hxxp://91[.]239[.]211[.]89/bins/kworkerd-rcu

Resubmissions

20/06/2026, 17:05

260620-vl2h5aht3t6

20/06/2026, 17:03

260620-vkn7eaht2v5

Analysis

user interaction
yes
max time kernel
104s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://91.239.211.89/bins/kworkerd-rcu
Sample260620-vkn7eaht2v

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a0000000242b8-1399.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3644	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264485953498702"	msedge.exe

Modifies registry class 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000c4c770c51ae3dc01df7d6da427e3dc01c381f2d4d600dd0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{B177E294-4A7A-4A99-BCAF-F8D1608FF527}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
1236	OpenWith.exe
3564	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 372	4732	msedge.exe	85
PID 4732 wrote to memory of 3644	4732	msedge.exe	86
PID 4732 wrote to memory of 2400	4732	msedge.exe	87
PID 4732 wrote to memory of 2400	4732	msedge.exe	87
PID 4732 wrote to memory of 2400	4732	msedge.exe	87
PID 4732 wrote to memory of 1600	4732	msedge.exe	88
PID 4732 wrote to memory of 1600	4732	msedge.exe	88
PID 4732 wrote to memory of 4404	4732	msedge.exe	89
PID 4732 wrote to memory of 4872	4732	msedge.exe	90
PID 4732 wrote to memory of 4404	4732	msedge.exe	89
PID 4732 wrote to memory of 4404	4732	msedge.exe	89
PID 4732 wrote to memory of 4872	4732	msedge.exe	90
PID 4732 wrote to memory of 4872	4732	msedge.exe	90
PID 4732 wrote to memory of 3172	4732	msedge.exe	92
PID 4732 wrote to memory of 388	4732	msedge.exe	93
PID 4732 wrote to memory of 3172	4732	msedge.exe	92
PID 4732 wrote to memory of 3172	4732	msedge.exe	92
PID 4732 wrote to memory of 388	4732	msedge.exe	93
PID 4732 wrote to memory of 388	4732	msedge.exe	93
PID 4732 wrote to memory of 544	4732	msedge.exe	96
PID 4732 wrote to memory of 4104	4732	msedge.exe	97
PID 4732 wrote to memory of 544	4732	msedge.exe	96
PID 4732 wrote to memory of 4104	4732	msedge.exe	97
PID 4732 wrote to memory of 2008	4732	msedge.exe	98
PID 4732 wrote to memory of 2008	4732	msedge.exe	98
PID 4732 wrote to memory of 2308	4732	msedge.exe	99
PID 4732 wrote to memory of 2308	4732	msedge.exe	99
PID 4732 wrote to memory of 2308	4732	msedge.exe	99
PID 4732 wrote to memory of 2480	4732	msedge.exe	100
PID 4732 wrote to memory of 984	4732	msedge.exe	103
PID 4732 wrote to memory of 4148	4732	msedge.exe	119
PID 4732 wrote to memory of 3528	4732	msedge.exe	120
PID 4732 wrote to memory of 4036	4732	msedge.exe	121
PID 4732 wrote to memory of 1796	4732	msedge.exe	123
PID 4732 wrote to memory of 1796	4732	msedge.exe	123
PID 4732 wrote to memory of 1796	4732	msedge.exe	123
PID 4732 wrote to memory of 2188	4732	msedge.exe	124
PID 4732 wrote to memory of 2188	4732	msedge.exe	124
PID 4732 wrote to memory of 4656	4732	msedge.exe	125
PID 4732 wrote to memory of 4656	4732	msedge.exe	125
PID 4732 wrote to memory of 4656	4732	msedge.exe	125
PID 4732 wrote to memory of 4576	4732	msedge.exe	126
PID 4732 wrote to memory of 4576	4732	msedge.exe	126
PID 4732 wrote to memory of 4576	4732	msedge.exe	126
PID 4732 wrote to memory of 4372	4732	msedge.exe	127
PID 4732 wrote to memory of 4372	4732	msedge.exe	127
PID 4732 wrote to memory of 1244	4732	msedge.exe	129
PID 4732 wrote to memory of 1244	4732	msedge.exe	129
PID 4732 wrote to memory of 1244	4732	msedge.exe	129
PID 4732 wrote to memory of 3124	4732	msedge.exe	130
PID 4732 wrote to memory of 3124	4732	msedge.exe	130
PID 4732 wrote to memory of 3124	4732	msedge.exe	130
PID 4732 wrote to memory of 732	4732	msedge.exe	131
PID 4732 wrote to memory of 732	4732	msedge.exe	131
PID 4732 wrote to memory of 732	4732	msedge.exe	131
PID 4732 wrote to memory of 3564	4732	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://91.239.211.89/bins/kworkerd-rcu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff93af1c188,0x7ff93af1c194,0x7ff93af1c1a0
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,9984110709627360912,1429101403962690983,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,12741359373374428047,9441464728630327856,262144 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,6647083412220701204,3442167496746875962,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5382471844249578108,16973778642801820331,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,7368600661953428840,2947581854505338475,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,2048313374564021295,9303932579967945528,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,44087058230221651,11562739445375679241,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,16232671426004216678,9925512674334673207,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,12161476448627353724,17329142807115789585,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,17332783878634249826,11665807313647513527,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5656,i,8843532694275576814,13733111519834740296,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,17228057895131023071,15086912037566082127,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5765265380838890829,13426360916900338273,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5765265380838890829,13426360916900338273,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,1116196761416022645,16697412316739096822,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,16526641240256382018,8331170739110639719,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1536,i,2191714267549490898,1044580988545665916,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5396,i,3874850139104343084,6902696685808478419,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,15722920765500888795,9502695662081179053,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5616,i,6010352360995196959,9558824439748654359,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5804,i,5147871007297070330,5958003597899406983,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,17925473331500116022,13978645029500151084,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7104,i,9495645416744532177,16609035700942456277,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5940,i,14033681129604813226,2587486026450429849,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7244,i,11751784871747048769,17416180408021536852,2097152 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,9446622267165896886,15863693369762183134,524288 --field-trial-handle=2264,i,13080165583939276213,12775491907271380308,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000106

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000106
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 944cbd4797ea3e786f463b727be999d8cc8cf001abe1ffb989fa3c5f9abe74f5
MD5 7c1860f6b7d4fe55e9a920045d5afbb4
SHA1 6675160269272dcd2a5413c7220920216b07d990
SHA512 5787242e9f8cf10c8260cbfe910b03145e8d7c566e4a80d1cbf5eedba0aa5f72848a1f26ae7e15f208b184ad3c288e414fdb61abef367756fbf3e93fca05796d
TLSH
T1B381D8F52A3200A0E720057D94F96E1A3A75A7EAFB0B5F5A31807C746D16FF10069D7C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 8ee54e343a57dd5659a23a5223683605f5cc5a00265fe8560b26ba9e164db740
MD5 54e82ab34fd726ed49823b21a8c01aa2
SHA1 1b848d44b833cbea60864e77d306885189baf86c
SHA512 c00fd2c32b9959b277eb353033268f7eec159811e0d9b3c9f0a00a8bd78a3e3e88253d621c2fc3f8b1750f130d827bd976764e9862ea50728a6838e9955ea905
SSDEEP 192:ar/jxCE/b4s/LrHy1y7rG/fC/Xs/UX2yZACAg/DIGd/O/d+4x/+yss/Q0xfgUQ/3:ar/jxCE/b4s/LrHsy7rG/fC/Xs/e2yZN
TLSH
T13A221BF991A90451EB256CBC90F66C4BB7375ECEF2074F2720506DB4680BBE84C769E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58750c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58750c.TMP
Size 3KB
SHA256 bbe2a59f6f36bdc1d09c7e387c98ee3a0edfc3792b9ab662a98eee8d2830197c
MD5 91931a71265ee56a669f34f82305da54
SHA1 0dc409992654484e83d52da96b2c81e91dfdcfcd
SHA512 120b97d1c5c9f2b290f644d7d64d7192f6157f79eef180311c6abe74a6e8308646ee587b25e1e44ae7b18278007c8bc2898e295d2e7b60334c5f69d8dc5dd2b2
TLSH
T11181D7F52A3200A0E720057D94F96E2A3A75A7EAFB0B5F5A31807C706D16FF20069D3C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 809b36b163c7049835dc4dd585007b9d4ed877c085b42cdf7ea5f6f9736b9dd1
MD5 f58a6d637682e4c31331f296f6f6735e
SHA1 541f674947464078a2e98f4b7876d831b60b1c3e
SHA512 d0875cfcacd4fe40fa9163d3bfbd067dbdd335d643c1cb4ae566f6534c3f37361b54b4f8e1ad0b11a8cb2ab270e1d44d4a4619d34a3ee2cc2fd45ec9f777ea34
TLSH
T160619AF2C3D6825DD95156F0AA187F1BCE2D085643683D4E84D4AF4BA3F18B1E152B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 7998f79cfbb24bfb2c4b592b3f231c5f31533959acb018b294674e2a59e66695
MD5 b979f0ecf5b2d492e381d38811211443
SHA1 dd175c3b0e2990a3b1a4d551a930a9f4578b013b
SHA512 846a91f8943071bc9a6d4fe1432621b712bda43ac87ca7d294765f6d90639333e61063ec2eacb1465d614d921610958982057b682e25257a3fcdfce1a78e0a5e
TLSH
T179D022631202B1B9BDAE7E81447AEC8FC32AA02848A2DDE820D0E999093646C861B341
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5946b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5946b4.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0a86e44284f95f9f9870758b0021dbbed7d85a2f9c857c8981464e494116e086
MD5 41de9cec7e59795729e3cad3498e6869
SHA1 5a8418e5dc97d7a947e34239c7f27c9423e6947e
SHA512 17d706eab160a84cef05a870473ae05f73501c74f099e5b19912016beb9e0b07b226ea759d291b054b7f4bd09677ee10eeae2405e0c7d975c3f405f6cd48ae21
SSDEEP 192:sxZyRlyM/jK1Ml8M9w/fZscfor3V2IdpJHVf6+WNGYvxIjqqIgrJ:sxZyt1w/fZscforBJHaGd/9
TLSH
T1A142D7126A38997BCCCBD20DFA45BF53D6F51572A2900E44A9FCDA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 9f29b7cf81e8a7b173778deb974f2d16efe02bab172e27e6afeb7f503d2004b4
MD5 cacc9d843ac9a44f28762d69c4d083c7
SHA1 02e1d2fd3c3b8a90e343dfd42e346faa7223c770
SHA512 d2d1a6a41e2f50e97b202f3d0ad29c5f37725a4cf944d409ec0b58a66284e4b7a6fd8522653277360005f4f5e5cc5ec328e55d80ebaacccf5dba03c7a2c44540
SSDEEP 384:sxZBnIPsm4w/fZs9fHr2eLHaA1/bPi//v4:sJIkm4w/fyfLNHa8unv4
TLSH
T1C882E7126624897BCDD7C619F952BF53D6F51432EA904F88E9FCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 37bc6d32e7dc761df7e26b31bd0dbe9f2854438922a94e478ab60321b0a5222f
MD5 24d5f95c85bf4a1925d4c2d984b28732
SHA1 f613dc0886cd3d03fa91ef0dde77d6ecd38da39f
SHA512 a190e23fcd316b96d40859a278b34ee5490ce84a85e5caed3cf3f2f8998ff3b1983251d7ea0156febedb5cbcfc30442af5dcf3ec7ab8e3a305f89322331762ec
SSDEEP 384:sxZBnqPsm4w/fZs9fHr2egHaA1/+m/Rv4:sJqkm4w/fyfLmHa85pv4
TLSH
T1CB82F9126624897BCCDBD619F912BF53D6F45472EA900F48A9FCCA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 af8268e94c03f6d4ec48da576c2e319d700303c63c5b1c22111b83a322a6a480
MD5 5d3457cc3076e5f3084d0f7c64ae90fe
SHA1 408588ead235881027dd24d24a32fad691bcae32
SHA512 1ddf54dc430c2d74bb4c14ffb77840917bf0e3f186a0b62345449be6e3bafb59bf8994a1c8878f8af997f133e0bbf57b05304449aa63269207959eda8e5acc24
SSDEEP 768:acseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppproRX:acseJ3xWvhfynu1jaVcL88pCl
TLSH
T1C1D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 99dec77a5569ca3fb3229e7d758b26a93795b2ec5fdbb2caaa5b2bd1e7920da7
MD5 3134bd061b94c523d72a991431ac155d
SHA1 e79ecb25f1f454028add1b22032919869276de75
SHA512 f3e9d3eba6c5cebc2d6b551cf047aa0514248b008ff0b785bb11f7962bd482d0240801ec2a2065bebe8aaef72e0d456b69a834213b35509bebd456917f2a0df9
TLSH
T18EA0021027804415D51262B2555392895204AD116201120670D12896CC51650855504C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 1bc4de8402b393cda2b21f747a208e8f3bfb4f949f4b9849237506c321658e31
MD5 67047f37074dce52ff5e965a5dc18102
SHA1 11300b6366dccf05398a2430f6fbd3fdf21dc2d1
SHA512 22b95b5f8563c00da76f733bf65b247b344133db334274316347e58030a37951ebfc7376472ee4b4903a6ec1ccdc16288215affd5d51db8aa2c26a1c9a544dd5
TLSH
T1E4A0021522C04021C01212BC76DB0656A210DE24030A53158AD00844DC7A665DA4502C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 84d196347cf59891ff330e7fdc6fea9924dbc5a5f91e9b1e7b79998eee60965d
MD5 2f9d023a57e94a3ac4785cc49891cfc8
SHA1 ffbec86a495137f63a2e0a093a1d5b34b4188fb1
SHA512 eae44fe87e82db2b9252d699d71600ad50a5e13135f52c2092242687062002beb50522510f206be5e3e5764e642f3d6bfff659aaf1dc6a6c34380a94abcb7fd8
TLSH
T13051C79F4C573B97DDAC117264B108883B35B5DC6A449E27A8FC9138ACCB32428BE758
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 c1c7375450f1786b0a470489d04350ebc1e01f227a4f38daa65531fa1455e26e
MD5 f9873160a42f8b6475fb818deb59c7b4
SHA1 c1281348fc31d64fb79b05dba3fe0a482363b918
SHA512 64ab2d618638f7015b7f5f2e0eb1c69af0def1fb97d2e0695b6164aff0526eeeb057b9ce5464a4ce807d2b154a6e41e4a39966374d96ba48669e064f359a72df
TLSH
T1D52172488E90891FE868817B15F7A4F033708DDC572163631C6C35351E2238D2A072DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e9ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe58e9ee.TMP
Size 1KB
SHA256 142ecc81144aee9887a0e5f691858115b200e7ede64c46be0653433352d7c2b5
MD5 7849ed0e4cb9729968c81a89b82a782f
SHA1 b56c157e491c7333e556844d4d2b8adb019a55af
SHA512 c45ed068729210baaa89e8e1f5c8aadd68a2447be654ccc1e09436b79d775aef212d28da5cb047a9f9dbd052c8d71ade1fb503399758d66d6cf0cdab14163e32
TLSH
T1602154854A918E1BF890517B1AA3A4F47330CC006332B7D3693C25794E31B8E5A0B1C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e00b85633830e79a1687e19d0cd9aa700c280c3d385327e0a77c28b4251ba394
MD5 f906eb7a7b75d55a79e396b36d5b3162
SHA1 ba5c5c057a1c9db6d1adc3bd0c764aa174aa0146
SHA512 81014df37e0c7a3d604e4945c4ce0f61b9c86c4a538835dc1c26d5d3a9306dd05bc0bd2be3e2d76509314854728dd37e4e2b3601adb8bca0939143c26d293ae3
TLSH
T15EE068B62DD72454BDABC3D12030C090060A7498E901FC0E541AF6831072315309AC25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 a6632f36197e69557901333236f071fd6ee3fe1d55657479335afee9a420fbca
MD5 3f5ced95746274ec888a5b2ce2df6947
SHA1 ab21a841817a3dabf20fe5fee2e9537050348873
SHA512 283334581fb507d6c9c82345c15d7ae163ae0f0cacb99a0bb7ef04e6f80045a49d1535628d2f7fd105e0bc1983374bc4f4c8e4cdbfe8b717710e96f82a5efd1c
TLSH
T14CB024154C0C405DC044037474C0004C7034CC541F0F31D040FCCD70D03F5C04015007
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596f0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596f0c.TMP
Size 48B
SHA256 a92982c2b336f0735387c6a73eb31e8c3b36c43e309b9e7654a0b5409a7d72d9
MD5 112743393df7fc6c0b6cf97f8a4d5fdc
SHA1 9d2dc2207e4e536ce3a5fdbbc075c74eeb7a80ed
SHA512 b19dd2817b93c5725a5b12635db6fde2e2cafa12bb8606f70b426b852a85d2e2a784367a44edcfa4222b6a026c42dba09239c35a1d6f8e3f433b2060abc743db
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 194a6b62c8f7819386ae2a6649c3cf136e88ed3ce1d6d395a4b89642c12502af
MD5 4faec6088655cff9b947d56c9150f9bb
SHA1 830482d87b9225e4b531771d20bd66aa3adaa7b8
SHA512 e1caaf24baed5dd62e0d28a81cc531f7f153027fe357e9793062aa2300d257308c808a2aa9940962c6bd602e65b1f9f48281d56f14a87fb3660faf0f662637ea
SSDEEP 96:KYH+KggmSRkVBnTfkvTqP1ZkK9B1/kJhBKnh5eleKm0Vz:49SRkVBnTfuTq9ZdB1/+hBKnh5hE
TLSH
T1F7914F42363F02022CBE294DB295A9764F4275A33558A4FF7BB804A30E66E110DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28d3107e-2688-4c09-83b3-7e460cf50acf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\28d3107e-2688-4c09-83b3-7e460cf50acf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a255907fd1b74e582a059edf518ca13a42bd7bbecb1d68d07ffff8d0ba60ad6c
MD5 9d4d1aa45cd5f9f97410ec075f0335b9
SHA1 0ed3ba6767993e1f815fff05f43955e436c664f3
SHA512 7cb4fc6819b43f7ec69f29bbda1bce2f996a088f60e8df47bd60d74df29bde658666b6a437b932186800d249b466ffd3d55939fcaf91e5029324df6ba0ecb997
SSDEEP 384:YtNn/s3n9SfsNeJ727VQxM3CJd4xGJrxUqi:Yj+9UyHUzhxUqi
TLSH
T139625C326834DC2B9D93A685F04737175EF4816BAAC02B94E5ED7F1C01CA7AC130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 3df18347a63515249dafd8625ca4c8e41ec78d21d2d98ff36227cb977813239e
MD5 b16bf7ec1791d1d53ee3884c64e7e49d
SHA1 ba8f1c611c26c7d8918b7c350b5eb1cce8e74592
SHA512 f05db3fcb7b583861f5877bd1a8beac1d524bf429af215bc0cbd74b66ba7d728344e159733a72d8611b9a1247e24432b875250ecacab3e81d505543fb6bd6321
SSDEEP 384:piFKtNn/s3n9SSUHsNu8TUNTUlIl/T/27VQ2MAGJd4xGJrTUqi:AFKj+9E/wgw9wzhTUqi
TLSH
T1A3B2E7F248D3883AD99E5747F37E2E064EBCC157B9806A54B7D86A0CCC862BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 ceb59ed06fe173d940c707a3d0e82b72c67cd75abdc0890b48d6c2b5d2384867
MD5 1b6c0d98e1212671c10f4b93af589289
SHA1 604dde29de1f67504bbd7682263962bdf43140b1
SHA512 606bdb636f2e9c01a0b597e9fc116caa46ca0731469ab8c64bd3fdabeb266597f99e670f0f3dd4451b1a806e2565d315815ce89f75b2185180729f01d83dd127
SSDEEP 384:piFetNn/s3n9SSUHsNu8TUNTUlIl/T/27VQnMAGJd4xGJrMUqi:AFej+9E/wgw4wzhMUqi
TLSH
T1DDB2E7F258D3883AD99E5747F33E2E064EBCC157B9806A54B7D86A0CCC862BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 332bbc37ce9b54d389cf269c60fed430449f1f8f8106a517b28a753db959c0fb
MD5 9a9a1487e0441f3a7da9236a22562f52
SHA1 635692156102e6e605938672f8a571b7d173fedc
SHA512 cbf092dac50020ae268a5e2734667243166e3a38742807911011fcac900887c2ebe57d12a45424c23a5e102126d7e415cdbbb120687f0e460d76928c9f371f32
SSDEEP 192:lON7Zh6vMtPQmiUyGzThTq4+FdLkxw847P64U/u:lON7D6UtRBTSd4xK3U/u
TLSH
T104020A35AC746C7BEA63AD46F48A37171FE4117FA9D05B54EAE82F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 683ed615f6fe0cec66fde36ea1f0f4a9f2a145e2c05ffebb38fff4ae037f28d8
MD5 1beba83b8bbbcdb07e9bfd975888e036
SHA1 f1be987762517281ad9ae69c247e854987255be4
SHA512 ca8461bf7424d7ecbfb3cafc4ddf54e2f23dac162c8dfcb4b0941e109db742b6ec85db6517f2e480a4ed2d65ef61d54c0d48a0fb1a2e822002e05bd57e7bd16e
SSDEEP 384:/tNn/s3n9SisNel727VQvM3CJd4xGJrxUqi:/j+99ixUzhxUqi
TLSH
T13F624C326824DC2F9DA3A685F04B37175EF4915BAAC42F94E5ED7F0D01CA7AC130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 610ea9f1fb5e0fe9d6195675b56ccb2f775707b338f703b5cd35adb6f28d8e6b
MD5 449e888855d4bdf6f226e502e2a9f836
SHA1 4ff4137f636cf364da1689c43e981274fc25ae75
SHA512 4711a8224eb2c188f4ac712483152836d30a96e16d35844a92a642243f10e439f73cbbe31b4129396ce884e84bb6e2dba16d2930a9a5b8d0a47c1386a4646580
SSDEEP 384:5tNn/s3n9S0sNe/T/27VQnMYj2Jd4xGJrKUqi:5j+9PQQjAzhKUqi
TLSH
T107724B326824DC2F9D93A685F14B37075EF4915BAAC42F94E5EDAF0D01CA7AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 9384fd9622318b37c08920877e7095126f33ff2beae8d3f60f7140f3c837dc61
MD5 883d05a9be1ee4150c4de6d9fcbf2c5b
SHA1 d0d962bb0e00081675da79ae435882236488356c
SHA512 25e69d680235c263da8161b5a2bebc911ab97f83a80dd3f9ff99757ecca5b8c96f6532ed965f3ebf376db6c214fcfdc19e4330d3a7516a2c1bfa808b3b106fb0
SSDEEP 192:dONX6vM7PQmiUywSzehTq4+FdLkxdtSJrM80IcqWU/u:dONX6U7R72eSd4xGJrxUU/u
TLSH
T12A12EB32A8649C2BAD53B546F08B36175EF0816BEBC56B94E6DD3F1C01DE6AC130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 bc61c045ef9c5996241a03d7ab63426b37f91ed4d42ceb47315f2da8d503d3d6
MD5 ee5f611ddd51cbfb87df26d651c58ad0
SHA1 24bd15678bf49bf4b8f5067739531134d0eccc30
SHA512 7445f7d991abe36b140adb39fb4c1ea58981ab6abbba2b3a33943598ee3eef3b34fc4f18a401e8a8edc02ee02eb8a3652fbb9e5480104d37f2766dae8f5f3225
SSDEEP 384:5tNn/s3n9SisNew727VQeM3CJd4xGJrKUqi:5j+99n+UzhKUqi
TLSH
T1F8623B326824DC2B9DA3A685F04737175EF4915BAAC42F94E5EDBF0D01CA7AC130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4a8ec0db0202a717197a7ecc1f32b56a397b7cc0d31df6f59c7a2b9b6dbe04b3
MD5 821458305d3ef363099fabb46b67ef0a
SHA1 f3e76ab29b92a59c5f485bbb4289767b0da6621e
SHA512 a4cdfecbb694d1c4b89a32aab9732c8f82f95e69044137092ac45bee5c1f89930575e605ec29ed721847f487f2a11d5ebb08699b8bc4fc17cc664148bfb176b4
TLSH
T115E004107140457DC41D473043D7111457D3C40501D10307001005705C051040D34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6bc867f7e7a21660d5de7a046bb9b1403893aa44e5ea6387a29bb4019b232da7
MD5 b436d86c03055ddbf3a84cd02d314801
SHA1 1727f3a87cadd40ef8cf30633491ff29390b1267
SHA512 6ab53758d8a8b4fe3007d068f4752917dc1089230e97f72802e1c041bad3e66518f5d07fdcd2391ce254685313b225df67b6f898661bcf02172cfa2aab8f79c4
TLSH
T114E00220B140417DC42D473042D75624AA92840501D2020601210A786C147491A34EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe592716.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe592716.TMP
Size 392B
SHA256 7270f9c4e3a980895037cddd3bf87becc0612886e15fbb962d0ba974a2ce61f8
MD5 ca025a65f96656b3032d19f042e74165
SHA1 c58580e715629a0054be0bc7e79d31675b0f5b14
SHA512 94396f4d6159b12a1fd9a641ae0639c44199eecb5059e36258f4e00bf5191f875cad5ef5c58e8e615960988ee024e23702db8e85e1fb27a73eeb3af4283d7a3b
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 44b1884427c7d2c0589b1766e0edb74e6d5a07b57473829b3b10155d9f0f5185
MD5 90e414846b720e3e34fb5af0c9850cc3
SHA1 ea4a8b937eeec879822b29306ff98a45760a1292
SHA512 a698e206c58a751573b8dc9bb807fdb0a9dcf44f391df72fcfab6ce0099ba5a6de866213989b78a9bae74d421be3aa83d9ebf4f3067e9f2bfd0b1cd7fcff47f8
TLSH
T192411859A6E91108B3B77E5AABF6A86D487FB9772F07D55D00110E4F0A22B40C961733
MD5 SHA1 SHA512 TLSH

Submit Download

kworkerd-rcu

Path C:\Users\Admin\Downloads\kworkerd-rcu
Size 136KB
SHA256 77bf85c043145dd34d7069fff7c3924074303294396ba775c070d1ff2c3a1e80
MD5 96342a612e8a9907cb0a6ebb99ed11f5
SHA1 307648359f37d50bced1278e1591d746443c35c3
SHA512 d3984c68bf3a2126c8ac272de84407ed8d07945f8f499b8ff3375c4d898149e64f55b87754f34eed97cbe04c0517bfa8f5652bc85aa7c58e3eb76d7b5ede4e62
SSDEEP 3072:rlQXurLPMpQCsY+G0tnweAb5gKpwKhek6y:rKuXPEF+G0tnweA93pwKAy
TLSH
T10BD3124B488064EEE7DC9D7D61BB9359894459D331C3C6C2939C3C356AF8A05FBCA4B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads