hxxps://cloud[.]mail[.]ru/public/jHqp/WC1VNQRXf

Analysis

user interaction
yes
max time kernel
83s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cloud.mail.ru/public/jHqp/WC1VNQRXf
Sample260627-13ectad12k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270718272567400"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{BE20A30E-6708-467D-8928-8AFA59BA6BC5}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4980	2076	msedge.exe	86
PID 2076 wrote to memory of 1208	2076	msedge.exe	89
PID 2076 wrote to memory of 552	2076	msedge.exe	88
PID 2076 wrote to memory of 1208	2076	msedge.exe	89
PID 2076 wrote to memory of 1208	2076	msedge.exe	89
PID 2076 wrote to memory of 4656	2076	msedge.exe	90
PID 2076 wrote to memory of 4656	2076	msedge.exe	90
PID 2076 wrote to memory of 3840	2076	msedge.exe	91
PID 2076 wrote to memory of 3840	2076	msedge.exe	91
PID 2076 wrote to memory of 3840	2076	msedge.exe	91
PID 2076 wrote to memory of 4600	2076	msedge.exe	92
PID 2076 wrote to memory of 4600	2076	msedge.exe	92
PID 2076 wrote to memory of 4600	2076	msedge.exe	92
PID 2076 wrote to memory of 2824	2076	msedge.exe	93
PID 2076 wrote to memory of 2824	2076	msedge.exe	93
PID 2076 wrote to memory of 2824	2076	msedge.exe	93
PID 2076 wrote to memory of 3716	2076	msedge.exe	94
PID 2076 wrote to memory of 3716	2076	msedge.exe	94
PID 2076 wrote to memory of 3716	2076	msedge.exe	94
PID 2076 wrote to memory of 4104	2076	msedge.exe	98
PID 2076 wrote to memory of 4476	2076	msedge.exe	99
PID 2076 wrote to memory of 4104	2076	msedge.exe	98
PID 2076 wrote to memory of 4476	2076	msedge.exe	99
PID 2076 wrote to memory of 1804	2076	msedge.exe	103
PID 2076 wrote to memory of 5716	2076	msedge.exe	116
PID 2076 wrote to memory of 5724	2076	msedge.exe	117
PID 2076 wrote to memory of 5732	2076	msedge.exe	118
PID 2076 wrote to memory of 3796	2076	msedge.exe	121
PID 2076 wrote to memory of 3796	2076	msedge.exe	121
PID 2076 wrote to memory of 3796	2076	msedge.exe	121
PID 2076 wrote to memory of 5376	2076	msedge.exe	122
PID 2076 wrote to memory of 5376	2076	msedge.exe	122
PID 2076 wrote to memory of 2860	2076	msedge.exe	123
PID 2076 wrote to memory of 2860	2076	msedge.exe	123
PID 2076 wrote to memory of 2860	2076	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cloud.mail.ru/public/jHqp/WC1VNQRXf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8c6a6c188,0x7ff8c6a6c194,0x7ff8c6a6c1a0
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4051696202179863235,10064477563248969930,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:3
  2⤵
  - System Time Discovery
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1840,i,9069343773352890768,11267918443988482739,262144 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,7705155676572654001,3272453708899231476,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,8659431014477405595,3441765270393703640,2097152 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3659077646902010619,4896810500497410865,2097152 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,14464019180971101106,1741549132078428204,2097152 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,14088114288757758618,4987931962791001915,2097152 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,496596795449437473,267631820548237419,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,2067484714635677899,12417057039405829553,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,18395513910319260853,8258343615287092690,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,18395513910319260853,8258343615287092690,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,6185807402415487605,16970302272157177755,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,1252750992902883470,6837352730171553624,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,7482687956719179889,11347782832042891474,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5076,i,5590908290393786275,14328648347410681543,2097152 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,4566376018200511925,1284781895243197923,524288 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5932,i,11781095480889624452,11947026816760342627,2097152 --field-trial-handle=2292,i,18130400044155565301,1110906051342777744,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a002f001ebf3ed2cf2869886c49a7397645f7a31f64430efcb4aefde0846e1df
MD5 18b6ac3321ad3377443f84c11435b78c
SHA1 a11fa55169c5fa82b6de6d296b35aa85012b1328
SHA512 c5a0d861b7c7254d2ea930179e9be3eb814105a12adea7530bb45309f8db7a6458748b21621a6eecdeab53e70fb4ed3612b278b7649534276e47cdf4ae1f8500
TLSH
T1E781D61602B35B53E362363CD4E20A93F33784845D7B4E77468404FDBA3AB92A32966C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590361.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590361.TMP
Size 3KB
SHA256 807fa44ca0e99fc2b714989a443c1537ca9fcd28ce244c4120961f7e82c64e56
MD5 a2df96e1925271dc1a598ceb227b5116
SHA1 545d3361fc9bd2dafc6843eac843cf733f8302b5
SHA512 d8a5f2a9eeda6ae9f1139b2caf003cdf40188fc51c80e0df71a3a282532eeb4862fc2ec836b21dda9a5272397337a62b4919a49d8e39647f72f0cadbfc09941c
TLSH
T1A861D52A02B34797F322323CD4E30A13F3338488197B8D77464405FE7A38B22972A66C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_help.mail.ru_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_help.mail.ru_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d9d7989a4e1ac201774b0dfd0565f031a65d6a6e0da236c3d5328daa338b44f2
MD5 e81027ec9b200feda8f5fab7db9dcca3
SHA1 0dbc925bda8fcaf4a7dcf4968462a1fbb621affc
SHA512 28268207cfdd33124e9ec200351c86d4e8ee190f1cd83467c382b177b43ee3603182e15fafcf32b165e1621d7a86ead8918e483ecf562b9b41abd5b81bcbf802
SSDEEP 96:D0OSWszSfb8qwB/y2RIdXugOCTwDIylBJWyBhBWRTOXv+:D/SjGfb8qk/y2RIdXugOCTwDIylBYyXe
TLSH
T151A14AF743B48A6DDA2291F0AA25AF1F9F5908135BA8380645D0AF0BD3F7875F152D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 22a7b86957da0f8709b429e7ef5e04395f4be14d417fd6a72eac1a487a9e5b4e
MD5 f66c2047b900b7ff7f88b35fc360bc3a
SHA1 08a3e0c53bf562dbfa69580d1b6136d36bf5bf6b
SHA512 70a7e00341298287d134a795b42c46441db13ca75aca70765784997044ca1a3817e13b209ecaa675e9f06927f8ea2a7d244f5510e0b640b2814af87f12c5d271
SSDEEP 192:sxZ1RKyM/jK1Ml8Mkt/fXXs3CRQmIdpGyoHW6+WNdH1/YwLIpkIgrJ:sxZ1kMt/fHs3mQHuHb7/99
TLSH
T10252E9126A34997BCCCBD309FA55BF53D6F5147292900E48AAFCCA0C05E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6fec4920483a5e47ced74c99e5f71a461036b248f872b9ad01d4c609eacccb66
MD5 1cb4a0bc023923ea9f90019f8c2b4589
SHA1 b8dde9357fc4072af985cf230e5e6933538e072e
SHA512 4b83aae4f74f699ea5a24662a153cfd9b2f2194a6b9e7fbedb94fd7586bf5200292500c2f4998f145f82e857ba0c30e14866b7f162eccb53fe9214755fc4da16
SSDEEP 768:hq4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d+rohrctan:hq4jeXmWvmKLEu1jacPLZQdV+W
TLSH
T11BD20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cec9f094ca0ae06b49f5799ae8e50a4c843d92b5c5e6247506c8a63b32da8a93
MD5 ff346d0ff2e4c237e77c5a230cb4022e
SHA1 b1a28c2ce285fe2c714e800488b8577dc5a6aef7
SHA512 127c8d58a6ba7f01d6f1165186bab1122adc1a815dd90ae288b4d8c35177576037a7e9286287fbed86230fa7f3e793b80e42236ff1f752b7abfb145c7d511d04
SSDEEP 48:KAzIhK0YMHy1JIhKa88GfItKocQTyf/gD/t11uz:KAzWK0YWeJOKa8hfKKocGM/gD/t11uz
TLSH
T11491FF5670BB53412D3E2A1893A5A66A8E4171A37125F83B3FA811F16F27E144FFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597584.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597584.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 873340caf4b41898b937bf434f195101eaf19246f0a6fc932b404d901b4992c9
MD5 4a52a7749a1087788cfa24e74199ee21
SHA1 f1a5112d9159b4c8ae07a51133e3563f09d848fd
SHA512 8317a098fa4101e135c3486f49b0b94116c4805c879bb31a70f65985951770193782a864dcf2776bd3407f702348681fbe9d7dd21923b77608b3f7122a349f9e
SSDEEP 384:diF1tNn/s3n9SwzsNI8TUNTUlIlpWlzYOAduf+2/d9Y45+Fjmn15wbAjE9:UF1j+9j1wg2lrAgbwjmn12bf9
TLSH
T158C218F248D74936DDAE8B47F37E2E128EBCC167B5856A54B3984A0CCC962BFC305911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f2c52af28e414e6945e78134a2cea84e1cbc6321a84f32e450705f693b2b9d67
MD5 7cc8f3f270b0c5416848489a74863fb3
SHA1 60def78f1d8e4a44faa546c33f50e61514640d49
SHA512 e69259cdb72323107f02f4a53cb2910c9ed00e32e181b4d665826ce75aba7c64e56320486d661363bba3f96ca16a1e5b2e013432cbc38921c96e6c5abe6d476a
SSDEEP 384:wtNn/s3n9SfsNYpWlzYRAduf+2/d9Y454Fjmn15wbAjE9:wj+9UclAAgbmjmn12bf9
TLSH
T1DD928C32AC385C270EE39645F04B36138FE895779AC53F98E5EC9F0C00EA7AC131A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1747122a791db8e538aef17690bf83474e2db61bd9c65d47640c5493cd4e6dae
MD5 01a508401f053b825312a35eefb0ace6
SHA1 437d4bb636a1a2abb77903de94c3206b6ed8c037
SHA512 165c571db28576aeb451d09c45d16eb4b5ddd629c679fd352252ddbae255cb6efd762c91645523521aa2ca4849070edfc5c8a1912375196197ee2e4e3206bdac
SSDEEP 384:GtNn/s3n9SfsNYwWlzYRAduf+2/d9Y454Fjmn15wbAjE9:Gj+9UxlAAgbmjmn12bf9
TLSH
T180928D32AC385D270EE39645F04B36178FE895779AC53F98E5EC9F0C01EA3AC131A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ea4c1ae49db19b301a47377fe7da899a27200aaa64c607ed1d5bda5846bb9dd
MD5 0c4862cfe83e7b48afe86a50efcf8aed
SHA1 83501a20eb28e94164a95e5de3e732054e2d3fe5
SHA512 5a20b775faaacae8802b9d0fd44ffa59c70bff2cd6b21a1ae0125f8ca64aecb0be9da15ba7ded84ce2d59c4e985afc9cb0ae5049012794f79faaa08e79bcde8c
SSDEEP 192:EON+V6hZ0QmiUypppc/+jV40+Fd9YDJ5wOZeeU6:EONw6o8pu+2/d9Yk2lU6
TLSH
T15302E935AC686C778EF2AE05F48737235FE4116BAAD56F84DAEC1B1C00D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7eebd70ae24ee7ae703003790c2d1b5dcc95ad0985f1197d202ddd308f4d30c9
MD5 8b8c557c0b582ad9a8454b56ea12855c
SHA1 634b400054c8860487c4609708c2454e8853145d
SHA512 f68e40ab7b66d1adb3fbd3b1ee00ac3694270c6b31834c781c766da1050ecea6e0c169f3a670fc1311b95faead1223c63327b0262daf64863f96315ed379c6cf
SSDEEP 192:rONR6hZuQmiUynpTc/+jV40+Fd9YD804NN5cOqLrqN2U6:rONR6OITu+2/d9Y4549jU6
TLSH
T10E12FA32A868A8674DD3A641F08736135ED5522BEED57FC5E6EC2B1C00DB66C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0d2e626-8b8c-4951-8c69-93efbb326688.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c0d2e626-8b8c-4951-8c69-93efbb326688.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff41f3f63d63bedf5075d294d627224bcd35761e90fa21cccb934e2361f14d70
MD5 1312041aa0311ca65b2cc83b15d4ae54
SHA1 940749f0a4e28e993f2663453c491dd8fb917da0
SHA512 4fe6637abc01d2edf9725b941cbeaf438bf6b74532e5a9eaecaa5d5c9ad2e702caf403e76e310f2d747b4afee9c9cd0f6c2a386a500b22531cd9c62e9cf77243
TLSH
T1BE411958A6EA1144B377AF5AAFF6A86E487E79772F06C45D10110E4E0B66A00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads