hxxp://ptoszek[.]pioterontop[.]rf[.]gd

Resubmissions

02/09/2024, 14:18

240902-rl82esshra6

02/09/2024, 14:13

240902-rjwy3ssbll3

02/09/2024, 14:12

240902-rht34asarm3

02/09/2024, 14:02

240902-rb89fa1hpr3

Analysis

max time kernel
97s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://ptoszek.pioterontop.rf.gd
Sample240902-rb89fa1hpr

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "233"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
2252	msedge.exe
2252	msedge.exe
624	identity_helper.exe
624	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4004	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3972	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1208	2252	msedge.exe	83
PID 2252 wrote to memory of 1208	2252	msedge.exe	83
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 1004	2252	msedge.exe	84
PID 2252 wrote to memory of 876	2252	msedge.exe	85
PID 2252 wrote to memory of 876	2252	msedge.exe	85
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86
PID 2252 wrote to memory of 3316	2252	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ptoszek.pioterontop.rf.gd
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf51a46f8,0x7ffbf51a4708,0x7ffbf51a4718
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,14883033672501343734,9560297331198316631,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x390 0x414
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b1855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

9b1dea0d-47e6-4d64-ad86-02d9a9524266.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b1dea0d-47e6-4d64-ad86-02d9a9524266.tmp
Size 1KB
SHA256 8e116b3b482b66a87432e7325431cf12e746962825e3d98af651f934a49c8548
MD5 a91283a1a0e19353dd3cbc1ed7b72e19
SHA1 951803291b8abf0ce59b41bb431b37d971b9ca29
SHA512 78615837626750f6ed803162cc22432810a0416d1776c9aa47306366880c5529996720cfc7401de44009999fe43be3efa6736c4c8a90e37bf8462d654622f10c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 7d06adc46b8b93f3fe6f162ce056cc092dbdd1d890f7ded1c3028246498a6da8
MD5 5fa094cec17d4b730c6e5120e78e944d
SHA1 77ccbbd2fe47ba2f08b89e6887d3d436d5b1efb5
SHA512 be5c1dd53b8dc6893b16103c25ed21a0836b801e5b4fc243b6ff7695c12ee2a8eb77d8ca6918d4e9f590fd713a559c8308f9a20d4ff80766a53addf083b8d484
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f4af9865d83ede0d763b1b8e7ff0b7bbb0608f8967e4b88ffd413f385d48ea35
MD5 e09c66bb04231fa4fe2fe4f25dc782a6
SHA1 8cb2af366ca6c5a45eaa90730d516e20ddf94682
SHA512 78d4967f6290fbe7e5b5ca224ca336052e43703d06b2ef55d6c4cbd027c3483090d4d5edd6f474543b48353fec44b1b75d70799f7ad495695fbca180a5685b0a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 4057f833016f8331fe398197277cbda65761a98238cb5733a6a8bfa7b809558b
MD5 ebe8e0261872c1143f3d144b7e62313c
SHA1 0a3e4186127922ce6ef847b4e3c1b45502e51bc6
SHA512 cd15083e96dfbc42753779986cdef3f84dab06c90a9144ae61a19d8f3adc949dda00af7ddf89a1c5028e610f7c2b48bbad6f5a4c84fc7fbd0dcba3c754d6396d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 413447e5d98b0af4dbb9a52f2539c4cd2f1f7a483bcca683290a452ca579edbf
MD5 a7f214472c8e985d9a5624dfc9c4d449
SHA1 83bef5380b65aae542efb12664ad5b5da8bdd2a7
SHA512 3a283741cb55257c1b9d8b67f4c526dec3024ce27d826f45d52fa56e5e6d2478e7b45febb54f081d898fab8d56c226d0c2d9e971964cf4f0b1d1b1fe5302594f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ce6bf4ce21f7b30cfca9ce27ea2a8fa0c7e1da757306ae3995dc6435200f831f
MD5 16a70751f3cb4639dec172b802fbe787
SHA1 b70c1fa7ee3bd0260015da927d393fee97951983
SHA512 bf8448421ae3aefa71ee82af374b50aac9ebc1ca0a3d30e2b5ab621ba9673710b053fd515132c26f903910389fe6840bfdd12c1e49590a5bbc77a6877bfa084c
SSDEEP 96:nTk8sQJ1P1QdTLSFhPwpvWMoiWR5mdeGuN1nGyoGjq/uWUWQyV+VD7AiEwb:nTkspGdyFhPGWMWMuN79qVrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 12e1acbaa842c37f4ae3fbfbff7516a96dcce201dc9657878831f6fa2478e55e
MD5 b686b3fcef61ba7cdff092609b9c719c
SHA1 6e76f053d9c4b1443b3d73975cf67593710741d1
SHA512 4cee37ad289c7c1da989b025bfa0a118138fe129185d6d77a45acb2a18f99b53603930831e68c9b36d85453c6d845119af2ce4712b475d152c1006162591c916
SSDEEP 96:nTkzaP1Q1QLSFhPwpvWMoiVmdeH/bWUWQyV+VDCziEwb:nTkzYG1RFhPGWMXSro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d7cc079f915d6bddf860623d4557899a8ba139812af789888ab6f9df9a7eeef9
MD5 d3cf112173cbacc147bec3554c084e29
SHA1 c4ce89f040172f50d8817f6fdd7d05795d4f458f
SHA512 f95ccdee99deae08ab2b76458d9a04c6eeee498bd1796673d59a9d67519fabea4c65c02d12e62c44fe1d85c335406d46e489547540ae5e3b4109f98c0e421e89
SSDEEP 96:nTkKsQ2bKVP1QdvLSFhywpvWMoihR5R7mdeiY4IMkMTybphzGW8Gdg/wceyWQyVg:nTk/bCGdGFhyGWMhDmYxey1Lbg4lg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9346b25a1d8d505b7b49d0a9c3c46438864c61fe0ab9aabd69b49935e0ddd44b
MD5 002b18b3d4f9b6d6311ac13b91b3eb92
SHA1 e21722d6f75e6a534608ec998097749be5069def
SHA512 5bef76eeca452d757b94ab0af9fd79422178b67a75ed6c5f92b639c9b08104675efd0bae8a5469b1fe2859ab92b57d5a3848b183164b7ef52a9abd88b9bbfc2f
SSDEEP 96:nTkzEP1Q1ALSFhPwpvWMoiVmdeGuN1j/KWUWQyV+VD7AiEwb:nTkzWG1hFhPGWM2uNhxrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8223cfc2a4ab0e5c5a806bbe89afe6d7340056db01c610495a3a19dae02b5b2c
MD5 765ea7c579b3afea832f5dbf678d4c15
SHA1 7e4c48be10fbc9bffa9df045933df4253c0c444e
SHA512 4e96ce7d5b3674b9695285aa58b24a548f4037757bf15b2f89ecbba588ea23021933e7bcc4e43bf219562031302c40cc930e3f0bbae38732425837ae6c053889
SSDEEP 96:nTk8sQJkP1QdTLSFhPwpvWMoiWR5mdeGuN1nGyoGjq/KWUWQyV+VD7AiEwb:nTks2GdyFhPGWMWMuN79qxrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 348629da90ed3161994548bd89c5bbff72c693438486771b38afd4e6b4126cdb
MD5 512ed5c4d836a466b80842411af2fb7a
SHA1 77c1e319e8ff0ffbe75d2eb2a0114668ada25a79
SHA512 15768f00c3bf92285fb53f36b136f140ee568919344db4b549b28796da1ca3c021700fa8ee8ed6e011eb047a3104bb66b0bc07aa1dcbafb24209a0fed7060987
SSDEEP 96:nTkEsQJzP1QdNLSFhPwpvWMoihRER5mdeiY4IMk1GnpDGdg/KWUWQyV+VD7AiEwb:nTkk7Gd8FhPGWMhKsYxupOgBrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 cae91d63eb4df9aed0e54f2ce74d9b7f15a282c3402b25bdd3577c02f3628c0b
MD5 a26d8b8988c0b458daa9fb3010ee30e4
SHA1 659dc4f2034848f662cc260d4fadf61433d8e8bf
SHA512 ec6076487da637db918a3915bd3bcbc1b152ae249c3e60f06585b7a85be0b22f86f4fa3f4a6567101d393ab1b7b43e7983a2ba212bc510093384e8e3872f56cd
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58cadd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cadd.TMP
Size 873B
SHA256 2cbc87ea6297d44de8a720586421c4070cfae061edd26ab4d6944cdb48ff5d62
MD5 ad7509ee33312d54bc4057d4542ac574
SHA1 7a400ca094026ac4e5c26c8ad628a8ab60c13b95
SHA512 6afb8d766f1c62faaef77512767a67518dde994a77626288eb7759d855b9dbe0cd7aa6a8a086040eb8218dfc66dfbc8dfac642d932f3dc008b3913402c5e652d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 18e8ac7ec04cb5c2039def3af7b4641335794a6e070484b5cb2039c376d411f9
MD5 c20fd4993541bbaabf26a91a2cf1f3c7
SHA1 41d3068594489d8a660dcbe93860f5a3d8b1b93d
SHA512 ea8bb2689ad4f775bd1dd6376ebfcacfab36a1cabfe590e378a40f84a9d40e13e2a94f55a830c63bf2234347993a80826727dc40316df8a6de165f3b0e2cf564
SSDEEP 192:IoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDTe2RUwSwIfJYkbNuRw5YL:w9iIxuERzA83h09RZxYDDPOKABkLsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4a5986fb089b0f42f4a67576a13b270268f858cac7a6ee2e00cedc853af690a6
MD5 617dede1a066567a48fd154e42e81309
SHA1 61d10d389bd456d6058307041548b421fa442e33
SHA512 949562360d486f5e0b5a24eee92e7429eb3312fdaf39141eff11986dd58261c3a00a4b78657d028ae7a071cc7dedff88cc51ad9da4d2cfe7f9e31adbd24442e3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphZe2RUTxNoRw5Ytj9Zklq1:A9iIxuERzA83h09RZxYhNkrkLsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads