76621536f29a688e86b6964cbb88f51813f4858c57f375bc7387b7e2b138cdb6

Resubmissions

19/08/2024, 00:59

240819-bckpgaycjl

19/08/2024, 00:54

240819-a9eztavdph10

19/08/2024, 00:49

240819-a6ngsavcle10

Analysis

max time kernel
40s
max time network
40s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
19/08/2024, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stub.exe
Size 1.6MB
Sample240819-a6ngsavcle
SHA256 6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f
MD5 6627adf7167ee571e8fd6c8b1a0e8ae3
SHA1 03b9112660ee73c59d84e219f15bf24ae9df48db
SHA512 e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60
SSDEEP 49152:19Tq24GjdGSiqkqXfd+/9AqYanieKd0U:1YEjdGSiqkqXf0FLYW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stub.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "134"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4acbe2b2d1f1da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "124"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdom = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\dotnet.microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "10"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b8916eb4d1f1da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c07cd4b2d1f1da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "134"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c27af3b2d1f1da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\Total = "10"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 103e17b3d1f1da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
5020	MicrosoftEdgeCP.exe
5020	MicrosoftEdgeCP.exe
5020	MicrosoftEdgeCP.exe
5020	MicrosoftEdgeCP.exe
5020	MicrosoftEdgeCP.exe
5020	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4692	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4692	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4692	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3232	MicrosoftEdge.exe
5020	MicrosoftEdgeCP.exe
4692	MicrosoftEdgeCP.exe
5020	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4108	5020	MicrosoftEdgeCP.exe	78
PID 5020 wrote to memory of 4108	5020	MicrosoftEdgeCP.exe	78
PID 5020 wrote to memory of 4108	5020	MicrosoftEdgeCP.exe	78
PID 5020 wrote to memory of 4108	5020	MicrosoftEdgeCP.exe	78
PID 5020 wrote to memory of 4108	5020	MicrosoftEdgeCP.exe	78
PID 5020 wrote to memory of 4108	5020	MicrosoftEdgeCP.exe	78
PID 5020 wrote to memory of 4108	5020	MicrosoftEdgeCP.exe	78
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79
PID 5020 wrote to memory of 1192	5020	MicrosoftEdgeCP.exe	79

C:\Users\Admin\AppData\Local\Temp\stub.exe
"C:\Users\Admin\AppData\Local\Temp\stub.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3232

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
MD5 1bfe591a4fe3d91b03cdf26eaacd8f89
SHA1 719c37c320f518ac168c86723724891950911cea
SHA512 02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
SSDEEP 96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

edgecompatviewlist[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml
Size 74KB
SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
MD5 d4fc49dc14f63895d997fa4940f24378
SHA1 3efb1437a7c5e46034147cbbc8db017c69d02c31
SHA512 cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
SSDEEP 768:gL9S+ZZR8+zAmz7B4P/jRLhOzgT6YBNxdvEFd:K9/ZJAA7B2jhT6YTxdvSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.microsoft[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\BQPVI9G5\dotnet.microsoft[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

favicon[1].ico

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\U2P3OKWV\favicon[1].ico
Size 161KB
SHA256 dd7958526f6b8510fc2a9a675056d78e029e62015e8913dda574ff5797ddb969
MD5 8565042b6db20c23647202bf4b95f11b
SHA1 9f0829cb3ceef14ac10e0b66338d8b7243a09101
SHA512 dbf692b7219a3ea993ab939442a843ffbc7bcfe63bc62117a14ed7e953ffce595393e9f950649aa609a7a9a94b56003ab84cb82edaf2db3e4551434204085b95
SSDEEP 384:uXGEbBoakCHL2Vtddhk+izwOGTN8p8q2ahi0f:uXGToHL2VDk+izPjp8+iW
MD5 SHA1 SHA512 SSDEEP

Submit Download

imagestore.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\avw9kth\imagestore.dat
Size 64KB
SHA256 a8e90d55d17273cd87ea84209a54465dee7152af5fd66f13c30e16100ff7daa1
MD5 ebea4d8db73b76e257869dda01cb39e3
SHA1 fbf8aaded90300cb7d7bca19fb033726b7b807cf
SHA512 85591a6b40c8c77e83b9d3af39a101ba0576c97ad8b20a621833bd27b1f8872cc6363ab2ee556013fa40a1dadb5125d52129a70cef3ef0c14fd5dd928ef747c5
SSDEEP 384:+AcBfpIQ9JHhJkzltlliBfP77HChAA19lXGEbBiak8HL2VvddhE:JufOQ9JHhAyLChblXGFuHL2VJE
MD5 SHA1 SHA512 SSDEEP

Submit Download

RE1Mu3b[1].png

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\72MTLAGL\RE1Mu3b[1].png
Size 3KB
SHA256 112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
MD5 9f14c20150a003d7ce4de57c298f0fba
SHA1 daa53cf17cc45878a1b153f3c3bf47dc9669d78f
SHA512 d4f6e49c854e15fe48d6a1f1a03fda93218ab8fcdb2c443668e7df478830831acc2b41daefc25ed38fcc8d96c4401377374fed35c36a5017a11e63c8dae5c487
MD5 SHA1 SHA512

Submit Download

cda-tracker.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\72MTLAGL\cda-tracker.min[1].js
Size 797B
SHA256 a840f2b9595bf4deab839d5eb1ce4b8f7c93576db27a62e7428920825b151f5a
MD5 4224409739020ba30e3752c0d1f273d0
SHA1 54980ee9df0ef712048572c80dc8d70710178538
SHA512 1cbf209bfbf939713608be74eb2aaa788d250dacc40349ef10ee50074c62c47d1c0b2ad2d4a88d23a9b81e2059843e2add2f867ea98daef3d7f19b7643765c4b
MD5 SHA1 SHA512

Submit Download

ms.analytics-web-4.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\72MTLAGL\ms.analytics-web-4.min[1].js
Size 153KB
SHA256 ecb0bf38c5c4e4e1d00ee2131e694c2a62b5be0e8d398129be1799b831ce6137
MD5 8c0374ae846cf06e4448a785fda96d93
SHA1 1e668e9c6264e7cd07f32d1884dab3a699527287
SHA512 3815a689ddec2c25a6ccf6f9bf114fd773fc07d9a89e7cbf29db94cd4fe02c0f4298a1628181feb5e9510ac7afdf11f21e6f620b5b5a82a2233209f962320da6
SSDEEP 3072:mp7zNjcuvLhEnQld8iPz+6pOnV6qlDIjBgnqTwU1E+:mp7R/zhEnQuVHcdbTt1E+
MD5 SHA1 SHA512 SSDEEP

Submit Download

open-sans-v34-latin-700[1].woff2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\72MTLAGL\open-sans-v34-latin-700[1].woff2
Size 15KB
SHA256 d1a17abb1a999842fe425e1a4ace9d90f9c18f3595c21a63d89f0611b90cfd72
MD5 e45478d4d6f15dafda1f25d9e0fb5fa1
SHA1 52cb490cd0ee4442ede034085cda9652b206f91c
SHA512 2ac423249ec837efa35b29705f55a326dee83f727e867269b86005cce144ca8d435f7412bb0bc9babdb9ae17419e4a0314b2923bee6a5acc96c9909e9eb48645
SSDEEP 384:TtgTVSIoaVS0+dKzhUi9vlN7I5ISk2RE4J2Ck9j0o+2fGLPqb:TCTVSIoP0/UiFlN8ISk2qrCPzXPqb
MD5 SHA1 SHA512 SSDEEP

Submit Download

theme-toggle.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\72MTLAGL\theme-toggle.min[1].js
Size 3KB
SHA256 e02f294b19ef5b7a0421ab25a055738f6f4baabaffb3030132ff08121a338459
MD5 5eb247cbcbf666e2517e5f1256b52b5c
SHA1 d74454d4cba8f1c1aa8270ab092111ec63e69594
SHA512 b3f7889850da89185ff6e48675d0e52f3550561c2b4ec6502a67fc06451846a51e47f4d16ae15f351998cf2592292c1f4fb455dcc9756a3b19a79e281afa24f4
MD5 SHA1 SHA512

Submit Download

culture-selector.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BQKARNO7\culture-selector.min[1].js
Size 1KB
SHA256 e84d57bf859a256815362f36a4ff7f5ee6ba1dcfd02d8ac02673353fdd0a0ff1
MD5 a7d39d299ede945b34ebb570580d6686
SHA1 a1d32e04c5a0d72978dbb6ae531ceb9ef319e225
SHA512 c6a619dcd8b7e07d5491c9963a89f4fcc9d48e3fb14dbac57f0470988b48eb378224966b094c3cdbff4689674c49d6fd51fd0ec6c031d6902f8f2bc9154d4355
MD5 SHA1 SHA512

Submit Download

dotnet-framework-runtime[1].svg

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BQKARNO7\dotnet-framework-runtime[1].svg
Size 42KB
SHA256 db6c6f42e1d56092fb2c3d317968077cb29435139274faefbf4ab7681955bec6
MD5 5aaa8c37cd59979b920cd21c4a50a38d
SHA1 0ee61e3b2d58513b92cf4c6b5114c1beb55539e7
SHA512 0fb4c45db9f29963fce195e79b4e9963e57a50ef0fcab74466d6034834e0099f1f344a8569973d4c1ece05d9b70b5938b42ead4fabaa08de7d24c911df28c235
SSDEEP 768:naF93b8Ih0YgCee+Bgsymb0Mh0H3vG5DJmltD6o:64DTEm1iH/GVJmltuo
MD5 SHA1 SHA512 SSDEEP

Submit Download

footer.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BQKARNO7\footer.min[1].js
Size 376B
SHA256 0aa837fa8bbdc8d87bda9c64ca64732fdf87d85e2f8768b2220e1e03ab48df42
MD5 33eb53d99fb8b6b0fc16b035559b20d5
SHA1 db024d172c6623da9c65ace778c802bd46a4f043
SHA512 6575c35d99efb1671b1083165e10a04ce93bd715cb1165af5964d9051dff1c5ec0e86b51487ee51eac4e62807182de5677467475f3588dbfefbab42f1e79e51b
MD5 SHA1 SHA512

Submit Download

general.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BQKARNO7\general.min[1].js
Size 169KB
SHA256 c935dcc9f529f434237f4b507263236cd1fe9ee650735946a55a7f0c4f366018
MD5 49b237e0e1b4d7f8e79eef67df8fc31b
SHA1 e84b25d606a998921900c18808ac1c1a727a0640
SHA512 0c22d53148b3ca147f69e47ad156e906b7a7d5cbea402b3c77a37f42c5abdc060add4c6b6c56066893aa6b67af461b9aca1d43ed7f1243acf28df225a7d7b343
SSDEEP 1536:M/5yO7NemMJezP6LW0oiSNdKIcYVXAhoWvjDG3/GQLn95JxsZgtPQLY9f3zkdP2D:MxRchLW9fNSYWvI1eef3zAfRU6NaOm
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpc-data-sharing.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BQKARNO7\gpc-data-sharing.min[1].js
Size 217B
SHA256 cc8c32e30e08c43092c6ad4317b18c2d0a8f425bcc9de7bb5965384f9fc3f16e
MD5 0554032e1c38be8a9d0a4a5c6973ce43
SHA1 20c98add41d2cef29274560bb357884c40a72523
SHA512 fa13e128442c5aac2f2c1e142f66376dfd3daa6c015e040ac64a7dcbf11d911844fe53dcfdaddcb621e2b9df6f9f4fbbd197d604da25ab01a4cf5a1eb73df024
MD5 SHA1 SHA512

Submit Download

main.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BQKARNO7\main.min[1].js
Size 36KB
SHA256 7563cca0838959c44755de17514cf59b5578d54cffd2de1d4c1f6ef315fc0f68
MD5 71421678589b2c6524b226f9f9289408
SHA1 3b500a9bb82f0d96b5bd317476cc6c969c8f198e
SHA512 f5e846135d8fa75dbb40fd002a16a9880a814e8ddca7a87dd01e53bd4f52008cfa25d02b321e281c3746175d7e4cda29a8aa06b82856779a354d9fc8ba1f2f39
SSDEEP 768:+ovgqc/q5oLio0pwNnxG3MBSt6Ql24715xYxWE6688YCYhNbwY0dyB8gHaZM1hNl:Xgqc/Gro0pwNnk3MBSt6w247zixrX6ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

ai.2.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GFQ4522N\ai.2.min[1].js
Size 120KB
SHA256 bde9be4cbe799089a419225f87c2a9986043f6c7cb55853aaadab7200713f136
MD5 30f39ae5d1d05a439046a7640510b486
SHA1 716efa29594edae8832bb8b12e7fb19bc06e06fe
SHA512 f67fdafca801746226acb9d2ef6d90070dd1d8a5a08bcb5dd1c94631f1559373c56d9796a5633cac03e1a5a384cf01d60c080a6ef16cea4b52aaa93ed364b55a
SSDEEP 3072:m3yFsd/M+C0w0Ba04g+179ET9/OEMawYU1+eCSJLI016qw:ANT+179ExHFSJLI01i
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca-ae3ce4[1].css

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GFQ4522N\ca-ae3ce4[1].css
Size 167KB
SHA256 928acfba36ccd911340d2753db52423f0c7f6feaa72824e2a1ef6f5667ed4a71
MD5 b7af9fb8eb3f12d3baa37641537bedc2
SHA1 a3fbb622fd4d19cdb371f0b71146dd9f2605d8a4
SHA512 1023c4d81f68c73e247850f17bf048615ddabb69acf2429644bdaf8dc2a95930f7a29ceae6fbd985e1162897483a860c8248557cda2f1f3d3ff0589158625a49
SSDEEP 3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCx1:jlZAW9kJeqg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookie-consent.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GFQ4522N\cookie-consent.min[1].js
Size 2KB
SHA256 6f511e4c5d44853453d6840704ba07a04e06d47011f74920d76b6c580fe6123e
MD5 e8461b5f6a92c484b9b77ae2e5f0cd06
SHA1 0aa93613cb84f76a7a8038566ae39d4ff7e03288
SHA512 9fd5584edba7db6c3e6ffddba32164ef689c873263e980f6de40d1f8dfa9b081b29080425e03156ccf13da3aa90240155408b63a8442a5365139dcae8803a467
MD5 SHA1 SHA512

Submit Download

mwfmdl2-v3.54[1].woff

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GFQ4522N\mwfmdl2-v3.54[1].woff
Size 25KB
SHA256 22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
MD5 d0263dc03be4c393a90bda733c57d6db
SHA1 8a032b6deab53a33234c735133b48518f8643b92
SHA512 9511bef269ae0797addf4cd6f2fec4ad0c4a4e06b3e5bf6138c7678a203022ac4818c7d446d154594504c947da3061030e82472d2708149c0709b1a070fdd0e3
SSDEEP 768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5 SHA1 SHA512 SSDEEP

Submit Download

open-sans-v34-latin-regular[1].woff2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GFQ4522N\open-sans-v34-latin-regular[1].woff2
Size 16KB
SHA256 b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
MD5 e43b535855a4ae53bd5b07a6eeb3bf67
SHA1 6507312d9491156036316484bf8dc41e8b52ddd9
SHA512 955a4c3ea5df9d2255defc2c40555ac62eeafcc81f6fa688ba5e11a252b3ed59b4275e3e9a72c3f58e66be3a4d0e9952638932fa29eb9075463537910a8e0ce6
SSDEEP 384:S83axrqv4mRIF0Um2NStwCpx9qwEpYmUsNCDPSfHpf:S8KaRIF0UnNStwCpN3mluPIHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcp-consent[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GFQ4522N\wcp-consent[1].js
Size 272KB
SHA256 c688d3f2135b6b51617a306a0b1a665324402a00a6bceba475881af281503ad9
MD5 5f524e20ce61f542125454baf867c47b
SHA1 7e9834fd30dcfd27532ce79165344a438c31d78b
SHA512 224a6e2961c75be0236140fed3606507bca49eb10cb13f7df2bcfbb3b12ebeced7107de7aa8b2b2bb3fc2aa07cd4f057739735c040ef908381be5bc86e0479b2
SSDEEP 6144:dIcsZZWWI0BDqL9W4sC6Hdo7NjIZjIZP0hZRWLF9LmSF/EI:dIcsZtI0BGoHdo7NjIZjIZP0vC75F/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

2b-8e0ae6[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\W7ZUJ4EQ\2b-8e0ae6[1].js
Size 134KB
SHA256 a1fe019388875b696edb373b51a51c0a8e3bad52cd489617d042c0722bdb1e48
MD5 b9c3e4320db870036919f1ee117bda6e
SHA1 29b5a9066b5b1f1fe5afe7ee986e80a49e86606a
SHA512 a878b55e8c65d880cdf14850baee1f82254c797c3284485498368f9128e42dca46f54d9d92750eeeb547c42cab9a9823aa9afab7d881090ebbfa1135cdd410b6
SSDEEP 3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

analytics.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\W7ZUJ4EQ\analytics.min[1].js
Size 2KB
SHA256 b8129c1b9a7b8a1467493c917ed1d007f7297a58a4ebc09ac73d958e28969ad1
MD5 38b34dd10999b35d3ea49d72d442d61b
SHA1 9f448f4af683e7359906f603bb2cbba37148d721
SHA512 cd30aeec91fb944644236665b19aa5e34371b75e76a310bfcab80e2e0528a0363f15865f54e26b4f58f8c3e313f716adbce6b720e50b332c227f994fdd973e5f
MD5 SHA1 SHA512

Submit Download

bootstrap-custom.min[1].css

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\W7ZUJ4EQ\bootstrap-custom.min[1].css
Size 232KB
SHA256 0dff15ac2e617f448c838474cf51cbef83b6da2dfdb6f106a763ca902de9de76
MD5 a9776b3abc6cbaf24b74f32d3fe173f4
SHA1 d66c1a0b3dffc17872928e68f2feb2a00f1992bc
SHA512 e74582f23c1ed9c7a644434df44bb4cc7ff841256d9d1c7f96f7428645a05efac8834ba4c8b7d597396c1641ba6c46c825067fe4febce63ba27a84627c186ca6
SSDEEP 6144:2GURuaUnEgYNMqgvQNk6hNO6LJp7pl1JaagEyzwl5UvNSXYiv9Q1:GJp7pl1JaagEyzwl5UvNSXYivK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

open-sans-v34-latin-600[1].woff2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\W7ZUJ4EQ\open-sans-v34-latin-600[1].woff2
Size 16KB
SHA256 4ffc35ac4d5e3f1546a4c1a879f425f090ff3336e0fce31a39ae4973b5e8c127
MD5 603c99275486a11982874425a0bc0dd1
SHA1 ffeb62d105d2893d323574407b459fbae8cc90a6
SHA512 662dc53798ccda65ee972a1bb52959ca5f4c45066c1d500c2476c50ec537cb90a42d474d7dde2bec1ea8c312cc4a46e1d91ffb610130c2dc7914b65aef8a2615
SSDEEP 384:cIlJSYgEmK1DlskYEkml1XQGsK475GLNH/7OqQVY3HWwAlTP:cIlJSGmtkRkml5QBKn/6q4wAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

space-grotesk-v12-latin-700[1].woff2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\W7ZUJ4EQ\space-grotesk-v12-latin-700[1].woff2
Size 11KB
SHA256 751851e72654508ca07678c61bdacd91b772d725f531dd8a6f62e6f941e11ecc
MD5 514360ed1b78e71aabe58ecd08f36706
SHA1 1062c179ea2f74b5db67f9d7822c556ed25637dd
SHA512 1827c1a0189570e775bdcd07657e720e0bb27c2157ff46307cba551eaa16822645e388321081eb13cae7f4d024038b5279cff897a4c86c0ecd4428e60a5dac5e
SSDEEP 192:rspRtTaX3Gh0LIqtqwscakjhzj3J5XzcGM4VRr7SaTo14dGn+6Su/NF2PTieysar:rsDQSq3aunZZzJMu7SRWOBAPGeysa+Qr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.microsoft[1].xml

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\BQPVI9G5\dotnet.microsoft[1].xml
Size 84B
SHA256 93f5639eb2acb6dff5f25264c2a9b37a2da9549bf406d7c88d9f20d418d5b620
MD5 468edc3fdc9a115bc576ba1b13e20842
SHA1 5df481c59dfe757904f67437e35341288e58f036
SHA512 8da7df15ccefe4f86c780a75ea62e788cb66399da3b49907e792c9f77a38a9fcec57e7333ec93b50bd9e9f535ffd4c24b452eb3bbb704bd42ebe939da923bbdb
MD5 SHA1 SHA512

Submit Download

C389FD106AACA95B265CC81A85B3522B_B01925B2B46F5058A43DABB371773EE2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\C389FD106AACA95B265CC81A85B3522B_B01925B2B46F5058A43DABB371773EE2
Size 1KB
SHA256 28a80b9a21c87cf00369f4ebbda9b70e6e29de0ed125a65737186751005c37ac
MD5 2ff7a35bd81b941b9b229360aef2ff83
SHA1 8202e9b49056cd428dd40f277f5a2ffce16edc23
SHA512 90ff37642e0d42c5cebdd9451e0de0361c4837481425b9ebbe3c4bacbe75ecb17e6c34b818f31f09eb1a7fab16fa0f1f71b7f0c490e03e1e75c875cebc0a5290
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 471B
SHA256 4f4a463bd4a923eaa0b80ea76b9d350f01da1a2d7d3f4dc95b4158bc15484a45
MD5 061295db1941df66d062a81f91abeeb5
SHA1 3c31475f17ba9dd7cfd6fc580703302e17271f33
SHA512 658e4291ec3a3ad526b33969e48c0eeded0d20e29f4a795b4aba8064cccac5a521224d35e31e9a5bfa85614a0621b74ee097fb763935656acf1b4697cb9f29a6
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Size 471B
SHA256 d2de4e1ce7cb4f064bb1bc106cb947ae4b7b32783010e6711e84d33d2ac3a123
MD5 843d977200411d7e6f6fd91e01b34145
SHA1 2d47b152596b2d3e77027fba9c9b016051836514
SHA512 dbce95eb01ad049449e666e95b485beb834428b497877f708ef508658a22b1466086d0096e39875d9066ef7b6a31f4c0763f44f8673996311a91163ea1fc18a3
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Size 471B
SHA256 1e7c891085461a1e4103c999a457cddec2565cedf2f1abda31bee480186b1f2c
MD5 6658b3e3e2d583b4ba3e225892704717
SHA1 7757128b0c9d3a676934ff3ee18ffde255017415
SHA512 4a04f43c4d82c7067e74e615c3ff376350c8131ae7d9d45ee0d44d7078710e4c1f97fe7b660697ba404265b6ed095c2754792e3c9a6d3790de60488c808a9041
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Size 471B
SHA256 15759d6590f341b07acca488ce30ac5f8545da69209e6cddf28fa0ec04d0767f
MD5 41aa557aca4ec8589547990f0c00ae79
SHA1 3234297ccab2b04b5f4e4f67daaf13671b0864e9
SHA512 0b5d38081d0db69e7b27ebbba969d289844296ffd6e1a42b6c0c7cae8a069e87528219982fd5876267ba63a72f83e19a98ec504c44320533dbf415cfe6b5f80a
MD5 SHA1 SHA512

Submit Download

C389FD106AACA95B265CC81A85B3522B_B01925B2B46F5058A43DABB371773EE2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\C389FD106AACA95B265CC81A85B3522B_B01925B2B46F5058A43DABB371773EE2
Size 564B
SHA256 941e1d90d3938dc1594fc1f8aec55037be38eba72b7076e6b34c6d92cb35d1ed
MD5 a59b845c2b362b8654ce4631e568652e
SHA1 4756d847c83dd8db7825e7d370fbcdcccf1a1ef1
SHA512 e106d7512d48f1b9897caab1efbb129c0c895b49b69805ecd9642556b0af9a28a4c8ae57226c4808df0ebe8a9c858d88476e4b31a1ae8f98bea5d55e97982e62
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 412B
SHA256 7026a58699e3966fb30903d62feabcababf4da622a50875a0c2ae76b8f02a9b5
MD5 158102939a30688bc17e20fb919c8d5a
SHA1 c22119d3db081d40f779bb6e906338d44678908b
SHA512 ee64c0c5bcaab1237bba75173ae09ec997cbe2c55c44becefa5419eaa88fd5e8264dca89fd247f59158b7ee7a1e4fc852a885cccdaf700f4e2c36305eb787eb3
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Size 412B
SHA256 726d5fbc9510786a7e033a59809b8abcd8fc9c762ab9c929f1ed6dd5debb9a4d
MD5 9bf2c92a04a8d732ec959c5b2547bf74
SHA1 81cdaa3640d989efd7a86b1852c650a1f288932b
SHA512 a082406db0739ad01eb82515903a0530398fc81d42d0feb69b0947934b14b2a9bca15801036bf7db12e803b3deb90087554787095c43a342d6069b626d62ae7b
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Size 420B
SHA256 15aedf956291c60218980bd3eb6c7ae3ee68043b74e31bf29c285b085ca871d8
MD5 e0c224f955ab885390492099ee170c67
SHA1 4e5004adeb016d2196d9041d3263ab31c5870fb8
SHA512 8444c4c8514e22fc17dcf11a53e0a545e6ab7536b6ec5d79f292c305e997c83afc9142184f26e9a7650dd89e0a8aae4742520d42a35f2ae4682723add99e3a7c
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Size 412B
SHA256 4e5d6e876ba9e50723e66e18e70c15146c7b138909fceef95a58f79603c4d30e
MD5 4501cbbda3fa28c736c26f552efb5c17
SHA1 1653c75f554e2db4e73da03e0cdab3495ff9c53e
SHA512 b8209bb8dc53288eb346168c951fade58557b9b4e2806a206858c36bc7969ddb4b899b524a04bef51699841ce4e8bc30f5510d24269bfb5ef22aac3cfcc05613
MD5 SHA1 SHA512

Submit Download

memory/1192-317-0x000002DAF5B90000-0x000002DAF5B92000-memory.dmp

Download

memory/1192-405-0x000002DAF8640000-0x000002DAF8660000-memory.dmp

Download

memory/1192-422-0x000002DAFB110000-0x000002DAFB210000-memory.dmp

Download

memory/1192-319-0x000002DAF5BB0000-0x000002DAF5BB2000-memory.dmp

Download

memory/1192-315-0x000002DAF5B70000-0x000002DAF5B72000-memory.dmp

Download

memory/1192-377-0x000002DAF4E10000-0x000002DAF4E12000-memory.dmp

Download

memory/1192-313-0x000002DAF5B50000-0x000002DAF5B52000-memory.dmp

Download

memory/1192-400-0x000002DAF6200000-0x000002DAF6300000-memory.dmp

Download

memory/1192-364-0x000002DAF4F40000-0x000002DAF5040000-memory.dmp

Download

memory/3232-0-0x00000148AFC20000-0x00000148AFC30000-memory.dmp

Download

memory/3232-16-0x00000148AFD20000-0x00000148AFD30000-memory.dmp

Download

memory/3232-35-0x00000148AD2D0000-0x00000148AD2D2000-memory.dmp

Download

memory/3232-428-0x00000148B64A0000-0x00000148B64A1000-memory.dmp

Download

memory/3232-427-0x00000148B6480000-0x00000148B6481000-memory.dmp

Download

memory/4108-235-0x000002409DB00000-0x000002409DB02000-memory.dmp

Download

memory/4108-401-0x00000240A2040000-0x00000240A2140000-memory.dmp

Download

memory/4108-367-0x000002409DB20000-0x000002409DC20000-memory.dmp

Download

memory/4108-363-0x000002409E1D0000-0x000002409E1F0000-memory.dmp

Download

memory/4108-239-0x000002409DD60000-0x000002409DD62000-memory.dmp

Download

memory/4108-237-0x000002409DD50000-0x000002409DD52000-memory.dmp

Download

memory/4108-233-0x000002409DAF0000-0x000002409DAF2000-memory.dmp

Download

memory/4108-231-0x000002409D6F0000-0x000002409D6F2000-memory.dmp

Download

memory/4108-229-0x000002409D6D0000-0x000002409D6D2000-memory.dmp

Download

memory/4108-227-0x000002409CF30000-0x000002409CF32000-memory.dmp

Download

memory/4108-180-0x000002409E5E0000-0x000002409E6E0000-memory.dmp

Download

memory/4108-68-0x000002408C100000-0x000002408C200000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads