hxxp://ruwark[.]com

Analysis

user interaction
yes
max time kernel
62s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ruwark.com
Sample260804-trm29ade75

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303339116309264"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{61B48721-4213-48C9-84FD-DF184A5C17C1}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1808	1700	msedge.exe	85
PID 1700 wrote to memory of 1812	1700	msedge.exe	86
PID 1700 wrote to memory of 4944	1700	msedge.exe	87
PID 1700 wrote to memory of 4944	1700	msedge.exe	87
PID 1700 wrote to memory of 4944	1700	msedge.exe	87
PID 1700 wrote to memory of 2924	1700	msedge.exe	88
PID 1700 wrote to memory of 2924	1700	msedge.exe	88
PID 1700 wrote to memory of 3356	1700	msedge.exe	89
PID 1700 wrote to memory of 3356	1700	msedge.exe	89
PID 1700 wrote to memory of 4568	1700	msedge.exe	90
PID 1700 wrote to memory of 3356	1700	msedge.exe	89
PID 1700 wrote to memory of 4568	1700	msedge.exe	90
PID 1700 wrote to memory of 4568	1700	msedge.exe	90
PID 1700 wrote to memory of 3164	1700	msedge.exe	92
PID 1700 wrote to memory of 3164	1700	msedge.exe	92
PID 1700 wrote to memory of 3164	1700	msedge.exe	92
PID 1700 wrote to memory of 2520	1700	msedge.exe	93
PID 1700 wrote to memory of 2520	1700	msedge.exe	93
PID 1700 wrote to memory of 2520	1700	msedge.exe	93
PID 1700 wrote to memory of 880	1700	msedge.exe	96
PID 1700 wrote to memory of 880	1700	msedge.exe	96
PID 1700 wrote to memory of 880	1700	msedge.exe	96
PID 1700 wrote to memory of 3588	1700	msedge.exe	98
PID 1700 wrote to memory of 3588	1700	msedge.exe	98
PID 1700 wrote to memory of 1776	1700	msedge.exe	99
PID 1700 wrote to memory of 1776	1700	msedge.exe	99
PID 1700 wrote to memory of 3368	1700	msedge.exe	100
PID 1700 wrote to memory of 3368	1700	msedge.exe	100
PID 1700 wrote to memory of 3368	1700	msedge.exe	100
PID 1700 wrote to memory of 3648	1700	msedge.exe	104
PID 1700 wrote to memory of 2564	1700	msedge.exe	106
PID 1700 wrote to memory of 2100	1700	msedge.exe	107
PID 1700 wrote to memory of 3248	1700	msedge.exe	115
PID 1700 wrote to memory of 3876	1700	msedge.exe	117
PID 1700 wrote to memory of 3876	1700	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ruwark.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x210,0x23c,0x240,0x21c,0x25c,0x7ff9f3a4c188,0x7ff9f3a4c194,0x7ff9f3a4c1a0
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10061375061094346964,12249709312718963455,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,7019972286788022357,281121553954776280,262144 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,5621123664563321560,8969478833878049,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,5134738288289837426,3606657648174588774,2097152 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14835991344735618427,14928241459899062524,2097152 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,6610938086712855510,7139850786551454224,2097152 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14294295821667975248,12333137816456072629,2097152 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,14504144478309502637,9807742555160541914,2097152 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,6000420079827065294,6431049869791076125,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,7608659395486842356,5283064143633920176,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5660,i,16086855472739004326,1201352046715082411,2097152 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1293217678808549513,17128345455170270913,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1293217678808549513,17128345455170270913,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=568,i,18049833526717518511,6099587738832057572,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,10467174909543990764,4255006298108140175,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,1362858298600223157,12065342118420841003,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,17904352697107613177,13775092844853374339,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,14761008915753828803,15739491024517219296,524288 --field-trial-handle=2224,i,15169797701271767658,8379320199013620588,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2836

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 484bcb5c661e6c1ab7c1e8eb0c2dc5467b2aad2bbfa7193f8c39808e2bc6a2bc
MD5 0303b5ff4733f8166294ea49530b902f
SHA1 dcaf0862a7b91f354c8fbd6433da224b0d79fe0f
SHA512 3c3ff7263abf5e7941634b2d489f03a0b875cc87021be2b45ea0f9cc3587625ccfb24009d6570292f82c542e63f3bb31ee266157332eb559db4019f9a6131084
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 64c9b77207fc806c1f2429323a3e5337f988dcd94e3eebfaa38f7275ccf667b3
MD5 818a63066996be55dc5742d52c2aeb25
SHA1 0e31d45633a85388512e69dd1c4b8c624f19f74a
SHA512 3bdec07cfacb366b488d2511ceec5ce97c2e5fe6b78fd554d4607ef59fbe6dfebfa17d83a4c0e43a6300266c9293be4d4162352e651a0094f49ecca5cefd7079
TLSH
T1EA513E54C2620D80EB901633D0D11B603A76CAD43BC79F65F28499F59F0EF2E9E7D109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5936d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5936d5.TMP
Size 2KB
SHA256 e560bd2ff1a8a284272ee8326900bb27a04bbd48bf3c5359eca2911ebb248aba
MD5 02aea9c4e7220bc1a820331168a00d73
SHA1 16d5e19b0e127f65b346cfbe7419c8c7fad094a8
SHA512 1c8ef0734a1a5c61fb6b716a046b5be6c0b7c3212317b952c55b59d246164e4bceab6f495bd442a22944b478b3169348bd10fe7a980ab9aef0bff84527426b80
TLSH
T161514C24C3520D91EB911233C0D02754367AD6A83BC76F94F28858F91E0EF2E5E7E119
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c9941ef-7813-4df3-90d7-26efa5d1b675.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7c9941ef-7813-4df3-90d7-26efa5d1b675.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c10ce3efc90dfb7a322f80b7d4959ffb8b36fd72299f726f76c6f65c2a103646
MD5 9877ee120936ca7e6bc0f46cf9f02c4b
SHA1 6c02f6605019cba4d7f520fab109172d512208c8
SHA512 3c7b6f3d5a33dc5f5d2992ac17c72f551f6dfd7403b8eaff16be71bf7c1a9137b46a3661b1c2efbff58fadd7c298a262d69236eb25746abafc3610fd1f561a03
SSDEEP 192:DnRmaCGXLede3GajfDZgp3Lni51LVRtEN76A2C8IcT:DnRmaCGXLede3GajfDZgp3Lni51LVR+o
TLSH
T1A2E19EA3C3D5C16DC90A1AF45A59BD1BCE590624472C3C39C9D8BF5BA7F2431E202A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8f913e3e7e148ab7e4cce87d05ebfe6808f9f3826535b1b37f9a117ac7e3580d
MD5 71540df4f10bb8c2f47dcbdfec172280
SHA1 e080794415137786c07efa166bf2f45da54cfa86
SHA512 b133abaff8ff1659e774ba9c9f0528d9143748112666e622d7eaae308abb69ad143f8b1cc180c6a0676a9a38a978345bb1d7bf7d37398ad9afecdd1827fe6a17
SSDEEP 192:sxZSRcyM/jK1Ml8MkV/fesf7gDEdpiZHW6+WNR0r/Y9INwBIgrJ:sxZSmMV/fesf73GHbG/M9
TLSH
T1E642F9126B346977CCDBD209FA41BF53D6F9157292900E58AAFC9A1C00E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fa3d3e09dc3a787ec6474b2766c419f9ae57c7810250b7d676dc5a0a67cd01ce
MD5 3a5a7dcfa75747c677de36b24c45eb9c
SHA1 a690c9ce49dfbfd5393bc08219ead58c4f86bfda
SHA512 be79b92a33bc1209db9774f9058bcaa5bcc5c7ad7f4e07dc5faf2e5f9e6d40079fea91da5ed1d5ce165442dfa53e7ea67cb81dde44ddaaffbb691ae6de187a4e
SSDEEP 192:sxZSRcyM/jK1Ml8MkV/fes6NgDEdpiZHW6+WNRDYXY9I2HwBIg5oPJ:sxZS+MV/fes6N3GHbWXfc
TLSH
T1EF520B166A345977CCDBD209F981BF93D6F5157292940E58ABFC9A1C00E3BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 25afdf58303ffb6969aae7c8b60c594f622c976ce8576b475914ac91bed7e597
MD5 f89f720d421fdc975288a59451a8f36f
SHA1 1c2f621d12d4ae01b20135e7d7dc994013b60a5a
SHA512 7fc03fe9f68c20fc290bc78ece2ceed12f48cbec03b1297e412c4b826391e395a395babc78e06cb75e43d21876836702f75ad4e81812f42880e8c7671e570a29
SSDEEP 192:sxZSRcyM/jK1Ml8M9V/fes6NgDIdpAZHW6+WNRZGdY9IBs4HBIg5eHJ:sxZS+1V/fes6NRkHbGdXNc
TLSH
T151520A166A346977CCDBD209FA85BF93D6F5147292904E58AAFCDA1C00E7BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 670edeea6875a6a1b5cb423dd1a4b0fac0f145de8732f0308c56db2e6fba45ce
MD5 ed662c288633d39a54877132e67928ec
SHA1 e6dd6790ebfc9388f41c4c30bc58a08a070b2cab
SHA512 602d7129bcb13c0c0ca593e6b6243bae45fae101269e2e2f54d50e3eb4fcf576379bea0378171ac25b98c393add30ca5860657f13d345ff4788b19d6adca6770
SSDEEP 768:mzcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN9roDg6n:mzcv21wWvu+Z+u1jaeFLeRN2DX
TLSH
T119D20B2B280CCB7E4F841E9CED2A6F8A6ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 42ee7f0ff702f164aebc0f8144e641cfd24c179f924c81e9307af107ebbb1041
MD5 f425c1cc85c2323b36ffcebe99760d6d
SHA1 6a019dd623a070533e872898196cc20406f76c7e
SHA512 13ab2ba356299119c842927e0fcf67f07204edc14459e49c0fd2baf91634c6206416793751ae8bd69b6285db2b44cc6632b7a134e29180c6d6044e3aa6855926
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD6aEKPaGO1WKO06C4AKFeRGri2AEok4EFPb:mTfLRl7Mxg
TLSH
T123D16215B17B0642287E784CA79286374E4631E7780CB4AF7FB840A65E6BE114DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 d0194f639f39368f7d744a9a54c1175b8afacba99248c0eaa9fbe53be7ea2e23
MD5 58ca8fa1201ae8962da887720a5c47fc
SHA1 e29eb19d3d8d6a5fbcda41dcd467f67a57ce04ac
SHA512 a47a7a90ccc56aef9b1f93a5090fcf3e70f55fabc3de165f1c651434d4c2e3c3d4b97cf471acd23c3bfbcbc4397a26ccf64b49dccf8f3155ad46666a7cbb4301
TLSH
T18F21658093EE54867FCAB986C209560396E23E9A190D5871B33E95F46F88C240F6FD29
MD5 SHA1 SHA512 TLSH

Submit Download

9e9141e1-7f9d-4968-aff0-c0c68e2d5092.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9e9141e1-7f9d-4968-aff0-c0c68e2d5092.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7226d1f57d28c6e611f009370ddf6e196311de9880db4a535ab56b53c053fdd1
MD5 a8e2d67e881955d442cacbfc14356ee1
SHA1 d49f17afb7ff81e3a17c40dd861e6893495ec3ca
SHA512 94fe7548c4037222837c83c9b4b415063a9ace4782f66ccc15f57e8509308f7f4fab66340f89385883766c0df867acd559b8fa14a945348cfc3003c35d90b633
SSDEEP 192:gLsN4AQgiu6+YLe0jQmiU1sfr4e+CGSO49oyfEJiuqu6dD:2sN4Auu6ziIm0e+CzO4eyfZSq
TLSH
T1B94239366D381CB79DE2A585F44B32238FBCA077DA852F9496DC2F1C02DB69C134691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 bc33127ff074bdf8a3f256675a0bb4b82e9e5f8d7f8ee99f332dbeb7c4343f99
MD5 5efa44d5cb49a3451c9bf05e9414dca9
SHA1 698c6a7ad99f2fc3643363e36f1e9e448ae46807
SHA512 9a21ac35859ce24de888a64a9d0f7b0617498ad9eeb174de15ffaee681621a073a77f545ead25b1e69fabdbf93b863958ec905b6e95ced3d0853fe68b1ed065f
SSDEEP 384:ciFiZcIsEsNo8TUNTUlIl3uu6zikO0e+CzO4eyfSSBeRs9JKgqijUBP:HFQLJwgyg/rOXyfSSTjKgqmUBP
TLSH
T1E8A27D325C688D7BEEF6AA81F58A32178FF99067D5C1AFA4E2DC6E0C01975CC1306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6a9053cf0ebc12bc19f2b63f738cd2653ac3c36f0557642113ae583fe2bd8896
MD5 d7c10629a5741aecf603460803e2c362
SHA1 f7a7ccfd9e6d5eb7b80a0af397bd8f2ee8823548
SHA512 881967bb30f6d803eb1c007343c7bd598b6e17149dfb6afdf21eba53fa4ea928e7659dcd7ecbd8e9297ad2517c43ace334df871454a5c4ac68c5465cb4be290f
SSDEEP 192:u98sN43Qgiu6+YLe0/QmiU1sfr4e+CGSO49oyfEJiuqu6dD:VsN43uu6zikm0e+CzO4eyfZSq
TLSH
T123423A356D381C775EE2A581F44B32138FB8A0A7D6C56F94D6DC6F1C02CB69C134691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2cdc3cb2f135c57cae88dc9dbf682e4a21236e5bd1fca8d066d02fafd454779f
MD5 1739646bbaf05333e8c442109948cb40
SHA1 68944d811c3038e7271070e7556b017aa61f29d3
SHA512 38240422e431f2596489701c5711af31d4cde050e6c7099fcfb79be424dba01c2622fdafeaee7fe0cc0d9eedfe780274f21749c8bbf2db95df610e5fba0799d0
SSDEEP 192:JONW6v+YLNQmiUy+XZh+CGSO49oQusMtU6:JONW6vz/rZh+CzO4eGcU6
TLSH
T16A02D8357D281C7B9FE2AE45F58736279FA82177E9912F84D9E82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d60342291b5a19f7fa6e23085d5cc137d846f95b97b8a921c02e037a7525ff2f
MD5 bcdf41936ab7526a165862cfd120101c
SHA1 b5d5324de287b2d775dee7dae674bda749055af0
SHA512 b9e643c99456e125b2e2466def60de8cf9b85e27d05c9453cbc27e7238d9b78676a48aeba3b2093d56547156623b85f560704234c991c42e6c2106995dadec6a
SSDEEP 192:ux8sN42Qgiu6+YLe0/QmiU1sfr4e+CGSO49oyfEJiuqu6dD:lsN42uu6zikm0e+CzO4eyfZSq
TLSH
T176423A366D381C775EE2A581F44B32138FB8A0A7DAC56F98D6DC6F1C02CB69C134691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4dd926ad1488f8b281c6f21a440876298878059b49d62045036a13ad30f9b610
MD5 f082bf1e74690db79730382fda0f8300
SHA1 30676fa244255681cc86a78f7ed5149fb7e83bef
SHA512 480de88f02f358b65d960d71e02d735d612cc48ef71b65e94e42b69c518d1c4681396980607448a6e297d2c2900792ab9a237dce8e1b980fcb2b1d761204ab4f
SSDEEP 384:XZcI6sN43uu6zikO0e+CzO4eyfZSBeRs9JKgqijUBP:f6cg/rOXyfZSTjKgqmUBP
TLSH
T1DC928E316C381DB79AE2A581F58636174FF8A067E6C56F94D1EC7F0D02DA98C230692B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ececf3eeaf5a769d66cf7cfded429293c20c1154a3ba9058fb211b2f822af6b
MD5 4c28eb2b113f0941c9abf4e8dec1b43a
SHA1 4270963dfbfb24f406faa3826f90cc6597ec599c
SHA512 e0ab7dff1005973eb6e052ed07066180b3fe1680e5231965e842f9ab7cfc557263345bd7b2ebbf1f2dd3d56964b630e90ff4bf2fee88d03e0d9dba3266b6650c
SSDEEP 192:8ON56v+YLVQmiUyaXUh+CGSO49oyfOCHuquU6:8ON56vz/JUh+CzO4eyfPSU6
TLSH
T1FB123C357D381C775EE2A980F48736238EA95167E9857F80D5DC3E1C02DF69C230682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecab1241-0b30-49e8-b35a-bc215aff5281.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ecab1241-0b30-49e8-b35a-bc215aff5281.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 245db7f3b6ad26261d6c0e58055cf18001ba92112acbac80b49afc6176e9365a
MD5 826806973a0a43e3941639df1716b458
SHA1 b9b667e8473457a6946c453ea780063c99de8853
SHA512 63af5789c10661fe9768787a94e8e4e41167db1bd698e827ca2f902a5bd856314774f536fc421ece343dd3b0d518f173d7cc003965d150aeb5b61211dec79ac2
TLSH
T19D41EB58B6E91108B3F76E56ABF6A96D447EB9772F06D05D00110E4E4A72B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads