hxxp://brevo[.]com

Analysis

user interaction
yes
max time kernel
35s
max time network
36s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/09/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://brevo.com
Sample260922-tbsmsshg77

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1040	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345660220649119"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{D26DC467-92BF-489F-9A5E-4CF06C89EFB9}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 2884	5584	msedge.exe	80
PID 5584 wrote to memory of 5308	5584	msedge.exe	82
PID 5584 wrote to memory of 1040	5584	msedge.exe	81
PID 5584 wrote to memory of 4920	5584	msedge.exe	84
PID 5584 wrote to memory of 5308	5584	msedge.exe	82
PID 5584 wrote to memory of 5308	5584	msedge.exe	82
PID 5584 wrote to memory of 4920	5584	msedge.exe	84
PID 5584 wrote to memory of 3952	5584	msedge.exe	86
PID 5584 wrote to memory of 3952	5584	msedge.exe	86
PID 5584 wrote to memory of 3952	5584	msedge.exe	86
PID 5584 wrote to memory of 3452	5584	msedge.exe	85
PID 5584 wrote to memory of 3452	5584	msedge.exe	85
PID 5584 wrote to memory of 3452	5584	msedge.exe	85
PID 5584 wrote to memory of 5200	5584	msedge.exe	88
PID 5584 wrote to memory of 5200	5584	msedge.exe	88
PID 5584 wrote to memory of 5200	5584	msedge.exe	88
PID 5584 wrote to memory of 464	5584	msedge.exe	89
PID 5584 wrote to memory of 1472	5584	msedge.exe	90
PID 5584 wrote to memory of 464	5584	msedge.exe	89
PID 5584 wrote to memory of 1472	5584	msedge.exe	90
PID 5584 wrote to memory of 1428	5584	msedge.exe	92
PID 5584 wrote to memory of 1728	5584	msedge.exe	93
PID 1428 wrote to memory of 1960	1428	msedge.exe	94
PID 5584 wrote to memory of 940	5584	msedge.exe	97
PID 5584 wrote to memory of 940	5584	msedge.exe	97
PID 5584 wrote to memory of 940	5584	msedge.exe	97
PID 5584 wrote to memory of 2388	5584	msedge.exe	98
PID 5584 wrote to memory of 2388	5584	msedge.exe	98
PID 5584 wrote to memory of 2388	5584	msedge.exe	98
PID 5584 wrote to memory of 5152	5584	msedge.exe	99
PID 5584 wrote to memory of 5980	5584	msedge.exe	100
PID 5584 wrote to memory of 2232	5584	msedge.exe	101

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://brevo.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffeb4f8c188,0x7ffeb4f8c194,0x7ffeb4f8c1a0
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,7948631078540791578,14351230019658371362,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,13377104924236903755,8107923718934209176,262144 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,8030671846989193084,15278118525848811926,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,9620920257655339440,3933803116791378868,2097152 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,13362218328871568217,16758663347583248784,2097152 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4836,i,12854836862628338589,2254942756492267159,2097152 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,17872410480053431383,6018852325818417638,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,7523554297801909615,10932160667739138717,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,3948755976911885021,13363507702560694268,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,17906707494923785276,7704276742149569393,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,3948755976911885021,13363507702560694268,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6240,i,10714401543333867417,17729376918537630692,2097152 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4996,i,9401224682190556141,10847384898068883684,2097152 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,4509951254887176050,1921732025802573878,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2888,i,8515979611803102526,2598710748651234571,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,1828537390907353997,9524823409671014581,524288 --field-trial-handle=2552,i,238395619394272901,10804778252504091637,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 25KB
SHA256 65ca8d0660e3b9de3e082c82b5279ea161465588e50a3d278a6a9f0746329fb3
MD5 9c18ed4528b1d19016a6d36d403a8302
SHA1 2c22cd61385953205a4cc5008213972fe330bef7
SHA512 ae7a9bbac96223446d58562f2eac4987730c206d9c1839094155d1d2900b80b44063c99ae3b9ec01d05e1f9ea8de3d257e84dbbcbc6bfe2be12a2dee4c024c6e
SSDEEP 768:12tLi2YhxCBsWWLliBGdCN3kvJTNBGOaLszV:1YLd8x4WLlgGI8JPGOaLszV
TLSH
T163C2E1B126D9E58429488DA5537340DD394E8F8A0A8F1A0E5D3FE5171B39067B2C6CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 128KB
SHA256 a46ecb86cb5915c9bac7f5749ec82e00cb4b5a47b3c9716217935dbd4bca8e99
MD5 1868eb816552cef8a3934f72d5f438c7
SHA1 eb3d36614ac7099ad36cf31523f3f7fe1ed2c06d
SHA512 3f0aec4435646b0d44ae9aea7122b46db4dbc48f9a94dfa7c01cab19f45075b19cbed1c9a2b749f564bae29d2b56098406761ec09bf4bb3fc434439856a68926
SSDEEP 3072:XgruxO7cNEpaM41U8tVpbto8C99mFPwxGp0Jkk6IaPIiUhC:XgrIacEpa31zVVtA9mZwgpxkZoIiUhC
TLSH
T183D312C83680F029569B756004BF69B216357EAC676DB53462B3DC71D80C287E9EE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 39KB
SHA256 e2bb88de636c557cbf6190906f431140ad5a06bca9dd20bb1d9af05793bd02a2
MD5 9511e80ebef2ce39048bbec2d42014f3
SHA1 026b0e35ef411997b5d4428a6baf191b9ded9b2e
SHA512 dca17cce668fa0b99eb7992bc4ccb33430287e414cbea7d30f746757766be2834df8b98016f092d2411e9eb7f4a2738e7b67fd0b207ad895f5ac411a51af01d5
SSDEEP 768:Iat5AdnNEp+lCGhPhSmbvPf0PZ0kdsiuJ46k4XOqS7+/kuCwxGO9qi4s:IdNdEGhhSmT0Pxd7uJ46k8j8uCrO9qij
TLSH
T1D1030210BC411F4073B2B3A233992A00AF0858FAB5B155F79F2FC99637532A966422DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 144KB
SHA256 ae99aefbaaf864d1339083af7f10c3d9e3af0e91dcae8ea31766663de161d8ac
MD5 9331275cbe92c6c79958b51a6d1d6b99
SHA1 5197dec950ff6a6f0c8cbc3d45ed171f312bbd88
SHA512 50549608ee14377773970d56a6bd9d7b0bceb1eb119c37ba078fca79850f7026bdbc7fed7dc06b2b49f27195cddf2dec3740db7d03cb7d87128f2727bd8a6923
SSDEEP 3072:natlUkyiyY2yFZ5KYv/FtJWnFz7V0Dlmzcug8/gt0jbSRGF:aTUv5yPnFf4nGDlBu1FN
TLSH
T173E312787A4FDE31562D534383BB8EEE9D049B17888B85C41525EE6B8010D5FFCF2A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 35KB
SHA256 087d0129f117125d005bcb51883e903f098728f4545b5883ccf0063d82664f28
MD5 487700d8840f799e2b025d95e91ed587
SHA1 c18af62279f46cf0fb51aef8190f18bc3951cf98
SHA512 1eb8240c1014b2d2beb77dc6b8941e64b0645c8d099e18acc0871567a4963df0c424b4bb5e0be7c33d2be0b9704aebedac657a377a502baeab5fef1887df34d0
SSDEEP 768:p2E45zLTVs1Du/W31KS6yA+gXwep1kRqdxBCfsGuwPi/Bv/k3Isz7p:rKnS1mW31Kt+gXxARqdxsxivYIsx
TLSH
T17EF2F193CB8F35EF62EA0A520B6390398E5F7A14660BD151FE10E81DBB6040BCF255B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 194KB
SHA256 c02c0352edc835e523526af1df34341793f8eb6e1bdc4b4ec297581443326d35
MD5 6d9e7ba80df0dcd447511125d92296e7
SHA1 1b1eb341dab723264a79b9a87288774f57bc1c7f
SHA512 4c02ff3a1ae010720703d35c5fa7457ea93fca85778ac71eb2acd70ee326ef3853805b7998e17f508fa39abab382b93133dc08f70a519701a35ca0bf8cdd18f3
SSDEEP 3072:eKWcEPdMTaxf0SVRZ8RJJjCZlWEUS2mgc4qNZZiEzuZ6UZvKtr/7K119vkVVWM:eKsWTaxrVRs1Smc4OZ+ZH8OoWM
TLSH
T13514231B692A63F5780FC7E2E8778607D7DAA46F30976F3D515380487A20BF58881D8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 40KB
SHA256 66bd0d3f4caab58f0cc5d8bddef3bb9c13b9dce942e8586dc85d0c57392d61c4
MD5 e51271be3805e0ea303af703a371174c
SHA1 b3f929b2611ca1c1a1860f1d78321bf9ada4b3e0
SHA512 3cd27ba2085cfa992b06eea6892775e166c09d3f8ddcecd33adc82308dc87760205200f1362b35f9bc8b0e3374548d8e33e629733e97b1d783f621138ab39223
SSDEEP 768:9BEqb3StDqPpQNp4aO0gOMMEE6jLKeuk26rWXPwa1fTlbB5FEW7:96qb3CuqpUVxLKzk26rWXLTlt5FR7
TLSH
T15403F1AB1BA9701AF0FF173C3196E462196CEFE53853D30DAB5CBA151A43C8A6C490E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6
Size 20KB
SHA256 048ef08c47cc75b5305dc6a657dfe6742466f84662c347534b823d00a70fecb9
MD5 92d104d878035a68b89eac1287076ccd
SHA1 3c5ae80298d8c004230a16798b82c297e6491db9
SHA512 a4dd04e0d7c802381648d5b5f241ed4e598339c65775086942ad6190ca3ffd293b8a6263f3cbc442db7fd781884e3e18e09f6d40145f8e8734fe20f42fcf7b18
SSDEEP 384:YvuzkqqN3uPkFPXvpiLvueDC3WzVGPFnnJ1I2Rj:YvdNePklvpCuMLzUdn9
TLSH
T1D3A2E18771BEAEB82FAC7CB486C18EE8509C7859174060839049EA56DF01C5E9FB58DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000eb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000eb
Size 345KB
SHA256 af74444f93c1a87703c134e8e3a1762932e8c9ed17b5781360a51435080b8704
MD5 a3b1bd33206689c75f9acfb640a6ef7f
SHA1 88d1a94a23fc0b9702d6857e71038d5c01a0bc27
SHA512 7d2ab5783a9640015ad2215944cf3bff51babf2ca59fa0ee7e2e587c1ef56901b6ddb399c2a435757aa66bd2d5c7933326c606df7942d354ba6493c51c49acfa
SSDEEP 6144:dt6B0ZtO9WZMN5KSdoaPiC1ghYvx4BmlxTbD5FuTbb1cc:dt6B0ZtCWA5KYP8qvx4klZqTec
TLSH
T1927423E3AC113A4A630789E74DC8A1AB7453C5C32A56FF4237467887A6D8D8E365CF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0e54078e24218fdfd59aaaedf00e3f445b993a63b50c1eab620f68facfda2dda
MD5 3b31082168f3d99d908df4d9596ec6de
SHA1 f5a7dd47d2faf9cf6b31faefa84ce2dc42fcec47
SHA512 3a8a0716fe933a6cae87c4f1395855118e7f2d214e2ab25af13b18eea78d263d5996866f0f58583a6e785c84b72926d5ea521424b5bd3c5022f4b1d74fc57dd4
SSDEEP 192:sxZiRfF8/fJs4I1ZqMqVzodpJA/W6+WNGRR/Y0gWDzuRL+lIgjyJ:sxZiv8/fJsV7qO6/bi/5vv4LcjO
TLSH
T1C942B855AD28A93F9CC7D619BB15BF53E3F95032A0915E48A6FCCA2C10EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c81770650d80f4a6c3d658cb7da3130fb94904612967ba8c09509f33729b6e77
MD5 1c631fc594c4c9f32a13cbe2051a88f7
SHA1 652df3734dda308eecaf7bcb4ea2121e2c38fba7
SHA512 fe39437ae0fbf65e6140afce4ff5aaf4480701b5717ce03b682935923802f73fe85197e2e136a004673692d9d17e571a333832827d09cf286dc36457e371afda
SSDEEP 192:sxZiRfF8/fJsg7I1ZqMqezodpJH4/W6+WNSEGxQRR/Y0gWqzuRL+lIg5HyJ:sxZiv8/fJsgM7q1i/bCy/5vi4LctO
TLSH
T1FF42C656AD34697B9CD7D619BA15BF53D3F99032A1C01E48AAFC8F1C10EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e96bcc724e57e28f2f7c17c0b5e5467c0e99b65f86f47395e77efb23cb82902d
MD5 2ac601d062460763cf635adac5bc8ec8
SHA1 af43540b1c76b0cc4478f6364401e03b62c00ba2
SHA512 44bf9dd530078056ad3274075e4f784265920f46152785adebc13f935bfc042c23ccc1ee4f2a0194ecfd7bde1266a567ffe361d3244a7b576aa138ad64b89ca1
SSDEEP 192:sxZiRfF8/fJsgII1ZqMqSMzodpJf/W6+WNSsARR/Y0gWDzuRL+lIg5HyJ:sxZiv8/fJsgF7qCPt/bQ/5vv4LctO
TLSH
T17142C716AD34A93B9CC7D619FB15BF53E3F95032A0915E48AAFC8E1C10EB6DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 fab72c4fe3c99ab9934eee2cfcc91283a80567fca7823fdade8be2534bb752d6
MD5 6c4e55d79d9c24e573bcbfa1c93df27c
SHA1 4d5967ef799200ed9ffea00654c29a39439ccd29
SHA512 bfcfb3540a21332267332106fb17852b74ca0e61d49f727a7f20d1f446e070d8423dd743951d3689bbf687051d4d0a4dc8c5a5547cff96d7b46235aa0a4197e5
SSDEEP 768:AvmgC8Ba29tWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroTN:AvmgC8Ba29tWRmpbQPLu1jaKHgLpj+sH
TLSH
T127D2093B640CCB7E4FC04E9DDD266F966EE802D7AA588D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 3e9fb838667c11d642191eef0da72e13ac2d3c307a6120488f59d7ee9993c482
MD5 cccad8fda82e90de71b21e424d4ed1c2
SHA1 00e2192a61e9b4975984b0e161f210e2e295a9f3
SHA512 6f5b90cadbfdb909090ec8b084a0c0454887f148c967f760e3c2b375fe52c64fdac3663098ae799e8922fe307576c6a479372dcbdc820b2dc2b9b0a317958be3
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgj:ohdNdBzXXFPXgRbKvtp0JlznuLv68
TLSH
T115B2261131BA12543CBE390890B59B2F528235B3711CE62B7FFD40A68E6BE485DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e9afeac5-25c6-4be1-b181-123197d52f09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e9afeac5-25c6-4be1-b181-123197d52f09.tmp
Size 649B
SHA256 84fc1f69f2a0898c42c860717ea4aed9c9e6dc8131d65c4b6a0d5baa230adf0c
MD5 df0c70e62172dcb3ba01175890a00338
SHA1 a5c6dcf417c24148286832df99e823a5343816b5
SHA512 de8b06875721942185df166a1dabe43e420fa3a0911ecf7e81f660810de06fa1708fad4af1b34f6f826c2372b3261d51157a25267c5d22e24c7f9ed1429ebc8b
TLSH
T1E3F0D1B9CC21BC3B18F90B2D20944B8BEA9413672A50985B3A3C820C8FB163B8586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bf59f5a281746e4b265219b8f17f4035d4705d910726c65148121c221a704ee7
MD5 6cea7780ffe2b2ca7a0b332abc7addf9
SHA1 f411539a710c512ce2fb70a41c9b2ae6165e3d4d
SHA512 9286b1225516d516166db7010938aafa0b2b49b711948ccae9c9749665ac1ea337526d18af2ef32562f59bd6a11b1dbecd19c5343f1d6db5219d194d02d06c85
SSDEEP 384:nZiFiZcIn38NC8TUNTUlIRbCC7Hc5xzyfoBjfOxAJhtZwHVovv77O6R2Feoy7gLK:wFQn39wgACQbdBywoVW77TRD+A
TLSH
T174C24B32DCA4C977EDEB8ED9A70A7A03EEF04163D98C9AC4D5D95E1D009B19E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 075e73ce5d229f58f77a2c2fcefc09ff5a36f682e714fdd20385b7e81721719a
MD5 f2b9a633e1221ce2cb3df7dc0158106f
SHA1 73ba9f1e46f60df1b5a5602f3558c8a6b0ce1821
SHA512 920709867959dde74f02de127dc4a9ff5231363016edfcee5ad5ffbfaed67c51467728c9d7c0d1c1c4e4c7ee6cf4fc9a34a17e93bb67d1ae8de9e7f605279aae
SSDEEP 384:nNiFiZcIn38NA8TUNTUlIRvCC7mc5xzyfoBjfOxAJhtZwHVovv7xuvzxV+MhdpJw:EFQn3HwgQCfbdBywoVW74184pJO3
TLSH
T1F5C26B35ECA4CDB7ECEA8AC9E74A7603DEF04163D98C9AC4D5D95E1D009B19E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7201f710d1b9709bf660f232cbc18fe6025301077a977b84157bb073a129a859
MD5 47aba16d346a212944d2deb568be4d20
SHA1 6e07913eb159e3a9a4ea28c582e6d9f89cdf7c2e
SHA512 5662f94771e5f6e4fc535b94791464a27e7737639d89e0ac8d7f39e931a835cbdf418fbe3fdbee419c4852e350cb952b3935a57f87a9bfcd17e34406d21bef21
SSDEEP 384:n9iFiZcI638Nj8TUNTUlIxBCC7JujcxzyfoBjfOxAJhtZwH1QJ7O6R2Feoy7gL/P:0FQ63cwgCC0jWdBywouJ7TRDRA
TLSH
T1F9C25B35ECA4CABBE9EB8FD9A74A7A07EEF00163D59C89C0D5D85D1D009719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1728-622-0x0000025280000000-0x0000025281000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads