hxxps://hrisitosense[.]github[.]io

Analysis

user interaction
yes
max time kernel
10s
max time network
40s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/08/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://hrisitosense.github.io
Sample260815-kcrmfssdrd

Score

8^/10

discovery persistence ransomware upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
37	5116	msedge.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001001e-152.dat	upx
behavioral1/memory/2748-183-0x0000000000900000-0x0000000001C77000-memory.dmp	upx
behavioral1/memory/3664-216-0x0000000000860000-0x0000000001BD7000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312560710466467"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{1EF5B190-5462-4D68-95F1-4A5EF442CF0F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 4748	560	msedge.exe	83
PID 560 wrote to memory of 5116	560	msedge.exe	84
PID 560 wrote to memory of 4728	560	msedge.exe	85
PID 560 wrote to memory of 4404	560	msedge.exe	86
PID 560 wrote to memory of 4728	560	msedge.exe	85
PID 560 wrote to memory of 4404	560	msedge.exe	86
PID 560 wrote to memory of 4404	560	msedge.exe	86
PID 560 wrote to memory of 1068	560	msedge.exe	87
PID 560 wrote to memory of 1068	560	msedge.exe	87
PID 560 wrote to memory of 420	560	msedge.exe	88
PID 560 wrote to memory of 1068	560	msedge.exe	87
PID 560 wrote to memory of 420	560	msedge.exe	88
PID 560 wrote to memory of 420	560	msedge.exe	88
PID 560 wrote to memory of 5104	560	msedge.exe	90
PID 560 wrote to memory of 864	560	msedge.exe	91
PID 560 wrote to memory of 5104	560	msedge.exe	90
PID 560 wrote to memory of 5104	560	msedge.exe	90
PID 560 wrote to memory of 864	560	msedge.exe	91
PID 560 wrote to memory of 864	560	msedge.exe	91
PID 560 wrote to memory of 4336	560	msedge.exe	95
PID 560 wrote to memory of 2776	560	msedge.exe	96
PID 560 wrote to memory of 4336	560	msedge.exe	95
PID 560 wrote to memory of 2776	560	msedge.exe	96
PID 560 wrote to memory of 1864	560	msedge.exe	98
PID 560 wrote to memory of 3736	560	msedge.exe	99
PID 560 wrote to memory of 3736	560	msedge.exe	99
PID 560 wrote to memory of 3736	560	msedge.exe	99
PID 560 wrote to memory of 3640	560	msedge.exe	100
PID 560 wrote to memory of 3640	560	msedge.exe	100
PID 560 wrote to memory of 1704	560	msedge.exe	101
PID 560 wrote to memory of 3692	560	msedge.exe	102
PID 560 wrote to memory of 3692	560	msedge.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hrisitosense.github.io
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x284,0x7ffe734ac188,0x7ffe734ac194,0x7ffe734ac1a0
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,13850042350540849385,16059353541819029838,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,1776715166976342749,18163670886181436949,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2522111858871029041,11923411181331800735,262144 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,2968621123239727650,3445909918674281876,2097152 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,13706788395669973397,16341171792087656705,2097152 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,6127192735989763490,8048967457945346807,2097152 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,16004019638563385317,16466065191987448754,2097152 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2539548726717598270,2427355852088893224,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,12533088249491297337,68006173954910596,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,12844897481479030490,13161569608224772029,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,12844897481479030490,13161569608224772029,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6228,i,16152803231887979219,9578785202556475625,2097152 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,7114788891274765723,5436889232765708001,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,3946606887267161865,15531395825555807261,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,15325281299078853521,15760879188249564930,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4436,i,7568984337407733625,14537670709548939055,2097152 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,6202514468557695511,12648863300466614143,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,14712459161927115912,2885711544702128378,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,3873264279479953309,8607551937473644882,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,12856103352634077782,4621099449547403040,524288 --field-trial-handle=2448,i,4763557292111357641,15439171541791589812,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3972

C:\Users\Admin\Downloads\hrisitosense.exe
"C:\Users\Admin\Downloads\hrisitosense.exe"
1⤵
PID:2748

C:\Users\Admin\Downloads\hrisitosense (1).exe
"C:\Users\Admin\Downloads\hrisitosense (1).exe"
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ffdd0cebf60fe2866f85f6cc524f3cb774a4799694873329065366a641aac4a8
MD5 9bb6c0d8e2dcef308d0f9ae141c4c3e2
SHA1 118a5cd2d38003b1036389d15ae9147258c19b6e
SHA512 c6a26101d1167fc70ef3b056f69ef94f5df8a11cf53c07d8269585667dd8eef2a9738a94e9859c5ad4a7ced10d4f8bc344bbf9abf05676beb569186f34dbe611
TLSH
T10A71FA5C000619A2E3B22332A6F296ADB77360DEFFD3EE691344617CE51FB51B138469
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5886a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5886a0.TMP
Size 3KB
SHA256 00621803aa2e5207e80c6dc783edafce0537df9b56e9ddac6aaba0596d200678
MD5 9e36071a9e1f2b7db2bc68b8ee73fcf1
SHA1 c3e419f3ef0dc5cd64a6c75b8f5fb243cc0eca6b
SHA512 1f303472676b6a536982b858f353df0a0fe326ecc5bac19abf5fcb84095b1bef1bf81d71f1253df17d9beba461f09edfe9ca348d5ea585ae7fdbe69497da38b4
TLSH
T1BE71EA5C000619A2E3B22332A6F1929DB77360DEFFD3EE691304617CE51F751B138469
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 752e3a657a9931dd952f63927e8f3546360ba8a4884b4cfd19b8b4d99cb6ce04
MD5 26c7312a72970386e7b9bee1a8365bc3
SHA1 e688b49b433fb3b9e381d0e762b5c00e18c33abf
SHA512 fc09ef86333f076348f93fb7fe9984995501d9edafe6d8f9807b80af634f41bc32594d3e526c3d577bb566a879e3532eb96b035ec793604edffcef66459c0b34
SSDEEP 192:sxZTR6yM/jK1Ml8M9l/fds7TvqnIdpclXHW6+WNbJZ/YrYZusgwIgrJ:sxZT41l/fdsHvJyHbz/DJb9
TLSH
T18E42D911AA34AA77CCDBD209F955BF53D7F9057292940E44A9FC9A1C04E6AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0da83abbf1ec65a34019e04726f176b0602c46e7bb27e75b61c58f8b6c814969
MD5 c2af767371d920875fb8be7ae1e366bb
SHA1 eebe26bd10bf5f8d42ca08374e2c0e7e4f696300
SHA512 8d570b33531ac0723c6062ac8afa2fefdcdc1f98233c3410e096249dac51958980b991c218e1d1b278202c7014997df6485ac469cda0bc4a1d5620176fb1da7c
SSDEEP 768:CXgL6XeWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRNroWZTTqGs:CXgL6XeWviSZqu1jaSJL7+RmWcGs
TLSH
T1A4D20A3B690CCB7E4F840E9CED26AF876ED801CB5B984D5447FA494C03C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b082fe64c1dbd369b2dff8590751c1e5af6157c8562f43f59e96f20264b7f48d
MD5 204e5524ee9ecaf38af8a9d6a16ee682
SHA1 58432bea1f816ad682576f37ad8b5774b1b5f90e
SHA512 0437d5a6545a84e47786a0c53be88d68bf1afc37aa22b8bd6aec6cd4818f098302e1bb292b2b76e4f7f9a864e87c81e78c797c9944df8050297e7a1ed5fb589e
SSDEEP 96:KwX+KUs+OUKP6KG1iB1v33OFHMVvVOKH7vrOzdVk7FPGAFmK46GDFWbyvyDKHavW:oGXG1iB1v33wHMFV17vr8dVk7FPGAFmT
TLSH
T10EB13601357F12433CBF2C4C96B595275E9230A33564A8AF3F6915A60EA7E111EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 48935e95ed5be400e136d3dace8f495a0e370da78de34a3dc7628ecfd3b21b74
MD5 ea91c625eec840d02e3ea43ed965ac66
SHA1 b9549b9b06abfdbf479210d7d4dc048a2e74f554
SHA512 c1f261de7e0f0d6f142887443432b97f5354fd4d2d4280c84f30c67f8c0f082f1f18d39a5af30270ad0432e6eb057716d8c3278cda9caca4ea29c8ef3116d1b2
SSDEEP 384:FZcI1sNkAcCg8+Sy9uO8iusVpu7cOOPrXLpe8C/5t0:91Kcnd1jacOi9Pot0
TLSH
T1EF928E72A9786C67ADE6FA80F58632075FF85427F6C43B4496ECAB0C02DA558130AD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c2594d15837f833c0c769de17194a13d5ed4849c7c9681ecbe1b740a5f8bfb00
MD5 793a7d57dbe9bb6cfd8cd5d842fadf66
SHA1 22028cedf1e45a3f23e4de3306b8a4c7cb2f7a73
SHA512 917351b7e4d4e89599cad425428684efb8bc462189db42a5c39eb60d0221ff2c399ebec7c2cfe9592e76ae49982d28538d5b61337ad293fefb6719d334716029
SSDEEP 384:mZcIhsNkkRCg8OSy9uO8iusVpuGcOOPrXLpe8C/5t0:0hfcnd1jzcOi9Pot0
TLSH
T16A929E72A9785C67ADF6FE80F58622075FF95423F6C43B4896ECAB0C02DA558130AD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b4dae07a3a24c851ae943e9a6154ee3bc75c295e6013bdae3813d81a77d05773
MD5 f2cd3512ac13adabb6f426141af34423
SHA1 c25905e85c725cf58f58544ead638488df0370db
SHA512 c4be3c35d504cc95454ed61c773e7881966c545200abf1994006833620aa94e998fb0fc190b17aea8012aef8b416855e38f91ff455fa300dac590d9118e31bbd
SSDEEP 192:YONT6LCWtDQmiUyaKILSuOCz3Sus6WdsEQAU6:YONT6mg1aImuO8iusVHZU6
TLSH
T1FD02C93AA9686C77DEB37E44B58737275FA42027A9903F54DEE82F1C01DB64C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 aedb7ccfb0a27f77a351765b38d13e09ae44e8119730bcc4076b3412845a239d
MD5 15d07234b7e197f1b44ef8dbf37be8d1
SHA1 88a24daa1893cc04f29e527ed2d4cf46497748a6
SHA512 111be1fe6203fa7b6b038ab42a825fe1284c209e79a6796560082bb31c5fe3782a64e3617331a5c95d7fc990b39de4eb127722299dcf4f25e4c6269a5b945c50
SSDEEP 384:0ZcIesNkARCg88Sy9uO8iusVpuGcOOPrXLpe8C/5t0:yeNcnd1jzcOi9Pot0
TLSH
T11E928E72A9786C67ADF7FA80F48622075FF85427F6C43B44D6ECAB0C02DA558130AD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75644594ef6bef4cff7745d92feaa0d485a5353ef637c0b83d99acf373d1f699
MD5 49f5b49c89a08520ce3cb2430e75b1bd
SHA1 b1cd4aab87b9cb902b6cd1559ac40d17e5ae2ee7
SHA512 261f7df0f0e58412177e6d4511d759596bdbf9c24659fef87d0aab4a5a958044ccd310d2f43d0524207a8f19c040f1085f608d8148c406d0609441ddb31a0c80
SSDEEP 192:SON16LCWtFQmiUyZKuLSuOCz3Sus6W+SulGBI/vqjU6:SON16mgjjumuO8iusVpu5cU6
TLSH
T167121937A868AC279DA27D84B48336175FB55127EA843F44DADC3F0C02DF58C230AD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5e4c28d5862125fd2623c81406b5b4788658d3ee938e0fa2dbe92858308709f7
MD5 9ebaffa36d5fad001f3356a27e1655dd
SHA1 873dea1fc67cf42a95fc4d095208d18b2b111358
SHA512 cf2a4393f365b0b9ab969c17e3704841a21adedf1d0637a84c3b3ebbec5fc10ee2fb553c9b12841591bb8129643c538d7b2e5804894b8e85dec9db5973f7c1d2
TLSH
T132413B5CBAEA1148B3B76E56AFF7696D487BBD732E06D45D00000D4F0A27A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

hrisitosense.exe

Path C:\Users\Admin\Downloads\hrisitosense.exe
Size 12.8MB
SHA256 f12316bceefbabe45f8279bd5a9d6e8e815a9f76114097991548ca7e259f6472
MD5 3a91c400d62443769a506d8f77c51a10
SHA1 e6d4b5abe0c4cd24ab41365402c2c02a09a7b0d5
SHA512 d285ef5ceb012ef750e9513a582f587ad0614e12594aff9fb7ab18fb6cba1a8fc4db54e9e57765c3f675c5810d484981c585a7e04a97425090e79c9b13334bd3
SSDEEP 393216:Lc5wGfq8rn2lcSqC5Lw/c0ZXsQF9DSvrj3n3EmRhXaoSwmp4uD:ryqCcAC5Lw/c0Z8vXn3vaovmquD
TLSH
T103D633130850B5A5F0911C7A929478D429173E672D3AF9AB0F05EAF2B7766C2FF1270B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2748-183-0x0000000000900000-0x0000000001C77000-memory.dmp

Download

memory/3664-216-0x0000000000860000-0x0000000001BD7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads