hxxps://kpr[.]lol/files/tkd[.]rar

Analysis

user interaction
yes
max time kernel
31s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kpr.lol/files/tkd.rar
Sample260929-xtargsxz4j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{5CCAF9B8-4555-4A8F-AB5E-8E7D7BE03B7D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4436	1856	msedge.exe	87
PID 1856 wrote to memory of 5056	1856	msedge.exe	88
PID 1856 wrote to memory of 4104	1856	msedge.exe	89
PID 1856 wrote to memory of 220	1856	msedge.exe	90
PID 1856 wrote to memory of 4104	1856	msedge.exe	89
PID 1856 wrote to memory of 4104	1856	msedge.exe	89
PID 1856 wrote to memory of 220	1856	msedge.exe	90
PID 1856 wrote to memory of 1172	1856	msedge.exe	91
PID 1856 wrote to memory of 1172	1856	msedge.exe	91
PID 1856 wrote to memory of 1136	1856	msedge.exe	92
PID 1856 wrote to memory of 1172	1856	msedge.exe	91
PID 1856 wrote to memory of 1136	1856	msedge.exe	92
PID 1856 wrote to memory of 1136	1856	msedge.exe	92
PID 1856 wrote to memory of 4204	1856	msedge.exe	94
PID 1856 wrote to memory of 1668	1856	msedge.exe	95
PID 1856 wrote to memory of 4204	1856	msedge.exe	94
PID 1856 wrote to memory of 4204	1856	msedge.exe	94
PID 1856 wrote to memory of 1668	1856	msedge.exe	95
PID 1856 wrote to memory of 1668	1856	msedge.exe	95
PID 1856 wrote to memory of 2060	1856	msedge.exe	100
PID 1856 wrote to memory of 4644	1856	msedge.exe	101
PID 1856 wrote to memory of 2060	1856	msedge.exe	100
PID 1856 wrote to memory of 4644	1856	msedge.exe	101
PID 1856 wrote to memory of 644	1856	msedge.exe	102
PID 1856 wrote to memory of 4516	1856	msedge.exe	103
PID 1856 wrote to memory of 644	1856	msedge.exe	102
PID 1856 wrote to memory of 4516	1856	msedge.exe	103
PID 1856 wrote to memory of 4516	1856	msedge.exe	103
PID 1856 wrote to memory of 2296	1856	msedge.exe	105
PID 1856 wrote to memory of 4848	1856	msedge.exe	114
PID 1856 wrote to memory of 4848	1856	msedge.exe	114
PID 1856 wrote to memory of 4848	1856	msedge.exe	114
PID 1856 wrote to memory of 4428	1856	msedge.exe	115
PID 1856 wrote to memory of 4428	1856	msedge.exe	115
PID 1856 wrote to memory of 4428	1856	msedge.exe	115
PID 1856 wrote to memory of 1068	1856	msedge.exe	117
PID 1856 wrote to memory of 2908	1856	msedge.exe	118
PID 1856 wrote to memory of 3120	1856	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kpr.lol/files/tkd.rar
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ff92094c188,0x7ff92094c194,0x7ff92094c1a0
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,10425269928138983,3241362529188627131,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,11835972561300309687,14153472555497200671,262144 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,5025278180070238052,11085080237541234328,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7024309002282788644,5874163639202215488,2097152 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,404912396492096782,16022851451272552154,2097152 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,7056001193488917330,14659587110111479174,2097152 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,2398617523664221441,3177904235196105133,2097152 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3475966777176330391,4453533905713889261,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,7440730203170958106,908525137558993001,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,15560627070674625737,9353237359073084043,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5356,i,1130645204052663570,11520063295854130826,2097152 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,14452977395385123834,17396456046590778520,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,14452977395385123834,17396456046590778520,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4304,i,3376196939502887991,13906777544998339321,2097152 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6212,i,13235212207903511155,13332258005418878090,2097152 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,16133137222327766247,17403202255876986833,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,17466973018931265246,16770902755440848808,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,6137491348155733029,18190705674227240054,524288 --field-trial-handle=2932,i,3737937983540420496,15938798207499948650,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bb75e0e30f1eab983b9e6366bc52e1331237e0a973d903232c0996a6af2edfc2
MD5 86bf2fb3a2478d08f70352900907f64e
SHA1 fbb44c28e71d54ae49b2688c51668eaf0580abf5
SHA512 b9cd4a970bd1fe01c1542c5706c5b5fe76ad2ced4d9f969f724266fbe25fead21d974c7041401b05e9307491e4450aded4dd79e40940053cb9f07559df02de53
TLSH
T15E61A4B07F404964F7AC133E51DB12833F38159A9C6B1E59A0D4FE7864063B8593BC08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5965f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5965f4.TMP
Size 3KB
SHA256 352d61114260daa7811ac64d18118d608329fcd93b366b95d7762f8b8857b862
MD5 ce2e2ae1f9cb34f2b192c2baa246de36
SHA1 19957a0c1c10352f579f4e2e00665df57ff60ece
SHA512 10e3b7c2d2b4216626f4b3af7fae6f79b6df4a7931f11bdc18a2e7f51dbac7d33900ee7be056473f8884a26f3993bf34d9845a2eae611aba2cee070c7f6593de
TLSH
T1B261A4B07F414964F7AC133E51DB12833F38159A9C6B1E5AA0D4FE7864063B85D3BC08
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 055c0ea7b53049bbcb67f0237c033bf3b2ca1c2c74b776955e2af77363be684a
MD5 6c4d648cccc70a35464b5da91f1e3b6c
SHA1 49f4bdbde532a8c4319609e25a15c7b5de004947
SHA512 fa532f842cae7318cb8c679874d1ca60126129a8cdb5d177d65d37dbb9cce4c5e3ba36c1d389d8eb4269fac6ed243f2534cc90f9f961882495097e1a0a93585c
SSDEEP 192:sxZMRPn//fssJNqIdpJHW6+WNGYa0wNIgrJ:sxZM1//fssJNjJHbGN9
TLSH
T10412A752AE28A57B8CC7D20DBB25BF43E6F9503261D41E58EAFC961C05E6ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f846fb0696e0a4914baba9f5e9dd8e81c11a3b1f72b4577f7d3377356915300b
MD5 4707425726ec5292700cea8f6725b415
SHA1 09d3dcd817661aab40303d82f1ff9988f2b240de
SHA512 0c4068223ad5e6d9f81c205bc33b1735956a62570cfc04a4955c8a36b794bf3cbe4ad028d6cf010fd1dd5c2de5920cd14a951e3495affdf53153d41b2911c827
SSDEEP 192:sxZMRPn//fss8NqIdpJHW6+WNGYa0wNIg5QJ:sxZM1//fss8NjJHbGNC
TLSH
T15012A652AE28A97B8CC7D20DFB55BF43E6F9503291D41E58AAFC861C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 05a50b8e1b8e23ea16f964608dcadd0016a5ac650385a0fd645f1c875ce7faef
MD5 91792a103f95a11ff3626aed9dd5ac44
SHA1 d755fca44ee3cec0ef97e83391fb6acbc4d2f924
SHA512 8f7aa4284883c606e042e8ded3bfd6e939b13b6d9e8d91758cb8542ea97edeb27eb6a2c349380c84eb9931d7f7c01c63460560a1c9d98abf78a22167fc280d97
SSDEEP 768:rAyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3ErofZmT:rAyQRbrWvvlpZu1jaXKLf33PfZmT
TLSH
T147C2F93B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b9a2890e6dc365073811b1c9771cfde359487e6094e83f20741cc71eded4999a
MD5 1d6c8685a3b6188115ff58066d5c78a9
SHA1 d7f5a0d849f8d53e49cff865ba3ab4c440e19167
SHA512 469ebc7d9d77f501f781ce581aeab9819518950a301d0c1494a46ffcf1350bab68fce7147228d0e5691b18a3b033def09b2c1277b5ace37db97208dde20c7031
SSDEEP 96:KHZQjPZzTxavKs4HxKg4auiUoKxueXGKEcC9:GZQjPZzTkvKjHl47TYN9
TLSH
T19A911E0271BB17403D7D6848D174879B468236A77098EB2B7BA841E64E6FE140DFE6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e2b38a492d0add35894977e936aef5bf96e5b67281925240b90ee1a090a3c707
MD5 eff5540fbcb1a3e9b4c63cc6014ae027
SHA1 c289e877c4946c0d48eb5533322a9a7151bbba2c
SHA512 448978872654d14559ba4d1bcbf7bd38d92fd1e9869a7a841ca160d50fe9d6aef7a81f4f51fd9ee79f71851e0f88c1fc84ecb8dd46fc70e91b9f82078b904d3a
SSDEEP 384:ZZcIxsNstiXUDd0UC4p5u8iu8LGXiYotZXtgOIwZOyJLeo8:xxvOUCykvmiFZXXsOS3
TLSH
T11C827D326C785CBA6CE79555F94B36038FB4806BD3C9AB94D5ED672D01EA2940307E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b4d0145ad14119a25f065f6b998a8281e965521cd1fa041ab004d5887341f3b
MD5 8b97f336fb3c4cb309c034d57a3a8d5f
SHA1 342662c55f25bce99d23ae99d13ee7c5ccc72e64
SHA512 9ae6b78a430dc674bb2bc653557e9eb1f6334165d59376d9d62013e0925578c7bac186bc7b0714c6be8c92ff78e5e760e673c888ebf19eba2138621f29a353a7
SSDEEP 192:SONo6iDCQmiUyLhHq5u88PijzorLeLSqZrFZFU6:SONo6/QHq5u8iu8LOZfFU6
TLSH
T16E02E9396C787CABAEE3AD05B54B37175FA4012FE6952B84DAE8162C00D729C1303933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c63e75edeb76937872bbbc862a476ee36840251f7e9a5b631210828cef152fe9
MD5 6c3d40c3c685913b5efb178883dae497
SHA1 cf0bed8fba6e11fa29f7fb27bf9322ae1101c65d
SHA512 a18601343d5eb089a59068c489c8badb61a2f30006256de2e86f5162c16745923ad51274ad46b191eac10db67693731860e2ed8a3637112f317daaa294812c96
SSDEEP 192:SONN6iDtQmiUykhxq5u88PijzorLeLXiPwoAuZZPqsU6:SONN66Fxq5u8iu8LGXiYo3ZXU6
TLSH
T1B5121B3678787C6F6DE36855B48B36138EA5412BE7886F84D9EC1B1C05EF29C5307A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e12b7d32032eddbd701b190bb05c789c47dfb2080b65c42da666981e996cd9fa
MD5 9932fec96ad1a163fba8b5a630c97960
SHA1 9e9817b94888ae3c5b18d99d4ec765173126b2da
SHA512 7e56a0fed1da2e5a0e4045697833d4f666f7d92509a91947ea8f95d8954a3677b6ef4b4df63af5ba948518eda45ac98a575a114701d3275795d4763ec4279ea7
TLSH
T10D411B68A6F91118B3B3AF16ABF7686D487E7D372F46919E40010E4F0672B40C972733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads