHA1 d845d2acb3f32ddbe57183042b9f24e735464602
SHA512 0b573f6bb353bc4b235b624dc1fdf43f5afa05e00c32b5d1020f50b0e19804c5b66f493cd70dd588db7e675ea3c9fc11e3b661ad2a07d7877dcb257aaedfd5b5
SSDEEP 192:LDQKgBWpJ/GjRSSSSSHI9T0m8c5IMbiEOBR8TztVwJBm9UZ8U:3hlp+SSSSSHI9T7R+BRG5KJmU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
432	msedge.exe
432	msedge.exe
1408	identity_helper.exe
1408	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3100	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3184	432	msedge.exe	81
PID 432 wrote to memory of 3184	432	msedge.exe	81
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 3024	432	msedge.exe	82
PID 432 wrote to memory of 4800	432	msedge.exe	83
PID 432 wrote to memory of 4800	432	msedge.exe	83
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84
PID 432 wrote to memory of 1576	432	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Скачать CS 1.6 Skrudgemode — Сборка КС 1.6 для ХНС.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6358712185584482334,11920314945809458975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3942055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 475158ba74686865ce5ba91ed8a86cc6ec9d6d85d90c7ef9a166729c3b4087ff
MD5 52db3434808e680f88cfa54b5df782f5
SHA1 94a9fbe586368e99d84271a1ec7213b72e48bb85
SHA512 3d725fe6ea202b912f21b390dc39cfa38dcd5c30656ce90be288a6cb85aa34249773104337dc045d3215442e848daf55efd4cb04f68fc549f7321122c08147f8
SSDEEP 96:nvkDj1k1wpvWMoiVmdeHBrz5UWQyV+VDCziEwb:nvkvS1GWMXTro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fc5eb082d89bb5d7f54b7a0d0106dcf86e8cd0eda6877e3d76e75f24ca7534fb
MD5 0dd644773d2a546dacca1195faa2aa4c
SHA1 0d9eba135e64b62d97afed53d58e629a2c023309
SHA512 bf10dd9652f39de49e3237ff7188e20058818d6b5133271cbe865d76df0707666d450f4969d124f289dd4d59f62bb8767c837583ae79a98a5d76f5f9d379aade
SSDEEP 96:nvkdj1knwpvWMoiVmdeL2BrX5UWQyVe/VD7AiEwb:nvk9SnGWM723re3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 84f1d7099e0dd6f9e82b9aa712a1d865e8049afcedbf0df36d1bc4f3a2ee1164
MD5 8116128de70ceef95903fd25801b34c1
SHA1 6132a1248d98906ff589fdbe51b7816b91f8fcff
SHA512 dc6b3c05ebe1731c5410ed49fcd1b89a47ffe38439566403a794bb80abd88e849961a49db7d69398806172476d02af22371b2bcee865d379fd72f130ea868219
SSDEEP 96:nvkDj1knwpvWMoiVmdeL2Brz5UWQyV+VDCAiEwb:nvkvSnGWM72TrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f7d56e71a651cee8f445c57aab783d1c2984ca74be0b310de3ca3b18aed000b3
MD5 5dcff39a6ae0a226e2ce5f4fe32c6dc3
SHA1 24eacbf0649e84b775f06c9007c31ffff5f6f568
SHA512 f965817f8c7540a52c937b4f5134f150b1ceca6cda870351251d034114a64f2ea15be02533462831fffcf7e4566cb2fb7b48295726bf052949ba12a5bec91065
SSDEEP 96:nvkDj1gnwpvWMoiVmdeL2Br7yUWQyVe/VD7AiEwb:nvkvynGWM72Ere3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 50edde3487a64ee72275c9ba7670b40aaeaaa6015ed61b9efe93bfe8ff8f047d
MD5 e3611174db50f4f6812b2d996d743333
SHA1 7cdd3c705941b78136fb6103194fc59d8400e615
SHA512 f6aaa27e89e8b0b8b75f39398063895727083d6d3a4c81fb7e7588b59e87b5a28051e90645c0b52c5e4c83b18818532d3a4331cacdd06bea20cfaf03c2fd5bf1
SSDEEP 192:OoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRHme2RU8S5xxj2/:a9iIxuERzA83h09RZxYRHoX4xy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0c51077-980b-4a5d-8659-794369f3ddf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a0c51077-980b-4a5d-8659-794369f3ddf3.tmp
Size 8KB
SHA256 5e28d87b650cd32e2eadcb0c709180e7a67090ad51d74f5c9ae5da4f8ded1da9
MD5 2144182dcd0656d65e1a3b02e3371e67
SHA1 f544eea0e599f111e343eb86b686ebfae47d5801
SHA512 0d5247354895d00ee2398fbe0813307f3f3e1b54c789be045837e8517ee22e1c637026883d14fb6845120d012b09a690a7f0fc6ce883df3556475c8f580c5dc2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfH8e2RU+Mj2B:A9iIxuERzA83h09RZxYfHi4yB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads