76621536f29a688e86b6964cbb88f51813f4858c57f375bc7387b7e2b138cdb6

Resubmissions

19/08/2024, 00:59

240819-bckpgaycjl

19/08/2024, 00:54

240819-a9eztavdph10

19/08/2024, 00:49

240819-a6ngsavcle10

Analysis

max time kernel
43s
max time network
47s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
19/08/2024, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stub.exe
Size 1.6MB
Sample240819-a9eztavdph
SHA256 6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f
MD5 6627adf7167ee571e8fd6c8b1a0e8ae3
SHA1 03b9112660ee73c59d84e219f15bf24ae9df48db
SHA512 e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60
SSDEEP 49152:19Tq24GjdGSiqkqXfd+/9AqYanieKd0U:1YEjdGSiqkqXf0FLYW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stub.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdom = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = dcbb3b61d2f1da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "134"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{99C6A88E-AB67-4F30-8A21-3309A009CA23} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 49029576d2f1da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdom = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "10"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 90400b68d2f1da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ed917261d2f1da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "134"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3104	MicrosoftEdgeCP.exe
3104	MicrosoftEdgeCP.exe
3104	MicrosoftEdgeCP.exe
3104	MicrosoftEdgeCP.exe
3104	MicrosoftEdgeCP.exe
3104	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	352	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	352	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2420	MicrosoftEdge.exe
3104	MicrosoftEdgeCP.exe
2192	MicrosoftEdgeCP.exe
3104	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 2704	3104	MicrosoftEdgeCP.exe	76
PID 3104 wrote to memory of 8	3104	MicrosoftEdgeCP.exe	80
PID 3104 wrote to memory of 8	3104	MicrosoftEdgeCP.exe	80
PID 3104 wrote to memory of 8	3104	MicrosoftEdgeCP.exe	80
PID 3104 wrote to memory of 8	3104	MicrosoftEdgeCP.exe	80
PID 3104 wrote to memory of 8	3104	MicrosoftEdgeCP.exe	80
PID 3104 wrote to memory of 8	3104	MicrosoftEdgeCP.exe	80
PID 3104 wrote to memory of 8	3104	MicrosoftEdgeCP.exe	80

C:\Users\Admin\AppData\Local\Temp\stub.exe
"C:\Users\Admin\AppData\Local\Temp\stub.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2704

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:8

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
MD5 1bfe591a4fe3d91b03cdf26eaacd8f89
SHA1 719c37c320f518ac168c86723724891950911cea
SHA512 02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
SSDEEP 96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

edgecompatviewlist[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml
Size 74KB
SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
MD5 d4fc49dc14f63895d997fa4940f24378
SHA1 3efb1437a7c5e46034147cbbc8db017c69d02c31
SHA512 cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
SSDEEP 768:gL9S+ZZR8+zAmz7B4P/jRLhOzgT6YBNxdvEFd:K9/ZJAA7B2jhT6YTxdvSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.microsoft[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\I1HJXP6L\dotnet.microsoft[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

dotnet.microsoft[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\I1HJXP6L\dotnet.microsoft[1].xml
Size 84B
SHA256 a8cb58aef6b2614be1d079538d063876c6c2e4a483b620080a59549fee4cc6ac
MD5 3f9562761d8bda4c9ed989b4971333f1
SHA1 5d16cb1a64a003bbcb74fac047a1f65de25ce676
SHA512 4ac7544c6c85b7ee5ee98ba874c1dd64e71e92badad04bf78f57706f61ea6395e268c289bb7e3d9ec1e47895c88b99d1f10748f714a4c16606089406face2d94
MD5 SHA1 SHA512

Submit Download

favicon[1].ico

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\USYYQCUR\favicon[1].ico
Size 161KB
SHA256 dd7958526f6b8510fc2a9a675056d78e029e62015e8913dda574ff5797ddb969
MD5 8565042b6db20c23647202bf4b95f11b
SHA1 9f0829cb3ceef14ac10e0b66338d8b7243a09101
SHA512 dbf692b7219a3ea993ab939442a843ffbc7bcfe63bc62117a14ed7e953ffce595393e9f950649aa609a7a9a94b56003ab84cb82edaf2db3e4551434204085b95
SSDEEP 384:uXGEbBoakCHL2Vtddhk+izwOGTN8p8q2ahi0f:uXGToHL2VDk+izPjp8+iW
MD5 SHA1 SHA512 SSDEEP

Submit Download

imagestore.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\ijw9syj\imagestore.dat
Size 64KB
SHA256 dfc27761d55a0ea65792b0ef186320461e2e7fe8236a36e02c65ceaa76a59f87
MD5 5b9d48b8f5e33ae9db7d8c06404a58cf
SHA1 b4d304c47e4c2baa3ac23b795fe446319266eba9
SHA512 9e4459bcff86bebc32ca8596a0dcad4a91e4be8db60ce487a4bc5a4dc4b096f1a6d9fbaa227dd29a6db0e08a201639cb31744edd43dcaef491821efc5d6f43e0
SSDEEP 384:+AcBTpIQ9JHhJkzltlliBfP77HChAA19dXGEbBGakQHL2Vbddh4:JuTOQ9JHhAyLChbdXGxSHL2VF4
MD5 SHA1 SHA512 SSDEEP

Submit Download

RE1Mu3b[1].png

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1G6WS7EK\RE1Mu3b[1].png
Size 3KB
SHA256 112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
MD5 9f14c20150a003d7ce4de57c298f0fba
SHA1 daa53cf17cc45878a1b153f3c3bf47dc9669d78f
SHA512 d4f6e49c854e15fe48d6a1f1a03fda93218ab8fcdb2c443668e7df478830831acc2b41daefc25ed38fcc8d96c4401377374fed35c36a5017a11e63c8dae5c487
MD5 SHA1 SHA512

Submit Download

general.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1G6WS7EK\general.min[1].js
Size 169KB
SHA256 c935dcc9f529f434237f4b507263236cd1fe9ee650735946a55a7f0c4f366018
MD5 49b237e0e1b4d7f8e79eef67df8fc31b
SHA1 e84b25d606a998921900c18808ac1c1a727a0640
SHA512 0c22d53148b3ca147f69e47ad156e906b7a7d5cbea402b3c77a37f42c5abdc060add4c6b6c56066893aa6b67af461b9aca1d43ed7f1243acf28df225a7d7b343
SSDEEP 1536:M/5yO7NemMJezP6LW0oiSNdKIcYVXAhoWvjDG3/GQLn95JxsZgtPQLY9f3zkdP2D:MxRchLW9fNSYWvI1eef3zAfRU6NaOm
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpc-data-sharing.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1G6WS7EK\gpc-data-sharing.min[1].js
Size 217B
SHA256 cc8c32e30e08c43092c6ad4317b18c2d0a8f425bcc9de7bb5965384f9fc3f16e
MD5 0554032e1c38be8a9d0a4a5c6973ce43
SHA1 20c98add41d2cef29274560bb357884c40a72523
SHA512 fa13e128442c5aac2f2c1e142f66376dfd3daa6c015e040ac64a7dcbf11d911844fe53dcfdaddcb621e2b9df6f9f4fbbd197d604da25ab01a4cf5a1eb73df024
MD5 SHA1 SHA512

Submit Download

open-sans-v34-latin-regular[1].woff2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1G6WS7EK\open-sans-v34-latin-regular[1].woff2
Size 16KB
SHA256 b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
MD5 e43b535855a4ae53bd5b07a6eeb3bf67
SHA1 6507312d9491156036316484bf8dc41e8b52ddd9
SHA512 955a4c3ea5df9d2255defc2c40555ac62eeafcc81f6fa688ba5e11a252b3ed59b4275e3e9a72c3f58e66be3a4d0e9952638932fa29eb9075463537910a8e0ce6
SSDEEP 384:S83axrqv4mRIF0Um2NStwCpx9qwEpYmUsNCDPSfHpf:S8KaRIF0UnNStwCpN3mluPIHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcp-consent[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1G6WS7EK\wcp-consent[1].js
Size 272KB
SHA256 c688d3f2135b6b51617a306a0b1a665324402a00a6bceba475881af281503ad9
MD5 5f524e20ce61f542125454baf867c47b
SHA1 7e9834fd30dcfd27532ce79165344a438c31d78b
SHA512 224a6e2961c75be0236140fed3606507bca49eb10cb13f7df2bcfbb3b12ebeced7107de7aa8b2b2bb3fc2aa07cd4f057739735c040ef908381be5bc86e0479b2
SSDEEP 6144:dIcsZZWWI0BDqL9W4sC6Hdo7NjIZjIZP0hZRWLF9LmSF/EI:dIcsZtI0BGoHdo7NjIZjIZP0vC75F/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

culture-selector.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5PGROS7F\culture-selector.min[1].js
Size 1KB
SHA256 e84d57bf859a256815362f36a4ff7f5ee6ba1dcfd02d8ac02673353fdd0a0ff1
MD5 a7d39d299ede945b34ebb570580d6686
SHA1 a1d32e04c5a0d72978dbb6ae531ceb9ef319e225
SHA512 c6a619dcd8b7e07d5491c9963a89f4fcc9d48e3fb14dbac57f0470988b48eb378224966b094c3cdbff4689674c49d6fd51fd0ec6c031d6902f8f2bc9154d4355
MD5 SHA1 SHA512

Submit Download

dotnet-framework-runtime[1].svg

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5PGROS7F\dotnet-framework-runtime[1].svg
Size 42KB
SHA256 db6c6f42e1d56092fb2c3d317968077cb29435139274faefbf4ab7681955bec6
MD5 5aaa8c37cd59979b920cd21c4a50a38d
SHA1 0ee61e3b2d58513b92cf4c6b5114c1beb55539e7
SHA512 0fb4c45db9f29963fce195e79b4e9963e57a50ef0fcab74466d6034834e0099f1f344a8569973d4c1ece05d9b70b5938b42ead4fabaa08de7d24c911df28c235
SSDEEP 768:naF93b8Ih0YgCee+Bgsymb0Mh0H3vG5DJmltD6o:64DTEm1iH/GVJmltuo
MD5 SHA1 SHA512 SSDEEP

Submit Download

footer.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5PGROS7F\footer.min[1].js
Size 376B
SHA256 0aa837fa8bbdc8d87bda9c64ca64732fdf87d85e2f8768b2220e1e03ab48df42
MD5 33eb53d99fb8b6b0fc16b035559b20d5
SHA1 db024d172c6623da9c65ace778c802bd46a4f043
SHA512 6575c35d99efb1671b1083165e10a04ce93bd715cb1165af5964d9051dff1c5ec0e86b51487ee51eac4e62807182de5677467475f3588dbfefbab42f1e79e51b
MD5 SHA1 SHA512

Submit Download

ms.analytics-web-4.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5PGROS7F\ms.analytics-web-4.min[1].js
Size 153KB
SHA256 ecb0bf38c5c4e4e1d00ee2131e694c2a62b5be0e8d398129be1799b831ce6137
MD5 8c0374ae846cf06e4448a785fda96d93
SHA1 1e668e9c6264e7cd07f32d1884dab3a699527287
SHA512 3815a689ddec2c25a6ccf6f9bf114fd773fc07d9a89e7cbf29db94cd4fe02c0f4298a1628181feb5e9510ac7afdf11f21e6f620b5b5a82a2233209f962320da6
SSDEEP 3072:mp7zNjcuvLhEnQld8iPz+6pOnV6qlDIjBgnqTwU1E+:mp7R/zhEnQuVHcdbTt1E+
MD5 SHA1 SHA512 SSDEEP

Submit Download

mwfmdl2-v3.54[1].woff

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5PGROS7F\mwfmdl2-v3.54[1].woff
Size 25KB
SHA256 22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
MD5 d0263dc03be4c393a90bda733c57d6db
SHA1 8a032b6deab53a33234c735133b48518f8643b92
SHA512 9511bef269ae0797addf4cd6f2fec4ad0c4a4e06b3e5bf6138c7678a203022ac4818c7d446d154594504c947da3061030e82472d2708149c0709b1a070fdd0e3
SSDEEP 768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5 SHA1 SHA512 SSDEEP

Submit Download

space-grotesk-v12-latin-700[1].woff2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5PGROS7F\space-grotesk-v12-latin-700[1].woff2
Size 11KB
SHA256 751851e72654508ca07678c61bdacd91b772d725f531dd8a6f62e6f941e11ecc
MD5 514360ed1b78e71aabe58ecd08f36706
SHA1 1062c179ea2f74b5db67f9d7822c556ed25637dd
SHA512 1827c1a0189570e775bdcd07657e720e0bb27c2157ff46307cba551eaa16822645e388321081eb13cae7f4d024038b5279cff897a4c86c0ecd4428e60a5dac5e
SSDEEP 192:rspRtTaX3Gh0LIqtqwscakjhzj3J5XzcGM4VRr7SaTo14dGn+6Su/NF2PTieysar:rsDQSq3aunZZzJMu7SRWOBAPGeysa+Qr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ai.2.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\79SZ112Y\ai.2.min[1].js
Size 120KB
SHA256 bde9be4cbe799089a419225f87c2a9986043f6c7cb55853aaadab7200713f136
MD5 30f39ae5d1d05a439046a7640510b486
SHA1 716efa29594edae8832bb8b12e7fb19bc06e06fe
SHA512 f67fdafca801746226acb9d2ef6d90070dd1d8a5a08bcb5dd1c94631f1559373c56d9796a5633cac03e1a5a384cf01d60c080a6ef16cea4b52aaa93ed364b55a
SSDEEP 3072:m3yFsd/M+C0w0Ba04g+179ET9/OEMawYU1+eCSJLI016qw:ANT+179ExHFSJLI01i
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap-custom.min[1].css

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\79SZ112Y\bootstrap-custom.min[1].css
Size 232KB
SHA256 0dff15ac2e617f448c838474cf51cbef83b6da2dfdb6f106a763ca902de9de76
MD5 a9776b3abc6cbaf24b74f32d3fe173f4
SHA1 d66c1a0b3dffc17872928e68f2feb2a00f1992bc
SHA512 e74582f23c1ed9c7a644434df44bb4cc7ff841256d9d1c7f96f7428645a05efac8834ba4c8b7d597396c1641ba6c46c825067fe4febce63ba27a84627c186ca6
SSDEEP 6144:2GURuaUnEgYNMqgvQNk6hNO6LJp7pl1JaagEyzwl5UvNSXYiv9Q1:GJp7pl1JaagEyzwl5UvNSXYivK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca-ae3ce4[1].css

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\79SZ112Y\ca-ae3ce4[1].css
Size 167KB
SHA256 928acfba36ccd911340d2753db52423f0c7f6feaa72824e2a1ef6f5667ed4a71
MD5 b7af9fb8eb3f12d3baa37641537bedc2
SHA1 a3fbb622fd4d19cdb371f0b71146dd9f2605d8a4
SHA512 1023c4d81f68c73e247850f17bf048615ddabb69acf2429644bdaf8dc2a95930f7a29ceae6fbd985e1162897483a860c8248557cda2f1f3d3ff0589158625a49
SSDEEP 3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCx1:jlZAW9kJeqg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookie-consent.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\79SZ112Y\cookie-consent.min[1].js
Size 2KB
SHA256 6f511e4c5d44853453d6840704ba07a04e06d47011f74920d76b6c580fe6123e
MD5 e8461b5f6a92c484b9b77ae2e5f0cd06
SHA1 0aa93613cb84f76a7a8038566ae39d4ff7e03288
SHA512 9fd5584edba7db6c3e6ffddba32164ef689c873263e980f6de40d1f8dfa9b081b29080425e03156ccf13da3aa90240155408b63a8442a5365139dcae8803a467
MD5 SHA1 SHA512

Submit Download

main.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\79SZ112Y\main.min[1].js
Size 36KB
SHA256 7563cca0838959c44755de17514cf59b5578d54cffd2de1d4c1f6ef315fc0f68
MD5 71421678589b2c6524b226f9f9289408
SHA1 3b500a9bb82f0d96b5bd317476cc6c969c8f198e
SHA512 f5e846135d8fa75dbb40fd002a16a9880a814e8ddca7a87dd01e53bd4f52008cfa25d02b321e281c3746175d7e4cda29a8aa06b82856779a354d9fc8ba1f2f39
SSDEEP 768:+ovgqc/q5oLio0pwNnxG3MBSt6Ql24715xYxWE6688YCYhNbwY0dyB8gHaZM1hNl:Xgqc/Gro0pwNnk3MBSt6w247zixrX6ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

open-sans-v34-latin-700[1].woff2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\79SZ112Y\open-sans-v34-latin-700[1].woff2
Size 15KB
SHA256 d1a17abb1a999842fe425e1a4ace9d90f9c18f3595c21a63d89f0611b90cfd72
MD5 e45478d4d6f15dafda1f25d9e0fb5fa1
SHA1 52cb490cd0ee4442ede034085cda9652b206f91c
SHA512 2ac423249ec837efa35b29705f55a326dee83f727e867269b86005cce144ca8d435f7412bb0bc9babdb9ae17419e4a0314b2923bee6a5acc96c9909e9eb48645
SSDEEP 384:TtgTVSIoaVS0+dKzhUi9vlN7I5ISk2RE4J2Ck9j0o+2fGLPqb:TCTVSIoP0/UiFlN8ISk2qrCPzXPqb
MD5 SHA1 SHA512 SSDEEP

Submit Download

2b-8e0ae6[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SLAUSJ2C\2b-8e0ae6[1].js
Size 134KB
SHA256 a1fe019388875b696edb373b51a51c0a8e3bad52cd489617d042c0722bdb1e48
MD5 b9c3e4320db870036919f1ee117bda6e
SHA1 29b5a9066b5b1f1fe5afe7ee986e80a49e86606a
SHA512 a878b55e8c65d880cdf14850baee1f82254c797c3284485498368f9128e42dca46f54d9d92750eeeb547c42cab9a9823aa9afab7d881090ebbfa1135cdd410b6
SSDEEP 3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

analytics.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SLAUSJ2C\analytics.min[1].js
Size 2KB
SHA256 b8129c1b9a7b8a1467493c917ed1d007f7297a58a4ebc09ac73d958e28969ad1
MD5 38b34dd10999b35d3ea49d72d442d61b
SHA1 9f448f4af683e7359906f603bb2cbba37148d721
SHA512 cd30aeec91fb944644236665b19aa5e34371b75e76a310bfcab80e2e0528a0363f15865f54e26b4f58f8c3e313f716adbce6b720e50b332c227f994fdd973e5f
MD5 SHA1 SHA512

Submit Download

cda-tracker.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SLAUSJ2C\cda-tracker.min[1].js
Size 797B
SHA256 a840f2b9595bf4deab839d5eb1ce4b8f7c93576db27a62e7428920825b151f5a
MD5 4224409739020ba30e3752c0d1f273d0
SHA1 54980ee9df0ef712048572c80dc8d70710178538
SHA512 1cbf209bfbf939713608be74eb2aaa788d250dacc40349ef10ee50074c62c47d1c0b2ad2d4a88d23a9b81e2059843e2add2f867ea98daef3d7f19b7643765c4b
MD5 SHA1 SHA512

Submit Download

open-sans-v34-latin-600[1].woff2

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SLAUSJ2C\open-sans-v34-latin-600[1].woff2
Size 16KB
SHA256 4ffc35ac4d5e3f1546a4c1a879f425f090ff3336e0fce31a39ae4973b5e8c127
MD5 603c99275486a11982874425a0bc0dd1
SHA1 ffeb62d105d2893d323574407b459fbae8cc90a6
SHA512 662dc53798ccda65ee972a1bb52959ca5f4c45066c1d500c2476c50ec537cb90a42d474d7dde2bec1ea8c312cc4a46e1d91ffb610130c2dc7914b65aef8a2615
SSDEEP 384:cIlJSYgEmK1DlskYEkml1XQGsK475GLNH/7OqQVY3HWwAlTP:cIlJSGmtkRkml5QBKn/6q4wAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

theme-toggle.min[1].js

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SLAUSJ2C\theme-toggle.min[1].js
Size 3KB
SHA256 e02f294b19ef5b7a0421ab25a055738f6f4baabaffb3030132ff08121a338459
MD5 5eb247cbcbf666e2517e5f1256b52b5c
SHA1 d74454d4cba8f1c1aa8270ab092111ec63e69594
SHA512 b3f7889850da89185ff6e48675d0e52f3550561c2b4ec6502a67fc06451846a51e47f4d16ae15f351998cf2592292c1f4fb455dcc9756a3b19a79e281afa24f4
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 471B
SHA256 4f4a463bd4a923eaa0b80ea76b9d350f01da1a2d7d3f4dc95b4158bc15484a45
MD5 061295db1941df66d062a81f91abeeb5
SHA1 3c31475f17ba9dd7cfd6fc580703302e17271f33
SHA512 658e4291ec3a3ad526b33969e48c0eeded0d20e29f4a795b4aba8064cccac5a521224d35e31e9a5bfa85614a0621b74ee097fb763935656acf1b4697cb9f29a6
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Size 471B
SHA256 d2de4e1ce7cb4f064bb1bc106cb947ae4b7b32783010e6711e84d33d2ac3a123
MD5 843d977200411d7e6f6fd91e01b34145
SHA1 2d47b152596b2d3e77027fba9c9b016051836514
SHA512 dbce95eb01ad049449e666e95b485beb834428b497877f708ef508658a22b1466086d0096e39875d9066ef7b6a31f4c0763f44f8673996311a91163ea1fc18a3
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Size 471B
SHA256 15759d6590f341b07acca488ce30ac5f8545da69209e6cddf28fa0ec04d0767f
MD5 41aa557aca4ec8589547990f0c00ae79
SHA1 3234297ccab2b04b5f4e4f67daaf13671b0864e9
SHA512 0b5d38081d0db69e7b27ebbba969d289844296ffd6e1a42b6c0c7cae8a069e87528219982fd5876267ba63a72f83e19a98ec504c44320533dbf415cfe6b5f80a
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 412B
SHA256 57fc647afc6ad6264def1da8eb1a370c2767be306ac77a6b2275fc8334940b38
MD5 8ab62fd0d805104208092a5ce47bf102
SHA1 dbc1f6b9035499403f051da96ce999dd7ab9aecb
SHA512 944b6d680b37685131491e16b41e292b2e892cb67f88660836463e1a2b3edfd22723fca3843a2f9cd67f6c745a8162747bc74751b77f8072b8da7429b1836d07
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Size 412B
SHA256 fdbaf9192ba217213f1b3f179accd6cd58ae3e23964bb33a7fa223cd4318799f
MD5 87d6cd7b794f17eb0fd8313e8c29e1a1
SHA1 cbcccf783013bac70bf255b138592eee44509395
SHA512 4bb088e20dd0c9e9e5cba96746d963562588e14a5fd50b38b1920641a70fe2c4b5e2d24046d8103e6cb0a1396fb96145c639c0f804757e17fd2456f2221c1e1e
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Size 412B
SHA256 1ee36c793778c2b8d97f33da55f5827779d1c3bc861017e81e9bc3451ee8b821
MD5 3c972c292227e00d9bdf4491a1d53b97
SHA1 8f3b15eb10ced3355270e2e92baaf10be6eab0a5
SHA512 530a1737d347dfafff75ecb5e30918a39b345463ca1b15bc3616263c2708799570ba5285afef2d0d759e7b290c2b052d088c376622e278b4074a7873b075cd27
MD5 SHA1 SHA512

Submit Download

memory/2192-43-0x00000158C9300000-0x00000158C9400000-memory.dmp

Download

memory/2192-42-0x00000158C9300000-0x00000158C9400000-memory.dmp

Download

memory/2420-345-0x000001BD5BE90000-0x000001BD5BE91000-memory.dmp

Download

memory/2420-16-0x000001BD55920000-0x000001BD55930000-memory.dmp

Download

memory/2420-35-0x000001BD52C60000-0x000001BD52C62000-memory.dmp

Download

memory/2420-344-0x000001BD5BE80000-0x000001BD5BE81000-memory.dmp

Download

memory/2420-0-0x000001BD55820000-0x000001BD55830000-memory.dmp

Download

memory/2704-188-0x0000019281150000-0x0000019281152000-memory.dmp

Download

memory/2704-400-0x0000019281430000-0x0000019281432000-memory.dmp

Download

memory/2704-402-0x0000019281480000-0x0000019281482000-memory.dmp

Download

memory/2704-375-0x0000019281DC0000-0x0000019281EC0000-memory.dmp

Download

memory/2704-378-0x0000019281DC0000-0x0000019281EC0000-memory.dmp

Download

memory/2704-371-0x00000192813B0000-0x00000192813B2000-memory.dmp

Download

memory/2704-373-0x00000192813E0000-0x00000192813E2000-memory.dmp

Download

memory/2704-326-0x0000019281C80000-0x0000019281CA0000-memory.dmp

Download

memory/2704-321-0x0000019281C60000-0x0000019281C80000-memory.dmp

Download

memory/2704-283-0x0000019282740000-0x0000019282840000-memory.dmp

Download

memory/2704-273-0x0000019281230000-0x0000019281232000-memory.dmp

Download

memory/2704-241-0x0000019281740000-0x0000019281760000-memory.dmp

Download

memory/2704-194-0x0000019281CC0000-0x0000019281DC0000-memory.dmp

Download

memory/2704-186-0x0000019281130000-0x0000019281132000-memory.dmp

Download

memory/2704-184-0x0000019281110000-0x0000019281112000-memory.dmp

Download

memory/2704-182-0x0000019280FF0000-0x0000019280FF2000-memory.dmp

Download

memory/2704-176-0x0000019280F00000-0x0000019280F02000-memory.dmp

Download

memory/2704-178-0x0000019280FB0000-0x0000019280FB2000-memory.dmp

Download

memory/2704-180-0x0000019280FD0000-0x0000019280FD2000-memory.dmp

Download

memory/2704-174-0x0000019AFFFF0000-0x0000019AFFFF2000-memory.dmp

Download

memory/2704-172-0x0000019AFFFD0000-0x0000019AFFFD2000-memory.dmp

Download

memory/2704-170-0x0000019AFCEE0000-0x0000019AFCEE2000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads