hxxp://85[.]239[.]147[.]6/files/8717422379/HLSs5Qb[.]exe

Analysis

max time kernel
88s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://85.239.147.6/files/8717422379/HLSs5Qb.exe
Sample260418-mn992sdw6x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209827216757228"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{AA2EC26E-2CED-4D84-A7D8-6E9445431D6C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2620	4368	msedge.exe	85
PID 4368 wrote to memory of 4712	4368	msedge.exe	86
PID 4368 wrote to memory of 4984	4368	msedge.exe	87
PID 4368 wrote to memory of 4984	4368	msedge.exe	87
PID 4368 wrote to memory of 4984	4368	msedge.exe	87
PID 4368 wrote to memory of 5772	4368	msedge.exe	88
PID 4368 wrote to memory of 5772	4368	msedge.exe	88
PID 4368 wrote to memory of 2632	4368	msedge.exe	90
PID 4368 wrote to memory of 2632	4368	msedge.exe	90
PID 4368 wrote to memory of 2632	4368	msedge.exe	90
PID 4368 wrote to memory of 656	4368	msedge.exe	89
PID 4368 wrote to memory of 656	4368	msedge.exe	89
PID 4368 wrote to memory of 656	4368	msedge.exe	89
PID 4368 wrote to memory of 5988	4368	msedge.exe	93
PID 4368 wrote to memory of 5988	4368	msedge.exe	93
PID 4368 wrote to memory of 5988	4368	msedge.exe	93
PID 4368 wrote to memory of 3384	4368	msedge.exe	94
PID 4368 wrote to memory of 3384	4368	msedge.exe	94
PID 4368 wrote to memory of 3668	4368	msedge.exe	95
PID 4368 wrote to memory of 3668	4368	msedge.exe	95
PID 4368 wrote to memory of 4816	4368	msedge.exe	97
PID 4368 wrote to memory of 1056	4368	msedge.exe	102
PID 4368 wrote to memory of 2204	4368	msedge.exe	103
PID 4368 wrote to memory of 6120	4368	msedge.exe	104
PID 4368 wrote to memory of 2900	4368	msedge.exe	105
PID 4368 wrote to memory of 2900	4368	msedge.exe	105
PID 4368 wrote to memory of 2096	4368	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://85.239.147.6/files/8717422379/HLSs5Qb.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcdf74c188,0x7ffcdf74c194,0x7ffcdf74c1a0
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,7879078584131020189,17798259485530808004,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,15530459859451154530,15032134378737999240,262144 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,17214944085423024762,6342999578370997621,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8818101906619460926,7474556672452808890,2097152 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,12033607980818934419,6148304567514778039,2097152 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4960,i,6346020322212169661,5022755318784230632,2097152 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,12355245144900468889,11478444348840426079,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,1266309516713982934,548845465353228990,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,12891911674345143440,1475249283063645104,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,12891911674345143440,1475249283063645104,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,10177846974263410735,8969783326143585948,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,13487094985736315763,12399627529009334084,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,5135143526600598344,10624110451613153732,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,11736962002845892961,11542324051623464391,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9103140552925494899,9725729066223203197,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9103140552925494899,9725729066223203197,524288 --field-trial-handle=2248,i,4744292295351698617,17270677204978146785,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6eebd52a-51c4-476c-97ec-ca5b4fcd200e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6eebd52a-51c4-476c-97ec-ca5b4fcd200e.tmp
Size 25KB
SHA256 63461c338365227911010d5b9dc314a5c6ab06009d02f94cb5af9ea43dbc44de
MD5 23f13138c0998bf9280432237cd1ba51
SHA1 6ae4a002b3403fbf99a16e1f87535b697af5b64b
SHA512 881218a48d88a299bddb056e5ae382d77a8cfdec5acafe152644b2facf645111aed0e8863bd8191b36dc513c3566b3c50c77181c175792a7305d5d290504e548
SSDEEP 384:nOiFavqM13sNv8TUNTUlI4rRihfN+nmvfDYoQBEH3CMsleIZx9WnGbMvPksdvrNm:lFayK30wgsiiKYnS3Ulpx+GbGTN8
TLSH
T1F6C22B71E864DEBBEDE69FDAF3497603DEF0419785884AD4EAD85E0D008719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9cc49119af4e2d69c4bbd910622c3311648ade95add4c0a0a88d2b394fa5d8dd
MD5 47dd23195c450b2c3a6682cc3bbc886c
SHA1 002c8be46b951c839238069673da1fa312c20dce
SHA512 290f54f39e800ee218714a0de3453a4836a99d8d5433427155f91abaa11e3ba50c9b939c3403e7a65891091282195e52e97095b1f43d715820eb4d84dec2971e
TLSH
T1AFE02BAACC319C2B09FD0B2D60524646EB55135B1B50985F3B3D91088FB46374556C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0617590b2676a3c00f68d7d3f95d1d4c1ff7124f6bc3563198966711ce0450db
MD5 3c6c9ca6a3dde3c1fb5b6d75579baf9d
SHA1 ac9d7f38291c46c7d1b007beffa043e35347f37a
SHA512 61576ac33fbb020c95c5c28e9491a52d1b3bc94beee5db8efd056ff624aa3fc9793a4fdd99944155490e8c7ebaad95828f9616f143787f3620d8a5f9764326f0
TLSH
T15271076DD1F28E2AE3E584B116BE50E3723493F8428B0E6D75F490BF8AE570E8CB4411
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588930.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588930.TMP
Size 3KB
SHA256 9fb8a8e27ef40bafa41215d87e1e61f0f3f7b227046a39b234182700007269c8
MD5 6915cb403ec97eccb8be52280f99a1df
SHA1 f363bb5c4cd1bf04d792a14132ae5294c86f8038
SHA512 543520340263d8a6022d06d5fa3f7dfbd4468f2fea2253d552f1d85c99fc8f52c5731d434cfd900cffc3b1d5dd7b32d053bee076badfa1eb59bdf8ef9778079b
TLSH
T10171C54DD2F58E29E3E484B126BE50D7753487F8024B0E5D36F5407F5AE9B0E9CA4411
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8f0159d966e46b6896b0ec5642ac6466fb33d4b906614cf019698589a95e2c45
MD5 301804f8b903cae4c16dbb8fa6ded4f9
SHA1 efd37fdd52f1eb318e538106e1c5c18d9ad8ef53
SHA512 76d312932b7117414a0ee6862688d13e6f2c5147e0814a18dd4b74a3600163e69a175916d0959e64f0e1c251e61c06c92efce90fb98bc0331ec33e0350bfbfa9
SSDEEP 48:YALlNiOhnNhMhIhthVh3afo7gmzs0VzEs8rs2tsoZ0EszBs8CKsNPFsNPNj6VwhU:DQOFNWKzDlaa5zAXTZ0fXSPyPNj6VwO/
TLSH
T1B9919CF7C3E4812D891156F4AB15AF2FCE2E0614431C3D6AC9D8AF5BD3E2431E11666E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8318b9ed11a47cac914f89d2433e31d00a572748ba81cb35a64e25864624832f
MD5 3d26c739dfa61be6afc8204d60893025
SHA1 74d995ba353ebac18c96769f7ccbae7331c11669
SHA512 db9ad821525f58d3761f8159bbd73c64d4af8258abc9b453df102f654885ae1205263f51803543f4941efe769cb9232e682ef7a4889a2a3cf04bd9490fa1409d
SSDEEP 192:sxZzRkyMqZ/K1Ml8Mkw/fu/s/IpZZELgvSzodpoq2Hrh6+WNrCI8/YKR+XNcmTIc:sxZzRMw/f2s/E3hvpmHmE/gNRjn
TLSH
T1C872F8166A38997BCCD7D21AF645BF53D6F5552392904E44AAFCCA0C04E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ab36d85e37503199ea6f09e5c213d5dd697e59e6cb37f0dff3b98f0d4ff24f8a
MD5 7f86d2840a5bdb2292568cfc6f795134
SHA1 82eb10bba627b9b3ddc1dc7529334a860c99c242
SHA512 fbdbc9a442c1c19a517764faa212e2d7144b03c4fc43df822056f72500acf71defd0a2a224fe7163992321a8ce555ac6e6b73cc38b811f61635a60c10ca837d8
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OViEx4Llhf51YroS:AasqZl+E/BlWvBDeTu1ja/Ex4LXB1jAz
TLSH
T1BAF2FA3B6C0CCB7E4F804E9CDC2A7E8E6EE8028B9698895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 7fee732460ff172de9d6412e07ffaff017963e7e840fc90bffd3e8f7fcb86227
MD5 b527d46e4b6d56ff29d77887be4c0097
SHA1 8ae15dd9d691acdd9263c040b8d6ce198597fda0
SHA512 6ad5c0bb85229c0c1985c5dc136c6824ce342a25bd07e77d377dff9ee2669fddc5ca17fe7e712007125562c59d8e74c4768bd29adc0dcd144ffabe511ba68744
SSDEEP 768:A9sqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdEx4Llhf51YroA:A9sqZl+E/BlWvBDeTu1jaQEx4LXB1jyf
TLSH
T13EF2FA3B2C0CCB7E4F804E9CDC2A7E9E6DE8018B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 553d99670670e2f3a560aa78c903debc7254cf6e9fd42db2aab7add90e3f3f9a
MD5 d4b503beb1435552266c8d6427903034
SHA1 2a19399aa8a729d6c120503477a5dac4fe2430a4
SHA512 6726e388911ee9063a571ea5d0415d04e0ec1794553f8afd204203625bc77f82e45c7a55bbaa11939145d8e189a3507e47fb8854f554dba47d5b0cea78254356
TLSH
T1CCA002184A40C10BD4424370308115453ABC9CD06386221156DB54F4CDA038052415E5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d27fd4ea93e9eab36a970fd1b2331fcaadf52889edce8924b986f1e60e9a7299
MD5 df97d5ff488ce5cccaf142ff678e962c
SHA1 15897b720770982a029f9f9d535a0c7d63690cae
SHA512 7581b73a6a64afacd83e7ed609b17840e5e4febdc958a2a54d20d5552c5c13421b1e81e6869b47361357f0778959cbde3b585b14b248c3a9f5fd3658756a1ab5
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnv:+BOVglYXrbtZqRvJDh5
TLSH
T1F0B23D11753A03813A7E295E9594B46E62C270A33098B43B7BB944B64F6BF20CDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cfc7c91e53ac8423034327bc79935eb79accd6cfcf22abc75991aeaa6b02316b
MD5 5c1c9a348e61ab28b398f0404b10f1f5
SHA1 6d85807fb3cd0b58b29dba4153e5176b0f996c3f
SHA512 68762782f10f01f0a024493dc4ba4fdf059e6a97bc54b546d7450fe13d8b94a97c203b4d505ef82e2cf17a25a17882b8949ee34d3b08c07d4aadec161c18d775
SSDEEP 768:ucFayv3vwgTij2YnS3Ulpx8GFmo1tiEXEU:uXyv3BRk/rFmoX5V
TLSH
T1E3C24B34E898D9BBEDEA9F89E7497A07DEF00197C58C0AD8D9E85D0D10971DE2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 548fc71947057f54a36317a201092cd864d1af3291721d5a58bbf52d0498cfca
MD5 47ac6357f1d79304f707528c93ada583
SHA1 92e22cc30f0e5348a197c4eb8497d0a6bb479af7
SHA512 b7e4cab41ddc44bb8aedf83fa500f9d08b79f2caf29bdaf597b694bf4cd31b88e5364521eb5f5575118865e40e6ff3df046fff3bc4c0203c03f5eaf35711843c
SSDEEP 384:nOiFJjccCs+Bt0S353sNv8TUNTUlI4+RihIN+nmvfDYoQBEH3CMsleIZx9WnGbSy:lFJccQZ30wgFihKYnS3Ulpx+GbSg3CK
TLSH
T12CC23A31E8A4DEBBEDF68FD9E34A76039EF0005785985AD4E9D95E0D00871DE130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a03db54f64c37301c5298e1e45f1819454fea19e0e6b136c5ab4673ac88bce23
MD5 67124f4bab0b3ea8dbeea7a457ebe389
SHA1 6c47f71096f0896cc0fb8c65f0667355138110f3
SHA512 8a1da9d86a61d0f1c53e80186599568bbc86262e79b7b457cdffab1d4895ba912e77525cf6b26218d4baadd92fecd93e3b40d31c298a3590922f6d5521becc8f
SSDEEP 768:vFJccQT30wgFii3v7g8nS3UlpxzGbSg3CK:DccQT3c8k/sbS/K
TLSH
T1A6E2C5F198D78977E9AE4B97A37D6E029EBCC053B5844A94BBC41D0CCC860BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 38868bf6c0ec9573c4416f1ebc52d3800fffbedb0fc26cedeb6b808fd23c1fef
MD5 18ab7dd4316568cd22ad26183720a752
SHA1 4dea46a97d6fa72efe33758f9149e2f4a7ffa84c
SHA512 d683e74805916eb81d0d2b2abd0fc5827437a65b0ce8692b35d81db23ae8170540310c3cc90b8592fec66f02c1d20861768a19a2b863e64c163d6274cbe21772
SSDEEP 768:9Fayv3EwgTiE3YnS3UlpxIGbmo1tiEXEU:Wyv3sVk/XbmoX5V
TLSH
T153C24B31E898DDABEDEA9FDAE7097607DEE04197C58C0AD4E9E41D0D10971DE230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a312d4d7c61d94a5a153423fdf07a2aeea7f3159d149f2b0832e06c86e1d6775
MD5 440192ee4669f3116c9dd38e20b79516
SHA1 3e697d3a6a3c4c9d2f9fc9030af8c694b258ec26
SHA512 0d3f3035fbd2e8eeea6d616d2a5ab39e384cfa211c5547b51ef3758e0e51a062d33d90fdef4b1f0e0e16a5d8cbc3b94f714ff74bdbfc7e4e84812530dd39928d
SSDEEP 384:nsiFJjccCs+Bt0S353sNv8TUNTUlI4+RihIN+nmvfDYoQBEH3CMsleIZx9WnGbSy:XFJccQZ30wgFihKYnS3Ulpx+GbSg3CK
TLSH
T1BBC23A31E8A4DEBBEDF68FDAE34A76039EF0005785985AD4E9D95E0D00871DE130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ce36ff89ea9f5a42026ef62fcdca4c0f05b856ad3971cf35c0adc786fb4d612c
MD5 76bc54096cd682ec330258c9ebda2f59
SHA1 6d2e0b2f061dd0702b8a37452cd24a2c47b9588f
SHA512 6f302a806df797d476bd12de32d028d1a0c4d1f2bb92cf8be905a29327027889d9f70bcfa839015ce79f5b0d83587751150cfef9a32f74aa187cefda9626c7ad
TLSH
T1E6411858B6E91148B3776F5AAFF7A86D487FB9372F46945E00010E4F0A23B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2096-328-0x000002A1B16F0000-0x000002A1B179D000-memory.dmp

Download

memory/4816-209-0x000001FCA8D00000-0x000001FCA8DAD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads