ebf5c445d42268ad120a457708589e9ea0ee18896ee3cbb8c2bae53dc4bc2b9a

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress-6.7.2-tr_TR.html
Size 98KB
Sample260722-w4bwvssalg
SHA256 ebf5c445d42268ad120a457708589e9ea0ee18896ee3cbb8c2bae53dc4bc2b9a
MD5 fc04596858b7ce4b40518aa12234129e
SHA1 2f9d60b71b321e73d889712c4cec9e5488096dcb
SHA512 a2ed160171894fa0bd84d7f0f9625526f8f7230e23d452ccd8c94c88a7890dca11d3eee3dbd7726c31feee88921eda3323a1d454641a48b3825b4124e0d9942e
SSDEEP 1536:e+eJGpi36DdXELiGLaZmL5ypu8QRn9me1LALaYAQAH8WAza9MHIfqAgdVeUsJXKz:e+eJT0qLAL9AQAH5AFdVXsJxq
TLSH
T129A3A51253A488FA36DF9F58575DF70CF10A6840C5884BE7F176E118A6CCAA994B3B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2912	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292184983002363"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{ACBE6656-3539-4CF3-9F56-063BA5AA1A78}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2300	2516	msedge.exe	85
PID 2516 wrote to memory of 1056	2516	msedge.exe	86
PID 2516 wrote to memory of 2912	2516	msedge.exe	87
PID 2516 wrote to memory of 1056	2516	msedge.exe	86
PID 2516 wrote to memory of 1056	2516	msedge.exe	86
PID 2516 wrote to memory of 3544	2516	msedge.exe	88
PID 2516 wrote to memory of 3544	2516	msedge.exe	88
PID 2516 wrote to memory of 1884	2516	msedge.exe	89
PID 2516 wrote to memory of 3508	2516	msedge.exe	90
PID 2516 wrote to memory of 1884	2516	msedge.exe	89
PID 2516 wrote to memory of 1884	2516	msedge.exe	89
PID 2516 wrote to memory of 3508	2516	msedge.exe	90
PID 2516 wrote to memory of 3508	2516	msedge.exe	90
PID 2516 wrote to memory of 3384	2516	msedge.exe	92
PID 2516 wrote to memory of 3384	2516	msedge.exe	92
PID 2516 wrote to memory of 3384	2516	msedge.exe	92
PID 2516 wrote to memory of 3656	2516	msedge.exe	93
PID 2516 wrote to memory of 3656	2516	msedge.exe	93
PID 2516 wrote to memory of 3656	2516	msedge.exe	93
PID 2516 wrote to memory of 1668	2516	msedge.exe	98
PID 2516 wrote to memory of 1804	2516	msedge.exe	97
PID 2516 wrote to memory of 1668	2516	msedge.exe	98
PID 2516 wrote to memory of 1804	2516	msedge.exe	97
PID 2516 wrote to memory of 1596	2516	msedge.exe	100
PID 2516 wrote to memory of 4700	2516	msedge.exe	108
PID 2516 wrote to memory of 1588	2516	msedge.exe	109
PID 2516 wrote to memory of 2644	2516	msedge.exe	110
PID 2516 wrote to memory of 220	2516	msedge.exe	123
PID 2516 wrote to memory of 220	2516	msedge.exe	123
PID 2516 wrote to memory of 2708	2516	msedge.exe	125
PID 2516 wrote to memory of 2708	2516	msedge.exe	125
PID 2516 wrote to memory of 1984	2516	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wordpress-6.7.2-tr_TR.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8e5c1c188,0x7ff8e5c1c194,0x7ff8e5c1c1a0
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,11783784417951813098,3842035340598858897,262144 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,15166180771207486023,4162197145089866659,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,4108322463370482283,12591931137005989008,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6452229456500828027,2259608746216874809,2097152 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10937126223314371788,11902191287854596680,2097152 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,9341096527700293809,6741918561042179979,2097152 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,5000093977537807459,1290943514707213869,2097152 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,15080654743341489084,13020790403981857781,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,1015695107726636771,18043093099910878808,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16358141449499633792,16100038987497836624,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16358141449499633792,16100038987497836624,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,2890989053575254418,6701311063774077554,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,6774866179000345735,18439979001113411663,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,2251826450862438992,15094033527207986590,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,1218556998528778117,13449877788773917267,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13721276216325710730,7147384534773548089,524288 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,13188964691959626604,10332222868829997647,262144 --field-trial-handle=2240,i,13566913213512692225,18338373667211997345,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2af71bf79431918cd4b4ca4f3ee744f53ab329796f58cca2a934b1fc9334b95a
MD5 6f742234f7845fef548c3d5125435bc7
SHA1 214c1ad5a954f124f3ec53f5dde26249e73e8c27
SHA512 3b0a00b45e3d41c1b91f6d05387742c37edcf3f6ce540f3e352c8824d5173e1db5c5ae9beadcd27aad3d47be4d5bc782e6050ca04918c8177e4455ee8f1bc68f
TLSH
T1D861E834022146F5D3EA123294D30E8C75B586F6F9077E0B79D4DCF7E7A5F520029946
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b215.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b215.TMP
Size 3KB
SHA256 6c0f102004a00c47dfff0faaac12dd702c671be10b22e48ea1e59f8f378030c7
MD5 2040d05801dbd7b463c2bb37c7f601c1
SHA1 b716159704e1a6bbb534bb17f4545e9c22b94574
SHA512 a66cb382d87cc8fd6f1b14f42f632ceb10d7a4658fa53d973820792c65a628762ef52ba448b6366d35826c523dd0f227e2348f72a6ee85c83b0740c4459301cf
TLSH
T15E61E834022146F5D3EA113298D30E8C75B586F6F8077E0B69D4DDF7E7A9F520029946
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8117172bf1ab189beb0bd05e8bfe5a710e7d0c515b4ee1dfe050f67378b90ac1
MD5 549fed1f8fd53ec84f4bff017c390338
SHA1 cebe0de1ea0d4d8fd52e070beb701545fb544637
SHA512 05d72f8b5fe32892b435156020f9d8b3f52ffc4edf6b4e498d2e510970873c45902a7956f5a9aebda5cb02f7703ae101a6f70168f1979cf6fc8515b3fb113b49
TLSH
T1D82149F7C2D5866EC91556F06B24AE1ACE1D094682283C1689F4FF2B93E2475E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 14d31301fecc32b7b741681a7e2b813842b852023a2eb1ce2a86432bea6c1bed
MD5 b080b302d3435dc5b1bdb40b30fb57a5
SHA1 2c7c0c89438911eeb0966f2130fb81b20f6a8aca
SHA512 32e62f92295b0ccfba9b570d1477c8763ffcad96a7a2776decf77ed104bcb328015b9407960ad1aecfc853df9511762740e2988977aad5b61ed910c80a95c108
SSDEEP 192:sxZmRUyM/jK1Ml8Mk//fusBmpUNIdpduHW6+WNGY9IKf3KIgrJ:sxZmqM//fusBmpHgHbGD9
TLSH
T17942D816AA345977CCDBD209BA45BB53D6F90472D2900E44AAFC8A1C01E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 adf2a95fd72b25cbd09f0084846abc4a9d779d0f547be84835f5588b9ee90ef2
MD5 efa52ddb33707b0629722de3daef773d
SHA1 abc764dd8eecc5953dedd25972ccadfd232eae90
SHA512 fc447310eb0b03f99649feb66761c78b613c50eadc7041115d8e2040401c9e337dd57e920423b4e10f5dced6de15808433c275c9748001b172c761c4f072e676
SSDEEP 192:sxZmRUyM/jK1Ml8UQhk//fusFmzUNIdpHuHW6+WNGY9IGe3KIg5fJ:sxZmqqy//fusFmzHOHbGWj
TLSH
T1AE52E916AA345977CCDBD209BA81BF53D6F54472D2900E44AAFCCA1C01E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e8cff02af3801cc921468e1ce77de87cf619cb0c7b10c6fd21b40fa608039f1e
MD5 224342241e632d04b1f7d4c3f0fcf601
SHA1 08b270ef960181bb7ee9806118ac524990b65706
SHA512 89350cf6749c45ebd10d2bfe9b205e1f1d9d03a65a555005315dc297dcff0f3c5ea4afb982834946824be990a40f74582b3d9a9f73d23aa59f166dbade3b5558
SSDEEP 768:N+cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNyrong6g:N+cv21wWvu+Z+u1jaeFLeRNpnQ
TLSH
T1ABD21B2B280CCB7E0F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

729e3097-bceb-44cd-94e4-b6ea3cf45ab9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\729e3097-bceb-44cd-94e4-b6ea3cf45ab9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cf01fa7398cf031a20ef55f5529cbded8541a0e573c7e535c5424f0e9a54cda5
MD5 40bee8c0a3da978be2e34ee9cd1ea26e
SHA1 6f07f76373d6af27aed4d917ec84ce0cfcde1526
SHA512 d8bc8c06396d2b56f97529a0029cb123fe7ee4b8059774137fe5ff3d5787f36e301475d02540fea8066771eb8f1dcadb23e71ddb155cd85e38de935de9568612
SSDEEP 384:GiFLzsNx8TUNTUlIlNRcA6Mzi4UGe+C6BRuxMrJrZOufEScjmw1:tFfMwg6A64CRi4MrhwX1jh
TLSH
T1B4823B3798948D7BAEF69A44F98B32139FB440B3CA856B90E6DC6E1D01DB1DC1306D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6260858ba5a53924b33fb8d013f33594330f4661d3627225662bd815eb04f4b1
MD5 9d616b328500382370e3bb52fc4e4f9c
SHA1 9724d9f2350cf84193d343cb8b4ba1ac2eec5571
SHA512 9a8abbc750e2b64ca25932912c4a4229ab30f8394864db21efb03c9a54bf9d6d8cf5d707c764bc7500aac4b21ea59d56094aa2985ae6fbf6b8e499327e257c67
SSDEEP 384:GiFLzsNu8TUNTUlIlNRcA6Mzi4UGe+C6BRuxMrJrZTufEScjmw1:tFf5wg6A64CRi4Mrh1X1jh
TLSH
T1A4823B37A8948D7BAEF69A44F98B32139FB440B3CA856B90E6DC6E1D01DB1DC1307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 4eb837c608725453a0ea9d1dfddcc27fc7d01daadfd9b16584f98caa211d7f96
MD5 ac94a5ae43648fd744e514e656cd0c91
SHA1 0fcef6163a09f92b6b0b43379fd904a8e5043636
SHA512 e0889a8d7c33d7e1f7e1814a4d9b2b5fb56bdec46d737c1f7dbe36057681eeb3ecb3cb40120d2a8046c02381263814f54a5efe69a6b4529a1f0d8ad540e6bb66
SSDEEP 384:AsNPNRcA6Mzi4UGe+C6BRuxMrJrZ5ufEScjmw1:A9A64CRi4MrhnX1jh
TLSH
T1C3725C37A8644C7B5AF3A545F4873613AFB880B3D6891F80D9EC6F1D02DF2AC6306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f62c52e5cbab2d781f5bc34837459b46b0d7d8b3b8b38ad3c3d85cb805074d31
MD5 fbfefc86a454b2d5d91c56bbea87677c
SHA1 27809d51e50796a7f65017cef7971cf82785204c
SHA512 4498d61d57f8fe898e2987c6c0f778bd7e29846d7e9e3c2af989092ffef040bee7109808a86208473d215aabce597164fbf0fa2f8c58040a91d043e7308b8f94
SSDEEP 192:JONx6v+YLNQmiUyDuZh+CG66BMAuxYusclU6:JONx6vz/7Zh+C6BRuxugU6
TLSH
T10F02F93AB8681C7B9FF2AE45F58727275FE91177E6962F80D9E81F1C01D764C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a4ac51e6906508f521b0d8e92de407ea0052fe75437d45728684798443e275a
MD5 4be9303ad029cb6af0babc7d4cbe712b
SHA1 1f59c9687131a47589fd4d488786f70f0147e6af
SHA512 eefe9054f275643f668f535f49b383ca6748b86522931d339b9d18e6d060437fe448192164fb5db55ffa5cb416381b64f79b742cffec857ec5ca6a9432575be2
SSDEEP 192:+ONC6v+YLTQmiUybuSh+CG66BMAuxMcSJrZFCHuhqYEU6:+ONC6vzx1Sh+C6BRuxMrJrZSufEU6
TLSH
T1F2120A3AA8645C7B5EE2A940F4C735136FF94177EA8A3F80D5DC2E1C02DF65C634A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1eabc75446e0c2a9cb6cdaacd3f4e09ed53116af23640fe4978b07af5aa7a204
MD5 a3e8425a57701ec9368bf48d7bbd4af9
SHA1 25ebfc30d863c40fd351890e9831ea40d7659d35
SHA512 4d5d90addb5a7dd79ac36e9a9afd3307e14d91c50cdd71416ee811e3b980e53ef8ebc3832b2d5271b3bf64d3ffde8da9309b4a596de74925134e9e10d43c4cb9
SSDEEP 384:TsNPYRcA6Mzi4UGe+C6BRuxMrJrZ5ufEScjmw1:T2A64CRi4MrhnX1jh
TLSH
T159725C37A8644C7B5AF3A545F4873613AFB840B3D6891F80D9EC6F1D02DF2AC6316925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 98df47695b6101ab0a7b152ee9537e80115fde32559daa85ca64e74860452849
MD5 57d07e07387cf5683a1711eb10d71dc8
SHA1 e59754ec8d635ec41ddb293ed8029712193ba34f
SHA512 97f29f33a0a9e83342c6f16bc0e64fdaedea4fd00eec1c3ebdbb2aa6f87d547e252614d87b900b0982f3fd7f57368942d49970871eefb6c75f4c6bbf1f8c546e
TLSH
T1FF413B4CBAE91148B3B26F4AAFF7A86E487F78672E06C45D10150E4F4623B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads