hxxps://cdn[.]discordapp[.]com/attachments/1555733842126438434/1555743217033683034/xgha74ZFIosb[.]exe?backend=b2&ex=6ac1a247&is=6ac050c7&hm=872998fa7fbcbf12047467988549742eb8b92cc6e1720d55625eb0c4e9fe25cd&

Analysis

user interaction
yes
max time kernel
26s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1555733842126438434/1555743217033683034/xgha74ZFIosb.exe?backend=b2&ex=6ac1a247&is=6ac050c7&hm=872998fa7fbcbf12047467988549742eb8b92cc6e1720d55625eb0c4e9fe25cd&
Sample261003-rmhkvsdf68

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
21	2040	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
2348	xgha74ZFIosb.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{39A441EB-850F-4B2A-974F-69897C900EC2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 400	3020	msedge.exe	86
PID 3020 wrote to memory of 4988	3020	msedge.exe	87
PID 3020 wrote to memory of 2040	3020	msedge.exe	88
PID 3020 wrote to memory of 4988	3020	msedge.exe	87
PID 3020 wrote to memory of 4988	3020	msedge.exe	87
PID 3020 wrote to memory of 4068	3020	msedge.exe	90
PID 3020 wrote to memory of 4068	3020	msedge.exe	90
PID 3020 wrote to memory of 2632	3020	msedge.exe	91
PID 3020 wrote to memory of 2632	3020	msedge.exe	91
PID 3020 wrote to memory of 2632	3020	msedge.exe	91
PID 3020 wrote to memory of 440	3020	msedge.exe	92
PID 3020 wrote to memory of 440	3020	msedge.exe	92
PID 3020 wrote to memory of 440	3020	msedge.exe	92
PID 3020 wrote to memory of 1244	3020	msedge.exe	93
PID 3020 wrote to memory of 1244	3020	msedge.exe	93
PID 3020 wrote to memory of 1244	3020	msedge.exe	93
PID 3020 wrote to memory of 1516	3020	msedge.exe	94
PID 3020 wrote to memory of 1516	3020	msedge.exe	94
PID 3020 wrote to memory of 1516	3020	msedge.exe	94
PID 3020 wrote to memory of 448	3020	msedge.exe	98
PID 3020 wrote to memory of 2248	3020	msedge.exe	99
PID 3020 wrote to memory of 448	3020	msedge.exe	98
PID 3020 wrote to memory of 2248	3020	msedge.exe	99
PID 3020 wrote to memory of 2716	3020	msedge.exe	100
PID 3020 wrote to memory of 2716	3020	msedge.exe	100
PID 3020 wrote to memory of 4028	3020	msedge.exe	101
PID 3020 wrote to memory of 4028	3020	msedge.exe	101
PID 3020 wrote to memory of 4028	3020	msedge.exe	101
PID 3020 wrote to memory of 4368	3020	msedge.exe	102
PID 3020 wrote to memory of 2476	3020	msedge.exe	103
PID 3020 wrote to memory of 2476	3020	msedge.exe	103
PID 3020 wrote to memory of 1828	3020	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1555733842126438434/1555743217033683034/xgha74ZFIosb.exe?backend=b2&ex=6ac1a247&is=6ac050c7&hm=872998fa7fbcbf12047467988549742eb8b92cc6e1720d55625eb0c4e9fe25cd&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe609c188,0x7ffbe609c194,0x7ffbe609c1a0
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10557589150748501546,3688666302545131800,262144 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,2344875900866109254,16473539974870756883,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,3331109100853426769,13926451713722878286,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12307549085320600749,17782490849591126749,2097152 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,15781856246953099407,12678820308944145421,2097152 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,2130399662015534294,17638657352954577806,2097152 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,9393103624190289388,13567249368643876188,2097152 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,6222017792716128580,10136317112658680919,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,6515977871062819956,7800421350250697079,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,17673904865432061291,244412218518453751,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5700,i,1025109723024496201,5963449080746021489,2097152 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,5662041981571484084,4772875490986207246,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,513918200494791207,10103992531612842878,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,10148423314564132890,2797172353218165567,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,10148423314564132890,2797172353218165567,524288 --field-trial-handle=2276,i,15351376319977203404,9940916841752985383,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3840

C:\Users\Admin\Downloads\xgha74ZFIosb.exe
"C:\Users\Admin\Downloads\xgha74ZFIosb.exe"
1⤵
- Executes dropped EXE
PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2626d2af-4ed7-4976-94f8-a675f4188c4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2626d2af-4ed7-4976-94f8-a675f4188c4c.tmp
Size 18KB
SHA256 b873a0807898ffda53565cf22e44a7f8d89cd80c6f5eea9ed829dd0c8f0d4fba
MD5 39b2e9db942bc4b24611aa3243b372e0
SHA1 919bbf94eab079df18042e7335845135af1b8b91
SHA512 a6c8d698e2b7c594c25952a2ee7e5fdeae0411142d9e1c73c2e07ae6447e35a209c8912bfcdd132521f92fd90e86e843f6eada4fadc4ee3bc7fc743ecd23fc15
SSDEEP 384:CZcIzsNX3McppuhpSwA9iX5FDAVtgOIwZOyfLloQ:wzRUsEaYVXs0h7
TLSH
T124828E33AC786C7B5CE6E145F44736039F789127EBC8AF94C9ED672D05EA294030B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

38661bf9-598d-4a88-a6f7-c034deba7fdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38661bf9-598d-4a88-a6f7-c034deba7fdc.tmp
Size 9KB
SHA256 d8f36791b236e3386f146d6f4699ec6721628fcc8bcea2c9f307ef10ce20a842
MD5 d1c482d96f836c1380e4bace1e7c2e32
SHA1 2df7720b123ed6b1ca2d18886da4bbacd0e953de
SHA512 e6f94711bad07463a9dabce3f248665f74a4744192928b787f5266704e1b1d2f088eddca6f9c728db5b0fe948fd17453a1fd1815ab3afcb4d80071ac99e39e0c
SSDEEP 192:sxZaRznO/fBs+9JIdpJHW6+WNGY3sgvIg5UJ:sxZahO/fBs+9CJHbGye
TLSH
T16A22C8126E38A57B8CCBE21DBA257F53E6F9503255D01E58E6FC961C05E6ACE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85eb1654-2c77-49ab-b1cc-11b917c5c5f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85eb1654-2c77-49ab-b1cc-11b917c5c5f2.tmp
Size 9KB
SHA256 48a89477f93117f970da6d2222bd0c5a6f6827aeea68fe9095fe923846ae2573
MD5 6679f9888ab735c188daeed13aa14d72
SHA1 11ad881a04088a0ee307928f5e0e6a17ff9b3aad
SHA512 47bb5176f00cf500f65d0a9abf8397a72468b83fe827eb8f15be83820c395d6ae454174ea31f8cccb1e6095c8a097b6332a1965dd4a084aeda05dcd7573844a2
SSDEEP 192:sxZaRznO/fBsbJIdpJHW6+WNGY3FgvIgrJ:sxZahO/fBsbCJHbGJ9
TLSH
T13012C8126E28A57B8CC7E21DBB257F03E6F9503255D41E58EAFC961C05E6ACE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d4a5e22cd853546a6531528c73da13db252334784bf272f897df0a0eae8ffc8d
MD5 b295d32b52c1f4391fda4dc8e11c79c9
SHA1 f6ef1547a108581bb592be2e052eb96016cd97f7
SHA512 35def8dd5a765a9ccd6da8f7a7bbd860b5905dea6cf11163715f6a29570222af871b84d2997685757697287ca45f90bc16fc569b885f1c23b63f3383d82e0e42
TLSH
T18261418AA8005861FF7F4279A6D5368FB63C55607D431D032E73DEBE6C06724891C26F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d728e0557e5c4f177889ddf9a703cab3ab941e73664982219d2ef56769f9a435
MD5 1efc943b6b40ebb24cf478107b59516b
SHA1 0fa8f6c8296a973e28293abd45e83e9faa4a84e2
SHA512 8e2b8beb6a9bc84ce690e01e0196c2329d7e093f8c6145d4a3870645fed68865e02b62de675e4dc2e71e183c234caa4bb4d87e81166ab1abe5559c4f35c6f26c
TLSH
T1B261518AA8004861FFBF4279A6D4328FB63C95A03C431D032E73DDBE6C06724891C26F
MD5 SHA1 SHA512 TLSH

Submit Download

85144809-4d0b-44e0-82ae-8f42a38f2510.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\85144809-4d0b-44e0-82ae-8f42a38f2510.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

10017b14-f6ba-4c11-b488-b3562ea4fd4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\10017b14-f6ba-4c11-b488-b3562ea4fd4a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b02a17c1-7777-47b4-aef4-4fe8a76eb0ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b02a17c1-7777-47b4-aef4-4fe8a76eb0ad.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a4bdb91d-25bd-4a9e-a92c-d6bebc529670.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4bdb91d-25bd-4a9e-a92c-d6bebc529670.tmp
Size 27KB
SHA256 f86b60c796cefdf71e37e3ad52fbcdc70001a0a55dd9e3562f7bde590bb1a8f9
MD5 8948e4eff51e8f67e3e42773dd732eee
SHA1 cc48bc9d4265caf299fd68e23f7ef872721036ad
SHA512 e8d5f357f0cd762c9b805a0462c02450338d9a8d733e56e82b95f7d283edf75609890200e13b4fdb3f2331a2ea5d352560d622bb7fe29278b55accc97f73e8ba
SSDEEP 768:me30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ721rolZM0:me30AbSWvS2l9u1jaLmLZ12O/
TLSH
T191C2DA3B644CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4047FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a84b6c63-e964-41d8-8d26-2cbed6e96e02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a84b6c63-e964-41d8-8d26-2cbed6e96e02.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca284b96-5990-4e9e-8334-57b9ec450c4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca284b96-5990-4e9e-8334-57b9ec450c4b.tmp
Size 8KB
SHA256 84d6a97add2bb9cb335c9554fa37d36fb6dd6460f2fcf9b36eb1127fd4e09913
MD5 bf673347ce33f35302d983b4ba151044
SHA1 ac4abcd687f6307f1d29341fc292fdfa18d8da58
SHA512 a2c80926879939cda0d23e9338e8defaca56d8c52afad2e5049ac4119b4db5aaafc741232230f4646d3e5068aceb82651165a5c59f8849f39c2ed3a058772143
SSDEEP 192:LONC6Amwpv1QmiUyIZwgsiX5FXmEVr6JlRnqo7U6:LONC6ipr/GgsiX5FDWVU6
TLSH
T1B5120A36A878AC7F4DD2E555F04735139E68526BDB887F84C5EC272C06EF29C530B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d209e243-6024-4154-b13a-431e46c6a260.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d209e243-6024-4154-b13a-431e46c6a260.tmp
Size 18KB
SHA256 e9f901be4d605ca09216b1af4e5b9a105dd21f7e218e4fcb745e3d099970550f
MD5 6e9bacc9d253ea721327fc4d4d7da61f
SHA1 f1a78fafdf737a2c1fa35e76e74571bfc73a8ed2
SHA512 44e624480baf8ab0cfdaa7ea7f2f8f31796c6f7e19c6469eb3bc572ff61a3a0f86762326a497c16d21c33cf3ccf4897af576684d6a9bb6c39f3a8ec3eea594bb
SSDEEP 384:dZcIzsNXjMcppuhpSwA9iX5FDAVtgOIwZOyfLloQ:FzFUsEaYVXs0h7
TLSH
T1CB828E33AC786C7B5CE6E145F44736039F789167EBC86F94C5ED672D05EA294030B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e09ad7e4-4a7f-43f8-96af-ae37f485891a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e09ad7e4-4a7f-43f8-96af-ae37f485891a.tmp
Size 8KB
SHA256 45a5bb3924e0033c64ccd8261be04c661097bcc2ebf7a81e8c20e06cf81cb0cf
MD5 26140a39bf7cbaa254cf2fd616006a05
SHA1 3dd83b22949766b44338bb0dfb0e8c3ac4e6de4f
SHA512 c8cbc83aae5a099a7a50c6095e6347ad5d277a9d91ec5ec95401975d3dbc9f19b33f690b85668870f13ade5cb9949c3f3f43c7a16277f6df3c4589e15fde6790
SSDEEP 192:LONa6AmwprQmiUyUw6siX5FXmEPJibcU6:LONa6ipdM6siX5FKQU6
TLSH
T1E302EA35AC686C7F8DF2AE45B18B7B139FA9116BDB942F84CAE8172C01D769C1307432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7480213a0466c58ca49be361db80757a636ea605cfdebbeb8b46cc94bf5ea9c7
MD5 07fbbaf56e59fe81c0616c6258218592
SHA1 c62a01133ddf88cf94262b130203435ff47bbe9c
SHA512 d18220b9ef8ff749ac30111c799f78170e36329a365670d3375d1683b42f907c7b11409c752f5164154e0162ab368e6c9a943cf37421cf9d71d269ae7cac6d2d
TLSH
T1E6411759B6EA1108B3B76F9AABF7A86D487E78772F06D55D10010D4E0A77B40CCA2733
MD5 SHA1 SHA512 TLSH

Submit Download

92ea7152-8745-48db-836a-7c2284b8d8a8.tmp

Path C:\Users\Admin\Downloads\92ea7152-8745-48db-836a-7c2284b8d8a8.tmp
Size 8KB
SHA256 7c29e163205374f77fa09fe5bf9d7b1fa2d1ec6474ee7eda56849beba3c5c209
MD5 da2eb61718e712ac72d75ca91c7a1d39
SHA1 cb7372e95f019fa6931140a342a84bb8d2502bda
SHA512 c9cf40e3bf48e48c1a8903bb829e89b1be98d07cb41897a24a1def691ca0fffff9fa52b49a9c047d1a3ec482a19f4e4aa2ff5cce3f4f804f055b493d74bd288f
SSDEEP 192:st3w0XJw8BK0ZkQGz7Ig1MszUZrjjBqpTg3P2/B1/HnGHeNBVOilEWXZR5NmoQ:0w0XBK1QzwMWUZr/BqBsKB1/HGYVOiC7
TLSH
T11C02970C3A471999E4ED13B55E439797C066B410C737BDF66F82C3961E24A2B303BE66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xgha74ZFIosb.exe

Path C:\Users\Admin\Downloads\xgha74ZFIosb.exe
Size 1.4MB
SHA256 021f53c2328113f02db282d7bde017efcf807b1021173e497c06711a15d7f98f
MD5 8b923746242130bc39f9566cf8ab60dc
SHA1 430ef7824759dc2295eb6cc5591bf2558c71e350
SHA512 981a338cdb8ee7fa15fcec8e10e2abb21af0eb653f15c0cec041144c9bedb9df4af513605c3533b815e981023b0c76eb804f0adc4d63be846baf22b7f69d6c7b
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizfmQDc06WogeOfQr0W:itMzLAVStcdiT7FoR2A0W
TLSH
T11A65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads