hxxp://Wheelofnames[.]com

Analysis

user interaction
yes
max time kernel
53s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Wheelofnames.com
Sample260702-krjv6aez21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1628	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274558118568249"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{F89315B8-A6BF-4820-ABFD-3B0845BA2236}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1968	5028	msedge.exe	83
PID 5028 wrote to memory of 4848	5028	msedge.exe	84
PID 5028 wrote to memory of 1628	5028	msedge.exe	85
PID 5028 wrote to memory of 4848	5028	msedge.exe	84
PID 5028 wrote to memory of 4848	5028	msedge.exe	84
PID 5028 wrote to memory of 4684	5028	msedge.exe	86
PID 5028 wrote to memory of 4684	5028	msedge.exe	86
PID 5028 wrote to memory of 3972	5028	msedge.exe	88
PID 5028 wrote to memory of 3972	5028	msedge.exe	88
PID 5028 wrote to memory of 3972	5028	msedge.exe	88
PID 5028 wrote to memory of 732	5028	msedge.exe	89
PID 5028 wrote to memory of 732	5028	msedge.exe	89
PID 5028 wrote to memory of 732	5028	msedge.exe	89
PID 5028 wrote to memory of 2088	5028	msedge.exe	90
PID 5028 wrote to memory of 2088	5028	msedge.exe	90
PID 5028 wrote to memory of 2088	5028	msedge.exe	90
PID 5028 wrote to memory of 1896	5028	msedge.exe	91
PID 5028 wrote to memory of 1896	5028	msedge.exe	91
PID 5028 wrote to memory of 1896	5028	msedge.exe	91
PID 5028 wrote to memory of 224	5028	msedge.exe	94
PID 5028 wrote to memory of 224	5028	msedge.exe	94
PID 5028 wrote to memory of 224	5028	msedge.exe	94
PID 5028 wrote to memory of 2992	5028	msedge.exe	96
PID 5028 wrote to memory of 2992	5028	msedge.exe	96
PID 5028 wrote to memory of 3208	5028	msedge.exe	97
PID 5028 wrote to memory of 3208	5028	msedge.exe	97
PID 5028 wrote to memory of 1120	5028	msedge.exe	99
PID 5028 wrote to memory of 1120	5028	msedge.exe	99
PID 5028 wrote to memory of 1120	5028	msedge.exe	99
PID 5028 wrote to memory of 2916	5028	msedge.exe	101
PID 5028 wrote to memory of 4516	5028	msedge.exe	106
PID 5028 wrote to memory of 4516	5028	msedge.exe	106
PID 5028 wrote to memory of 4516	5028	msedge.exe	106
PID 5028 wrote to memory of 1660	5028	msedge.exe	107
PID 5028 wrote to memory of 1660	5028	msedge.exe	107
PID 5028 wrote to memory of 1660	5028	msedge.exe	107
PID 5028 wrote to memory of 3476	5028	msedge.exe	116
PID 5028 wrote to memory of 3476	5028	msedge.exe	116
PID 5028 wrote to memory of 5020	5028	msedge.exe	118
PID 5028 wrote to memory of 3772	5028	msedge.exe	119
PID 5028 wrote to memory of 1712	5028	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Wheelofnames.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffee8dac188,0x7ffee8dac194,0x7ffee8dac1a0
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,17129647284465401837,15769399976769185232,262144 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,15608852343613861011,15512537600168048069,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,3536883565327644925,10323204653877414827,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,1658849599418761321,13700026160978975375,2097152 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,10757885340767182813,3303170466340497027,2097152 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,13226244716233760187,15770758899723216434,2097152 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,2531147414947579044,9883808701086010331,2097152 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3456,i,12255214758660187414,10502093764283247474,2097152 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15361978389388273618,15650477669205171593,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,9217958862673017213,12284545875912962642,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5972,i,70655134009017085,11454760735381529570,2097152 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,4157551342964320748,12947059320192154951,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,4157551342964320748,12947059320192154951,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5292,i,11496201726440442259,14860311928651884247,2097152 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6692,i,16254508114117142014,12769009935091297260,2097152 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,17478096503288000127,184663095075169994,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,7925776832450422007,14353323499353726676,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,15044916221532461294,2074680525452755448,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,11436012080545768107,2218783175615910466,524288 --field-trial-handle=2156,i,11016579381651486030,16530539598638177039,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ee58fdc2b50fac3fc1694925fdb1f719a089921d941bf3abb2a475e7f82bfae6
MD5 208f4277e91b31d04523ce392a146d6d
SHA1 3273db9b1e1631c9b5b622a5fc09130aeea4634b
SHA512 212f9cd534cd4854684bfb05b89abcf87c9de5c9b5c156171986122f95ae058caf71065a3aff599e9a30d4aed3924263e7b052f251f5e984495da9d52fa6b659
SSDEEP 48:6UJF981LuO3zf9urwQ0S4bRjf7Ako3oWKZVPlWFTvJrTvzRp2MRx81ueiJxXr:bFIZzf9usgUR3A+Jg3vbpj81AJB
TLSH
T112A191A433119BE5EFE68D3DE9D10AC0397A61404913AEA50270977D27CBB9F4C139CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e8c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e8c5.TMP
Size 3KB
SHA256 ce97de1766b5d63bc2525ba8b0fcd0d56e650abb652c5cabe2590f340ac60ab1
MD5 ba35726fb48afabab1a79ba6155c97e3
SHA1 9173f8925a38a4ccad97dd00140ba8c17e6f7973
SHA512 7e6ee4d41a8c718e0f45290fd43adb04e89a5126e68681a1946c4fc568e2979e1031bce103392f8331986bb1113299b4845e0611222aa8cbc8ec700501ef0c14
TLSH
T15171C3653352A8B1EFE5493CEDD24AD979B0B0880A139EAA00705B3D2BDEB5F0C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d730d2ec5fd28799fb487dac092e53f99c7dfe840d61a172f8263d88cf79a129
MD5 624f9e1d7327e8ff5686e4f453907e4e
SHA1 3f84e3fad4615f344e79332372e009b2a33a8d44
SHA512 c805fa4223f6ef6126b879e791b3d2a061011bf42da974adcb0ab1cbcf8dbace185dfb06cb8735c38ef5c4b085d02787488a006e46d96d33d18fc154b3f86631
SSDEEP 192:sxZIRIyM/jK1Ml8Mkq/fOs7TVBEcIdpy3HW6+WNhgH/Y4EgFvzIgrJ:sxZImMq/fOs7T4F8HbS/NL9
TLSH
T19F52D912AA346977CCDBD209FA55BB53D5F50572E2900D44AAFCCA0C05E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1f182195fe395c3761571df21ebeb2bc36b56f29afea0b2a0a929855d1d3d9d2
MD5 628640fe61fd4ca38def16ef1c32e602
SHA1 0ef60b1b86ddb603da00a2b09954c61bd7ed6834
SHA512 289b30800538a7de9027aac88e851b6b2a84729dda815eb2c6a9a96ec9b832b58ba7732b1a27cb5ee5cb13288d57747996cc4dbc278540d0b726fbdafaeab56e
SSDEEP 768:3n8iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdsrozkRUnH:3n8iJPNWvx78ru1jahALocd3qUH
TLSH
T1E2E20A3B680CCB7E4F844E9CEC266F966DE801CB6B948D5447FA884C03C76EE512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b0180011d4a89290f8bd8f00b300cb33524f5636d58bdffb3a9958810b314b14
MD5 1ed5ea41fc2c613f5a79e6c5e123853d
SHA1 cf23c4102914c881bb0cc2a673bc9fb4a1ec742a
SHA512 f29c9fe8384756a91712c1b1a2a304febd8972f0ec58c28b1ade1b53ef2ded7d46756a22bf4ec6edf4faf235a6feb8f4e012e1912ad59ebe69e79c89fb6f6f03
TLSH
T19FA0025121A25425F5106A7A208386543760AE5052011612A0F009668951350414A46D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5f5aedb18771a2cab39f2bdf1ccee8719b74e1586e17ade013cb4858c3134646
MD5 180934e739008c826a0ef7683bcef9a0
SHA1 98b767afded4bcc9ca22291202bf9b91d4e70311
SHA512 cbe4b6245e2f9ad953574600d82cb7eef9925114711a8e6fcf20c2a82a6ef517939e60aa41e5b4dad9b3244b11fabb3933da27999c59e510d6da236a72cc72a0
SSDEEP 96:KoZ+Ky06SCsKnqNFSr/VPTXWbAOgHXK42gZXc9lYrj8HOjyuIx:093wFSr/VPTmbAvHN2gZM9lYrj8HOjyp
TLSH
T1B2917262317F02562C7E250DD1A49767DE82B2A33164B82B77AC01B28F67E214CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f18a5d1697c5c7fb034bb432ccceace25e57c9c67fe2595bdfa831c1c1a504c
MD5 832c8cff9558401267f65bfd2d2ce9d3
SHA1 b676def39e306aab966a269a2e9eb182c4590154
SHA512 3d68e9b9ac815d92167e976e23680b0d191c4e31d2dada901df500886e10884542880b06dae366f7f1c514dd7882fb75bfa85b70f0470a1a0a7fa73445456fa3
SSDEEP 96:ZqONkmGQsjpfmUTmDK5ih/cIPURHl8h4otop565D8BhPwivh50xy0SFYKRAxcbsH:gONp6kDfQmiUyEQZ903YRQi9QU6
TLSH
T1B902D83568BC2CBB8EA3AE49B48B37275FE5113BEA952F84D5E81A1C40D725C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fffad01cb532337ea0b6e301e6b10cbd71164f9138357de3870b9de59458196f
MD5 7be1639a67d801985f240041b7ac6d89
SHA1 2fe767cea3f5267cef5e2d09614bd341a622a0cb
SHA512 23b5a0ba6b16f8cab5eb5e7ecbf606a55f9f944d0d4860f8c7d4a40f1152bc8156945ec1a04efc65c44dea4f6c41c80ad7d2d742a2babec428e8f9833a5dd44f
SSDEEP 384:xtNn/s3n9SfsNJtMpbi1kVHteqKl8BhBTPLBliK:xj+9UyLqKl8BvTPaK
TLSH
T1FF926C729C686D7B4EA39948F0473A1B9EF88277E3C52F9095DC6B1C04DB26C5307A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e3b3a35ad22cd0d32a5b14a3516761ba0cf993b2d9c612e4090da5ba58983bf
MD5 6e38c3ca1f69abd48138d2c0ce5f908d
SHA1 fc93c62ce1b331222421b849ce97e36ea59b5a55
SHA512 43dd9c37d43aafdddc4cb8b2c1a913accce62b291ed96c14fa1fa40e861e1ab37ff0a96606e83e9a548a4fab5cdef6e90d640912f5d16cf1e079cd44010a0bda
SSDEEP 96:8qONkwQsjpfmUTqK5ih/cIPURHl8h4otop56tD8BfPwivh50xy0SFYKRAxcbsa42:nONE6kzQmiUy6QH903YHHNncRZqgyU6
TLSH
T193121A3668B86C7B9EA3A545B48737179EA58227EBC97F80D5DC1B1C01EF26C130B522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 caf925faceb35b1eb703d901c39a0d44fdbfabf656fea76cb8a11307be45549a
MD5 bb21888d9f37663eb7349c1aa166e3f9
SHA1 4128dcefce9f4dbbb47c13964184b9db28fef29b
SHA512 9f92ecc3662a839026151ca683d2579d2213f9423ddf4d0a0caa75e21885583f56298834bd4884c060b97511e2a0341af5e44c0c24ca63510fc71c59e78e7483
SSDEEP 384:jtNn/s3n9SfsNJkMpbi1kVHteqKl8BhBTPLBliK:jj+9U/LqKl8BvTPaK
TLSH
T159926C7298686D6B4DA39948F047371B9EF88277E3C52F9095DC6B1C04DB26C5307A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

745ebfc6-e449-4a11-8895-0911a7ea7ab7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\745ebfc6-e449-4a11-8895-0911a7ea7ab7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cac2f4436f1f16538bdbdb4ce4b28af2ea3c858b65c02995cd781599c50c3d91
MD5 77149ff775dab108df30b6c0fa901126
SHA1 be722a2068ba4c8d7e6300d5efdd71bbd68bf3a0
SHA512 9d3a99b09f5df2e213049c8a8fdbce8b602a05dd44a98258db42b50702e0d76cb80b73c3644d387a94fcb06039bd80456378cb81efffa9de9701188d48a8fc93
TLSH
T1EE41065CB6ED1108B3B67F5A9BF6A86E487EBC732E07D49E00110E4E0662E41C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads