hxxps://kworker[.]eth[.]limo/kworker/api

Analysis

user interaction
yes
max time kernel
16s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kworker.eth.limo/kworker/api
Sample260820-ff9j8aep2s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316750135050695"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D8D92AF2-8A01-4203-A767-C5C46D1EA402}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2768	1056	msedge.exe	86
PID 1056 wrote to memory of 1836	1056	msedge.exe	87
PID 1056 wrote to memory of 1924	1056	msedge.exe	88
PID 1056 wrote to memory of 1924	1056	msedge.exe	88
PID 1056 wrote to memory of 1924	1056	msedge.exe	88
PID 1056 wrote to memory of 3456	1056	msedge.exe	89
PID 1056 wrote to memory of 3456	1056	msedge.exe	89
PID 1056 wrote to memory of 1216	1056	msedge.exe	92
PID 1056 wrote to memory of 1216	1056	msedge.exe	92
PID 1056 wrote to memory of 1216	1056	msedge.exe	92
PID 1056 wrote to memory of 2256	1056	msedge.exe	91
PID 1056 wrote to memory of 2256	1056	msedge.exe	91
PID 1056 wrote to memory of 2256	1056	msedge.exe	91
PID 1056 wrote to memory of 3992	1056	msedge.exe	93
PID 1056 wrote to memory of 3992	1056	msedge.exe	93
PID 1056 wrote to memory of 3992	1056	msedge.exe	93
PID 1056 wrote to memory of 5000	1056	msedge.exe	94
PID 1056 wrote to memory of 5000	1056	msedge.exe	94
PID 1056 wrote to memory of 5000	1056	msedge.exe	94
PID 1056 wrote to memory of 4192	1056	msedge.exe	95
PID 1056 wrote to memory of 4192	1056	msedge.exe	95
PID 1056 wrote to memory of 4192	1056	msedge.exe	95
PID 1056 wrote to memory of 752	1056	msedge.exe	100
PID 1056 wrote to memory of 752	1056	msedge.exe	100
PID 1056 wrote to memory of 752	1056	msedge.exe	100
PID 1056 wrote to memory of 3548	1056	msedge.exe	101
PID 1056 wrote to memory of 312	1056	msedge.exe	102
PID 1056 wrote to memory of 312	1056	msedge.exe	102
PID 1056 wrote to memory of 3548	1056	msedge.exe	101
PID 1056 wrote to memory of 1524	1056	msedge.exe	104
PID 1056 wrote to memory of 4404	1056	msedge.exe	105
PID 1056 wrote to memory of 4404	1056	msedge.exe	105
PID 1056 wrote to memory of 4404	1056	msedge.exe	105
PID 1056 wrote to memory of 2960	1056	msedge.exe	106
PID 1056 wrote to memory of 2960	1056	msedge.exe	106
PID 1056 wrote to memory of 2960	1056	msedge.exe	106
PID 1056 wrote to memory of 3044	1056	msedge.exe	107
PID 1056 wrote to memory of 3044	1056	msedge.exe	107
PID 1056 wrote to memory of 3044	1056	msedge.exe	107
PID 1056 wrote to memory of 2132	1056	msedge.exe	108
PID 1056 wrote to memory of 2132	1056	msedge.exe	108
PID 1056 wrote to memory of 2132	1056	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kworker.eth.limo/kworker/api
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff90992c188,0x7ff90992c194,0x7ff90992c1a0
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,14293916522811643473,2397701892509667397,524288 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6432343665525522784,8717838984572119478,262144 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,16042374375053116369,7997566270604549757,524288 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,1161711247794951421,17201588321108726746,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,3102952734061306851,8501180856745235270,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,6136563477689978646,4126213967154154298,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,6941012202901135485,923971797706358738,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3928,i,16883802154671065090,16859992147772784472,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3580,i,7847445382660466349,12063033389099404212,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,2548538324524343530,7786283284479359100,524288 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10155097139627060823,10340420987329278841,524288 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,2826461462233854282,16728294396184105628,524288 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,2826461462233854282,16728294396184105628,524288 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5080,i,7533358059766410696,401840585439264796,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6068,i,12828771297443618256,17482168416496591911,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6284,i,16194397670458897986,11564723446529377997,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3552,i,5536442571304893746,588725799234037383,2097152 --field-trial-handle=2316,i,14602901537111397637,13415878386843625622,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d9b4bf25a1d18c4828846f532e78e0729b7c151206dea9d92831982ee5fe16d5
MD5 287af2089390b8e44b9e28a75371c2ed
SHA1 108c57fe9a7bb053acf96f40d65c6dd8503dea9c
SHA512 c332768533e5b6aabbe025a177c8ed6119730a4a05a5d82870776a8354dd2e9dee8f21744628e36f0e7d32abc383be5a57bc8a91daacfe4a6c2068090000c483
SSDEEP 192:sxZhRWkf/fPszPx5uIdpplcxHW6+WNGYzQ1qRKIgrJ:sxZhLf/fPszJlQHbGQK9
TLSH
T16C22C9526E28A47B8CC7E219BB257F53D6F5103295911E48FAFCC61C05E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d52888b239946c7fea2405375f3e173d7b5f93e8880f793d751711b5d9520959
MD5 272196f8b95ec7625de722586d1f8265
SHA1 670b7ce9c1ac1e95de72420300d43838e6c9f7f0
SHA512 f52fd321fc1b55e821cbf5cdbc5cd98b1e9dffed49fd803df9acffe56fd57018fc585a8f22ed9ec63cf716bbba9ef824eb5463df51b06055538266241c58c6ac
SSDEEP 768:9Bk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBNroyoYy:9Bk7u70WvqiEau1jai5LA3BmKy
TLSH
T154C2F93B740CCB7E4F801E9DAC1A6F977E9802C7A6948D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 266b2c07455b530fbf25ffca36c40c714d5a87b2b134a242939dbbfb560e570a
MD5 2e62620b7e3bf1e022f1c7f482221ce7
SHA1 b562293e8dbd4429ba484e6ec944bd2520ee226e
SHA512 6486673a030f6be01212c04890ef405b59374f358f4e7927b58c5a5e9c911c4d8bf3a7170042c1be4f63efff8ba6e1bb485527be15d0d55a8f96ed5d03f7bf34
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTvNIZKWcMVncRt3dpvQRWmIl1vKW+eTviv/PuBZkyAzM:KIbCKcvNSKWcFwAKFOSKkQKVCl
TLSH
T1C591A4463ABF02013C7F295C9165D5765E4235633108AC7F3BAC08625EA6E22CDFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a84c3219e0d28d5ec5ca95c42267c289b468a716b7f3cd45c48ce5acb106c1bd
MD5 e733864bcad39dadc77f212db153f53e
SHA1 8774e42dc4930384f69a211c21d0ff2189eb39e1
SHA512 f1e65835496c37568ec262f98c10a1088e1762ee21102d73324739fbac791e68273b59f193323fe475f6ba66fb6b57a03ddf4259816de7def85deac173d1bf54
SSDEEP 192:uZm+xasuheOwQxMGsNMwhQjNAkMBbbGQmiU1aDv4aGBPKIOCHrWTPNjdN1ebqMtM:XZcIhsNM8QibWOA7LCL1eXiv6Uyo1
TLSH
T15D828E759CB95D3A1DABE240F48A36079FB88037A7C85F44EADCE73C01AE6981317917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd01b2758fe91ee35d375232e40a50be0e683eea411f41c17c30f0910920ab6d
MD5 78d74d53c23f791944b4480f7bdc0e8a
SHA1 ec88ca0bc78c9df42fc7448ed16b921b312dd0d2
SHA512 3aba306302f0d53eef6dba4e345db8c797b567aa24b13d3ba33854cef47ac008728ea5b2bb744b16df74ce323db87a9124e244140346ebcb7b1cfa1307674a0f
SSDEEP 192:MONx64BAQmiUyF1EW5GBPKIOCHruaD1ZjU6:MONx6eAymW8LL1BU6
TLSH
T1A302FB396C796C7B9EA2BE45F48637175FA8113BF5945B44EAE85B1C00E764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9218e57a89578473ae8cc998ef66c677dca2a863de059f22aad1c4cde240072
MD5 619c1cbf198c2d4709d69c8333d59a29
SHA1 8d8d1ddea66974fa9e65a35972ded43ee1a6189a
SHA512 d93ef641facc142adb2aa9715e861a3360ac027f120af61f0ad0abe8ca072acf588d44dc36230546487a416aa27fcd9aabfcd0adafbdcd5200bd90f73e401368
SSDEEP 192:QONF64BjQmiUypEg5GBPKIOCHrWTPN4Ww1ebqMU6:QONF6eVzg8LCe1eXU6
TLSH
T108120A35ACA9AD6B5E93B541F4C632075FA8422BF6846F40EADC6A2C01EF65C2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0bc2682b850d78bc63cc01a913bd28cc9327519b1579aec5a3b474b929f807d8
MD5 6d0befa863b9c36ea3561a28555c535d
SHA1 e8c9e48532fd4903c94ab538311908d8b5c6a9e6
SHA512 3e7b423d25172e6269b9a86524aa8db0d3bd7fce55c499af1da8543e433afda0d22056a1ee908aa04429a87c348d49a374a9b6c184b33913aff0e2fe25ea381b
TLSH
T1D3412758BAEA2154B3B36E4A9BF7A85D487EBC332E06C55E00110E4F0A66B00CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads