hxxps://sephoraus[.]sharepoint[.]com/[:]f[:]/s/BR-Ecommerce/IgCpKRuSZY0uSaEfESbgrLMpAZNvSnmD9xXzf3ny1o6Pqcw

Analysis

user interaction
yes
max time kernel
56s
max time network
58s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/10/2026, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sephoraus.sharepoint.com/:f:/s/BR-Ecommerce/IgCpKRuSZY0uSaEfESbgrLMpAZNvSnmD9xXzf3ny1o6Pqcw
Sample261002-zbrcmavset

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{5E42CA81-9064-4979-926D-7151D72B8EFA}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4988	3928	msedge.exe	83
PID 3928 wrote to memory of 4392	3928	msedge.exe	84
PID 3928 wrote to memory of 3640	3928	msedge.exe	85
PID 3928 wrote to memory of 3640	3928	msedge.exe	85
PID 3928 wrote to memory of 3640	3928	msedge.exe	85
PID 3928 wrote to memory of 4972	3928	msedge.exe	86
PID 3928 wrote to memory of 4972	3928	msedge.exe	86
PID 3928 wrote to memory of 2592	3928	msedge.exe	88
PID 3928 wrote to memory of 2592	3928	msedge.exe	88
PID 3928 wrote to memory of 2592	3928	msedge.exe	88
PID 3928 wrote to memory of 1136	3928	msedge.exe	89
PID 3928 wrote to memory of 1136	3928	msedge.exe	89
PID 3928 wrote to memory of 1136	3928	msedge.exe	89
PID 3928 wrote to memory of 3788	3928	msedge.exe	91
PID 3928 wrote to memory of 3788	3928	msedge.exe	91
PID 3928 wrote to memory of 3788	3928	msedge.exe	91
PID 3928 wrote to memory of 1300	3928	msedge.exe	92
PID 3928 wrote to memory of 3112	3928	msedge.exe	93
PID 3928 wrote to memory of 1300	3928	msedge.exe	92
PID 3928 wrote to memory of 1300	3928	msedge.exe	92
PID 3928 wrote to memory of 3144	3928	msedge.exe	94
PID 3928 wrote to memory of 3112	3928	msedge.exe	93
PID 3928 wrote to memory of 3112	3928	msedge.exe	93
PID 3928 wrote to memory of 3144	3928	msedge.exe	94
PID 3928 wrote to memory of 3144	3928	msedge.exe	94
PID 3928 wrote to memory of 4872	3928	msedge.exe	97
PID 3928 wrote to memory of 4872	3928	msedge.exe	97
PID 3928 wrote to memory of 4348	3928	msedge.exe	98
PID 3928 wrote to memory of 4348	3928	msedge.exe	98
PID 3928 wrote to memory of 2488	3928	msedge.exe	100
PID 3928 wrote to memory of 1144	3928	msedge.exe	101
PID 2488 wrote to memory of 2568	2488	msedge.exe	102
PID 3928 wrote to memory of 2484	3928	msedge.exe	103
PID 3928 wrote to memory of 4884	3928	msedge.exe	104
PID 3928 wrote to memory of 2020	3928	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sephoraus.sharepoint.com/:f:/s/BR-Ecommerce/IgCpKRuSZY0uSaEfESbgrLMpAZNvSnmD9xXzf3ny1o6Pqcw
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x248,0x24c,0x250,0x244,0x21c,0x7ff95696c188,0x7ff95696c194,0x7ff95696c1a0
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1628,i,10929208606022690005,2515359355330577693,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1500,i,8463751329838122535,13867821586080149328,262144 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,12012899743986874819,3243745800074096392,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5325144809238244478,6058939307614094323,2097152 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3141890609751171652,295460073531310990,2097152 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,14527809404146773456,7934659502532653541,2097152 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,2484896880831263916,17745448966634651717,2097152 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4192,i,16792565434863595755,11370517644276503923,2097152 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4224,i,7186402749393163335,14141598942073130197,2097152 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,1537563726681164775,13145809888520901820,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,208732739451060313,6851571056966402617,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,2021783815258284526,17241743383756499445,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11297738127371455112,7673502777442700651,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,2021783815258284526,17241743383756499445,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,8451612369145817198,11021914739619805622,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,17763846736926477318,10319915790419411327,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,17631717419918612246,16976900754729719955,524288 --field-trial-handle=2296,i,13440332806173366732,3124414212898730086,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

112fa1c9-ad8f-48d3-bc5d-4947c4679a7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\112fa1c9-ad8f-48d3-bc5d-4947c4679a7b.tmp
Size 8KB
SHA256 c8bdd75ef1fe01f10c33cd421883505e6f71a0e3a01c7106665d0150cf4175ed
MD5 74537c097923496890de238d389ba3d7
SHA1 ca8fbf91d720230abf25d40d4e2cfaa26c091ed7
SHA512 a4cbce81f1db1474d77b82a7bb3dda3d03e00db41f95586cc72071d1f5276c33ed990e08a87a66f5efd05e6fe07304afc69dd9ca544836cdaf0afc13a9fabc25
SSDEEP 192:AGNc6WLkQmiUyVmaLEbnckX5m9r8EojzorYT44lhXU6:AGNc6a0KzLQckX5mV8Ew8yxNU6
TLSH
T16F02D939AC787C7B5EF3AD49B94A27139EE5111BEA852F44DAEC1E1D00D769C2306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3be394c2-014e-4414-933f-4aad884d41ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3be394c2-014e-4414-933f-4aad884d41ac.tmp
Size 18KB
SHA256 0c835277e1c648280b719549054251323f17185cc62ba4bf497fd0e85087d2bc
MD5 70804e5458e39a269137244eed632a59
SHA1 78c422decb8a467a78ca8fba391832be4f240e2a
SHA512 f9407f4d09ebadb1c3379618e17767d225059fcfd8927e95fdbb873e1c416e6523934aa8f93ceb6aff65ffbbb7709c5dee9ecbd30dbc01aa06ee146d6696e3dc
SSDEEP 384:DZcIh8ND7Agrpdkm9ckX5mV8Ew8y9fXWHtgOIwZOykoJop:bhfVsAtqfWHXsUJG
TLSH
T1DB828D739C745DBB19F7A149B54A36039FF89017AAC89F50D8EC5B2D01DA6A8130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73f1eb30-9b57-43a3-8193-57c2fd48de3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\73f1eb30-9b57-43a3-8193-57c2fd48de3c.tmp
Size 8KB
SHA256 a0a962c5713b6987b680e4c53254b12ab18833977a5c4d3cc4b362922f454ef5
MD5 28e0fd90dfb535643cb4045ff2d66030
SHA1 239d3cda7b067d7015f1ee5b16c26cf3332a4be6
SHA512 1269ec936d94d714d2f81236441d32ce341e5e26ba7e8b9434a59b12b6973fda5933ece33d5a61caa1448b395a104c511b0feb24ea61c01dd7d36dab2de6b231
SSDEEP 192:AGNe6WLSQmiUy/ayEbnckX5m9r8EojzorYT9fXtMeLqoU6:AGNe6aONyQckX5mV8Ew8y9fXpHU6
TLSH
T137120937AC38BC7B1EE2B455B44736139EA15117EF886F54DAEC1A2C01DE69C230A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7418d4ca-278e-477b-94bd-3b3903f76507.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7418d4ca-278e-477b-94bd-3b3903f76507.tmp
Size 18KB
SHA256 7621797652ad9109c8e8e767f61ac1c7f62fadfc7e5bbb9e4da2687bc66a1503
MD5 5115213f981e5303f513c536141ab983
SHA1 cbfd43b1a76e7ed6fec23b15e00b6151daa4ab85
SHA512 0fcbedd6b87a5ae8197021842b3e53b0370e30caf222bac39e60d991c86844dee61e942feaf151eb63b2786735e74d9bd0bcd511b03c7fbf8c9b232fef2831e1
SSDEEP 384:SZcIh8ND7Agrpdkm9ckX5mV8Ew8y9fXWHtgOIwZOykoJop:ghfVsAtqfWHXsUJG
TLSH
T1E6828D739C745DBB1DF7A149B54A36039FF89017AAC9AF50D8EC5B2D01DA6A8130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3199366-d15b-48b2-b022-2210e13179eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d3199366-d15b-48b2-b022-2210e13179eb.tmp
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f4205d47f4b3af998f8f58a67fcdeebde8cdd5a5169c45108d214c55c153f1c7
MD5 783ae6cf34fcf2d523873bb407c465de
SHA1 3d0771439a62a0c51da957d9b5e67fcdf716a37c
SHA512 42aaecc54b903c356fca0772ac69e40803d81a2c3fc3d77460b51efea0a214d9972e712e96f10120b498f2199217bd7564596eab40585ae393a1394fb2539dbb
TLSH
T1D4D080A5DD7966ECF031213C533617147948564156831105E55005AE4D641D355F58B4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3ac6d06c818694d314fd7e1c8585b8fed5f3f436c22dad65d4d99f6c08dbd429
MD5 2ba269f116715c306bf5080c1c6521f2
SHA1 be2370d904dca815a45076b6a5423deaa829d096
SHA512 f7e6b5701770ad9b5ee570b961252022942870c6f4ace7d03c97456e604ce4904f5b9f5a58435bbd4a2a83081cc35c2708592f41df42cc24e05850cf5301a4ec
TLSH
T11ED02BE4EE7811DCF052203C223B17283944810050830001D49001EE0C443D312BC034
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c3d6e1c303999af0d8df13a878ff81ae1d0a4b0dbd87e6e8d2a4b14b845481ea
MD5 eee62502b43458b13946c8ca96c885fd
SHA1 ea588ca4d4a09f35814349e8f76ec45d1492164b
SHA512 7c618563bb16a7574d927489dd738711547fcf3c086ee853a238d1a7bb12fafffd84da5082c7561413c8f0e3687f89713ccfbe58b46b221ce21121a466383e88
TLSH
T18BD02BE4EEB815DCF452203C223B17283944810050830002D49001EE0C453D312BC034
MD5 SHA1 SHA512 TLSH

Submit Download

4d8343dc-789a-4401-ad7f-249ee5c9a097.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d8343dc-789a-4401-ad7f-249ee5c9a097.tmp
Size 10KB
SHA256 5d69116c77d825024cde30f9340be142751c0caca3b4239d2d6bda467e14b134
MD5 597747864194b646ac3bee9eb173a08f
SHA1 c39ae5c6a799645ffbab24d08f7ccd481dcf9f13
SHA512 10f3ce9921a76dc99ebb95f09b0bab21ea87c7370feb41cd3b17ced5e6bee4e11ae3ce50d8ced6b0a2437e276b3691c6d692c971861bb4cfbf66ede82c6bb6da
SSDEEP 192:sxZMRzbS/fnsphEiUIdpGk/W6+WNqd6XY0Hddf1Ig5HJ:sxZMZS/fnsph/L/b9X5fx7
TLSH
T1A522D8666E38697B8CCBD20ABA15BF53E2F9503255D11E48E6FCC61C05E76CE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e767091-fc82-46b1-9717-5a5f98324a2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e767091-fc82-46b1-9717-5a5f98324a2d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c23be94-88dc-40b5-84b4-cc9e3068f051.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c23be94-88dc-40b5-84b4-cc9e3068f051.tmp
Size 10KB
SHA256 c00e52a4287a6812f76b92467ef9fa9078b6e62c6f771f6c432a5467ac7ee53e
MD5 7bfee86e240cc3a7d9cad1a9967048ec
SHA1 2ed386613d3afed0ab473e6c4c9d989cfdaad5ae
SHA512 5553f161decc7b02848e61a0d557b69b61a2ef04725b00603c2e6756c5ad30edd3776e8debb9c9e9c021875080921999bbfe2e8784f19b11c1980dc0ddc8aec2
SSDEEP 192:sxZMRzbS/fnsJliUIdpGU/W6+WNqAW/Y0HVdf1IgrJ:sxZMZS/fnsJIf/bo/5nx9
TLSH
T13A22D9566E38A97B8CCBE20ABA15BF53E2F9503255D11E48E6FCC61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 31KB
SHA256 1c99c59cad092f91d9e678be707aaf79b78781a0bf68ecf7cc6737ac6017900e
MD5 4f7c843ef9c7f963faace0dd479a8bcf
SHA1 d58f5898f93d67478d1f65b93d4708a398fa55fd
SHA512 9167d46ab928c63198aa616602fb77e94e5ce6eaa5e5681dd4309393a8ee4f1f919c039c1a8e229abe44da5b18d83200f5f3ff9612cf618e3f60ab6ece716496
SSDEEP 768:LzbnsOSWGhsUcoHxkbkcxNzVOb/ty7mcX3+afu5HMT9+/WZ8inZ/r9FzMPR:LnsOSHhvcoHxkQcrxOpcH+afn9WWtnZa
TLSH
T1F3E2E19E8E7C27D7CEA8F106E0ECD08535B152C7CB11F59A2BF549D3EA61E05B06A231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 093dd9ae24a401929f3fb0e81a14e1eee81f88e851c89df1acd1e5f7daff53eb
MD5 fad451a18042e86f785aa18edb182997
SHA1 96698fda5094cbe4de0a0a1df14852ba61fdc5fa
SHA512 5237dea16ea9115b01cbb43e4981c17db73a62c306fffe37d4cbe84fa8ecde2d88bc471ba8bf20ec99c097e32c9b727290c2ba8e077e7795d04d2958318e7775
TLSH
T1E46164B3CE794CE2EF6FC17498D518873BB8A78538875D6118ACED79691E712F054040
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c26ad0f4fecf011308893ee2d4bf1169638fda1f4d38e6cbbf37359f0008c669
MD5 2ccb2536edc90885e6cdcfaa7a975d1a
SHA1 51be889eb8a9d94c6b557d87cab11838850a9c3c
SHA512 561fb43c0c2c1ae1ea9c7191ed8f60948c4c0f578730de6aae4a84c870faac77647642366e44b37b475107b87ff944ec1e88698a325d85f30815940000808b31
TLSH
T1927183B7CE784CE2EF6FC17494E418833BB8A78938875D610CACED796A1E712F094040
MD5 SHA1 SHA512 TLSH

Submit Download

866870c6-36c3-43da-9a90-29c644f7ca73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\866870c6-36c3-43da-9a90-29c644f7ca73.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

173a18d9-1167-4197-afab-fe9737f8f4fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\173a18d9-1167-4197-afab-fe9737f8f4fd.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e0e567e2-0beb-49be-be29-5726e154ffd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0e567e2-0beb-49be-be29-5726e154ffd3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8d3f0042a4f0188911c46dfd3c251b13837bc42ffa74ad6d9fa715eafdb7770b
MD5 ca05d722356ff3561ec5dfbe4ce69501
SHA1 8b0a14647696527c34bb5b26cc52cc5beb8b0263
SHA512 873fcc591f4403e014416f3055dca2dada7ae3cb8235971f91e8b677e3404e5ed9a785bdb012bb795f132e232111ea9914eff317b00816c4f3c272b3a2830814
SSDEEP 192:sxZtRzbS/fnsph9iUIdpGB/W6+WNqvgZY0Hfdf1Ig5HJ:sxZtZS/fnsphw6/bTZ5lx7
TLSH
T13E32D8566E38697B8CCBE20ABA15BF53E6F9503255911E48E6FCC61C05E77CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f65c096403158cdb773cbb8e45c2a250f2d912e062749b5e8b2230081f4d4cd0
MD5 92a0ef473ef49dc71301248a558cd85d
SHA1 3ea4979ab14a4583350e931b61d0b93c6394bb2f
SHA512 5dd366076a641197c6b3e4430d1744ceb993faa505dd9e130d6cc9a4a3c01ac548a28a3f72d803c087e1a754524dfab6e1b5dcfcaf5fa7f1911af81525f8dac1
SSDEEP 48:K4XIRKM4sTyfp2dZXzfkvzUPIUBkKVB9/kx50G0XvCIfK/Kwjy+:K4XSKM4yy2AKnKcCEK/K2Z
TLSH
T17491360435B682D03ABD266C43E98A1B464131B37059E62F3FBE95715E3AE054CFCDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af8a4d8d-87a6-4784-a830-9758a8620e27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af8a4d8d-87a6-4784-a830-9758a8620e27.tmp
Size 10KB
SHA256 e6e14bd0fcd174c471efa32081e6f80d84dbb67fd5aacbf145442e436445ad84
MD5 31ebd97c482d4dc545e651a4beae85e7
SHA1 06f1d52f1542b5736cebd9a7c86c3f5a33ac16b6
SHA512 d11b8151b5f14f8674faf8b9c9cd18951614efc4e16434531922be2b600bf594ff22e0cff48994db84593f0d50cbea69d547a8b3ab66ff0809098091c2ab4e09
SSDEEP 192:sxZMRzbS/fnspmliUIdpGU/W6+WNqd6XY0Hsdf1Ig5tJ:sxZMZS/fnspmIf/b9X5exV
TLSH
T19422C8566E38697B8CCBD20ABA15BF53E6F9103295D11E4CE6FC861C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b27869e4-a351-44df-affc-5e93f4ad6dc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b27869e4-a351-44df-affc-5e93f4ad6dc9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d2223c29-da63-4c38-a2a3-4d2ba38c5575.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d2223c29-da63-4c38-a2a3-4d2ba38c5575.tmp
Size 28KB
SHA256 f5ba3596ca219442d653f1598477ff993df366f93697cfc1d9bab3440150dc7f
MD5 48b96349da49a190a5a41c6e44f3702a
SHA1 6c56a956a5c48938406ef25abe5e280ca5f994b1
SHA512 bd57ba9e141e71342cb86f32961c43820c0b6b4d415ababc5113fe4b763a3e3499574e4e77d5afc12e71e1cebf4dde08500a3b317bbc1e83f23cbeab6f2d5241
SSDEEP 768:I9Y2I87M23TWRmjdQVx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NyLl/cu0yCHroaT:I9Y2I87M23TWRmjdQVxu1jaKNyLpc3yG
TLSH
T12AD2EA3B240CCB7E4FC11E9DDD5A6F976E9802C7A6688D4047FA894C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b360453e-dac4-4a1e-aa6c-a901caf7fbbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b360453e-dac4-4a1e-aa6c-a901caf7fbbe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads