01cfb794d1dea0952e731cec4b385453a849673aa3386ae65b351c4a7cffb7fb

Analysis

user interaction
yes
max time kernel
50s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
enc_U2FsdGVkX1-95nde3fA4M_gFLMLiduC-df9SO9SmTojsnKBJ4imR7GmpMM21mToFHGBNu8Dpafc8uuFndpRPVKP3yGxoM1w3.html
Size 696B
Sample261014-pg9faavtht
SHA256 01cfb794d1dea0952e731cec4b385453a849673aa3386ae65b351c4a7cffb7fb
MD5 5c1bb87bac5c27b5f50d457d65294359
SHA1 5ffd778008808988ad4bb7f2197a9d9faeb45d7e
SHA512 496bff4d756461182538be6349344a0df660c505ce8174004c34d9abf7b68ea2840442a469bef45a1871b33e1dd7cae69e947ae2e88cb00048c37f657f368d12
TLSH
T1F6019E158493A90372E081C628C9F7A15873B29ABA04DFCC72C71164FD846E721D28CF
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery phishing

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 3 IoCs

phishing

Phishing

T1566

flow	ioc
36	forms.zohopublic.com
37	forms.zohopublic.com
39	forms.zohopublic.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2568	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{B4C5F8F2-26B5-42AF-983F-783908B71BDF}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4968	1180	msedge.exe	85
PID 1180 wrote to memory of 4772	1180	msedge.exe	87
PID 1180 wrote to memory of 2568	1180	msedge.exe	86
PID 1180 wrote to memory of 4772	1180	msedge.exe	87
PID 1180 wrote to memory of 4772	1180	msedge.exe	87
PID 1180 wrote to memory of 4960	1180	msedge.exe	88
PID 1180 wrote to memory of 4960	1180	msedge.exe	88
PID 1180 wrote to memory of 4324	1180	msedge.exe	90
PID 1180 wrote to memory of 4324	1180	msedge.exe	90
PID 1180 wrote to memory of 4324	1180	msedge.exe	90
PID 1180 wrote to memory of 2168	1180	msedge.exe	91
PID 1180 wrote to memory of 2168	1180	msedge.exe	91
PID 1180 wrote to memory of 2168	1180	msedge.exe	91
PID 1180 wrote to memory of 2444	1180	msedge.exe	92
PID 1180 wrote to memory of 4592	1180	msedge.exe	93
PID 1180 wrote to memory of 2444	1180	msedge.exe	92
PID 1180 wrote to memory of 2444	1180	msedge.exe	92
PID 1180 wrote to memory of 4592	1180	msedge.exe	93
PID 1180 wrote to memory of 4592	1180	msedge.exe	93
PID 1180 wrote to memory of 4740	1180	msedge.exe	94
PID 1180 wrote to memory of 4740	1180	msedge.exe	94
PID 1180 wrote to memory of 4740	1180	msedge.exe	94
PID 1180 wrote to memory of 1048	1180	msedge.exe	98
PID 1180 wrote to memory of 1048	1180	msedge.exe	98
PID 1180 wrote to memory of 1048	1180	msedge.exe	98
PID 1180 wrote to memory of 3112	1180	msedge.exe	99
PID 1180 wrote to memory of 3112	1180	msedge.exe	99
PID 1180 wrote to memory of 3112	1180	msedge.exe	99
PID 1180 wrote to memory of 4196	1180	msedge.exe	100
PID 1180 wrote to memory of 4196	1180	msedge.exe	100
PID 1180 wrote to memory of 4196	1180	msedge.exe	100
PID 1180 wrote to memory of 2236	1180	msedge.exe	101
PID 1180 wrote to memory of 4376	1180	msedge.exe	102
PID 1180 wrote to memory of 2236	1180	msedge.exe	101
PID 1180 wrote to memory of 4376	1180	msedge.exe	102
PID 1180 wrote to memory of 892	1180	msedge.exe	107
PID 1180 wrote to memory of 6064	1180	msedge.exe	121
PID 1180 wrote to memory of 6072	1180	msedge.exe	122
PID 1180 wrote to memory of 6080	1180	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\enc_U2FsdGVkX1-95nde3fA4M_gFLMLiduC-df9SO9SmTojsnKBJ4imR7GmpMM21mToFHGBNu8Dpafc8uuFndpRPVKP3yGxoM1w3.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa42b6c188,0x7ffa42b6c194,0x7ffa42b6c1a0
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,958260127795169745,7235210826729947901,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10597983864088727633,7573567895978827546,262144 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,8733380329849691308,15021333162282554970,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8646491845978594786,14527760295435244980,2097152 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,11339223866122446184,10708809059314523349,2097152 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=1664,i,16218702460489249163,12495769795337632620,2097152 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,15775275830100390216,2629706506613599375,2097152 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,5127789466486848010,13165383906218337443,2097152 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4400,i,5547935134253634403,15070658337589245749,2097152 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3652,i,13876053291286868001,10158633361632074043,2097152 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5400,i,1132377036257953784,204081193115972473,2097152 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,2781976799188928298,6003615116336226033,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,4597416616793568931,11463994059976661075,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,4480090106303800162,9631322156949529473,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,4480090106303800162,9631322156949529473,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,9245526275301317103,4844543483214406614,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,13148664392967896965,16319702927697271524,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,17852686837054066864,5830551651509342654,524288 --field-trial-handle=2188,i,3472627025878725399,2371018323515147313,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11fbdf5b-7fec-465e-adfe-d47d1c9a9712.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11fbdf5b-7fec-465e-adfe-d47d1c9a9712.tmp
Size 8KB
SHA256 eded839116e62f8498b8daef469d0e6160ac645c1478bd1e0a0fb74667d7c163
MD5 8638d65ee1b6cfd4a6f97f80ef10ab08
SHA1 d983fbdb86e18d3fe1273c68fc7fe8736cf2435d
SHA512 58caf9bf11b391a191ea13e9b812470e8207ceb831fff629a0c9e7402045b5e36a76ecd2948d548b9e8268b2f55372b66edca7cb5efd5e69bbc406033904952c
SSDEEP 96:KqONkNQsjpfbUmjH5ih/cIPURHl8h4otop5MaDiBKP4v+Y1xf//ojdMxMY+XhBjt:BONl6JUm0QmiUytiso//ihBjU5BC+GU6
TLSH
T11802D635AC68ACBB8EA39E45F48777239FA4107B9A911F84DAD82E2C01D715C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

161b3ebc-1f3a-49ac-96b1-583b9d17d87c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\161b3ebc-1f3a-49ac-96b1-583b9d17d87c.tmp
Size 18KB
SHA256 aa8363b14b3e8cf588ea7ed0d889ebcb85360157fd8d67c9d193bd7f4c6e5a50
MD5 f0561d30bece5a7dea4c1e0a283f304e
SHA1 845f2fe65b48a4af2067b210db82fcff648fc8da
SHA512 a9db41322f675baca6b34b377022b0eaf1aaf9e3029394c051d52bf49393966e68f892090c47d3e160690fede0e8b69d04c71877c785d374a7628074b737be72
SSDEEP 384:sQkUSv/sN5asxbMeOl0h//iDkEYoXKPJAxJpChHgIIlb:s/H4/aDp/KPkJpChgLB
TLSH
T18A828D72B864BD774EA39601F14736039EB0917BEBC51F58D6D8AB2C02DA2DC230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d06d377-236b-46dc-81aa-8d9f6440e769.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d06d377-236b-46dc-81aa-8d9f6440e769.tmp
Size 18KB
SHA256 a8d562f063cf7a0cd65935c3581c1df8bbe7f65681907ed255f9c7c52096f19e
MD5 5542fcc8a88c9d99b8c443a8a432badf
SHA1 f00fbcc8dac07cceeaa742eed5719af706a6a42b
SHA512 cad581315f6c36ce5bebb04105028985989c5d4a25b7fa44316efaac1c21bf60612d1787b2239d0d8d2e8e2215282120942b9b2fe7c52ec081e1f73d351434bf
SSDEEP 384:ZQkUSv0sN5lsxbMNOl0h//iDkEYoXKPJAxJpChHgIIlb:70D4/aDp/KPkJpChgLB
TLSH
T1C1828C72B864BD774EA39601F14736039EB0916BEBC51F58CAD8BB1C02DA2DC230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

391f0822-7952-4314-be5b-415963afbb95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\391f0822-7952-4314-be5b-415963afbb95.tmp
Size 8KB
SHA256 f6128102602665736cbace35862dce99a48ffa4aa683a11b05ac125f1a27e4be
MD5 165a7da81d6b1bc0a1e22a60e9873734
SHA1 82374cb8025720e338dc2d252ce6f1090b1e6442
SHA512 e061a22a54b20ed8d5243d3745762b1d519fe9f7aa7eae81628cc7a5805537adf76361af2fc265206fafd61e5fee727902c68e2443e2891a45b621d423dfc8e3
SSDEEP 192:yONk6JUMQmiUyI6iUo//ihBjkGnPwosDCNxfq5U6:yONk6+cDTUo//iDkEYo7KU6
TLSH
T11C121836B868AC7B5D93A591F08336139E744167EF856F94D9DC2A1C02EE1AC530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

0d64e076-88c1-4993-a3ae-f9aac7637d53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d64e076-88c1-4993-a3ae-f9aac7637d53.tmp
Size 9KB
SHA256 d9a4dee7bc80c99bb704d89fb6aba16eaa551a94351d01d82874f5d6d61f1366
MD5 4129dfdb7fdd65849c50344f027ba49a
SHA1 d9955ac3ec4ccaae4a08e8a4968cef6af29c8aad
SHA512 a4dfe6446df73eaa28d418587f82864f1a2b475a678bc5f1b024d0cafd02c711441d19679b09465d72c5bf8df1ad3c7bc14c5751f60845cef4086dd59d01c18b
SSDEEP 192:sxZbRDWC/f3swZIdpddiHW6+WNGY36WG8sIgrJ:sxZbIC/f3swyiHbGXj9
TLSH
T17A22B852AE38697B8CC7D219BA55BF13D6FA113261D51E48F6FCC61C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c51246b-fdf6-40a7-882d-953777f83922.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c51246b-fdf6-40a7-882d-953777f83922.tmp
Size 27KB
SHA256 f9cd0d4323946c1902f0c30a98582dcfc46d6ba7b892036c22251e7ffce5cad1
MD5 6e5eb8b26173ec5b2f46d3c98d5622f3
SHA1 efebb6ae5612c61fc8e040d962134277e57ebe78
SHA512 d4dfe930260e6e5d94642015078361ae2ca1e30679f119ed957edc0c7ea92f9601201d0f8b34fbfdf8f5210f59cf2ac086d8268bc880cabd04fee0be167c6c3c
SSDEEP 768:guKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/broVx:guKlm7QWvUYe0u1ja8/L/E/oVx
TLSH
T10FC2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4daf4770-46fc-4f59-8b36-12aac917a7ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4daf4770-46fc-4f59-8b36-12aac917a7ef.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78671090-bfe6-4a42-8cef-efac8ac62491.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\78671090-bfe6-4a42-8cef-efac8ac62491.tmp
Size 10KB
SHA256 c72506919d4cab0c4c267ea277aa3af455e7c82a6971dd01d87e606833ea1231
MD5 328e19ad9a303282999a2eb814c95e99
SHA1 775c2d295ac3e0b956b87ce0ea352164e1160dfa
SHA512 d3bc891151a13c6f4da58d0a4ce2e1ca58a204cfab97a0a1739247a52b016ce0b419256c48553eb357eca64e60bf94f09e34bf9c66de0e68d8e08567d19c1167
SSDEEP 192:sxZbRDWC/f3sDZIdpddiHW6+WNKnv/Y36pc8sIg5Xf3J:sxZbIC/f3sDyiHb+/Xan
TLSH
T19622C952AD386A7B8CC7D209BA55BF53E2FA513261D50E48B6FCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

905ecf93-947d-46c0-ac05-3828ddc4853e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\905ecf93-947d-46c0-ac05-3828ddc4853e.tmp
Size 10KB
SHA256 4bfbbec9a6828b0a21c19d90d6227dd3779d2b9ddf5aa77ee83a0e49c88fde71
MD5 f8c7b85f11de5ed22761347b9db96191
SHA1 9f3aba2246fd49e3392e866d45794946e7df2404
SHA512 d97336ba08daa0fe8c8cbec21d1d3a7f72e1a6aed89e66945181cf47888d40248c831f9c74ee7a96b95963ec50dd596f5ab9bd0bc570e34c8c9f0ed3b2b13aac
SSDEEP 192:sxZbRDWC/f3sSZIdpddiHW6+WNGY36WG8sIg5XRJ:sxZbIC/f3sSyiHbGXjt
TLSH
T17E22C752AE38697B8CC7D219BA55BF13D6FA1132A1D51E48B6FCC61C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 28KB
SHA256 4401836cb4ac0af0aa482e5823ca6eaadc1d5c8bbd8844049291ca3319b989a2
MD5 c3db89deef9289a33b1cbf7fc43feab8
SHA1 1a5dfb855c91dce1b39fadef6334eb89b310d377
SHA512 d216e21a3fe24c340d92be4f68fd27f267c554dc3e767dd041a8a27611430ab9f8c02a17918634286c4a9dbaee459282c7c1409ff882066829c5ed94887b88e9
SSDEEP 768:q8SKzgyGdB0vRaVq1meplFKHgo557obneczSjYPlcCyt:JSiWB0vAVqAvgo59obnepsPlOt
TLSH
T123D2E12947B24FFFA2971CF5E503724CC1582722EEECA9A56BE0F0113D8628D7D924A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 66KB
SHA256 88fb8716f31c692236134ab4c45c585b24b484af4e77d3d31b09aaeaa8ea3454
MD5 bf45ef6dfa3207cceb1dc8151bf13978
SHA1 136221d379bac55ff84d24a6c1bd0b95a5e73bbb
SHA512 8c293c2e3c35560583036fe5e18606a466da511c276cce0e33860a532bd9ba16a247098cf242d7e47d8ae3fc548e1a1935c85cb425b3e5fb523bfb426b77cb66
SSDEEP 1536:UbF/+SGq+vTFqGjdf+gOcuGalj44grQcBqhSbP+og:UB+Z5qfgOBt44cQcEhyWog
TLSH
T1C663120D3B58008669FC03E233E57D2951E2D3E6DAFD47A95DB0BD2078CB60E8736968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 62KB
SHA256 f9c4b28fb4f421bd11bd6e28536a643fef3f5186f7335548ca098c05f3fcc924
MD5 0f602ab44eba4aa06c2af282ac186dda
SHA1 ade7558c632f42571f6f1d9134717f281b9cf54d
SHA512 cd58d69eee83e84ee43c0fca07663135f64aad79fa0eb3208059582e17b03fa285de8114e23cb2dabfb57529e7bb82070a57395fc51e4bd3d91a4742bbe7795a
SSDEEP 1536:ZuOndsUUw8ZML3IUEdBBaoUE/CKN4dKpPbOJ8TRQKyL:AOndsmGu034TKN44g8mBL
TLSH
T1B75302AAC0E4031EB3BE94195B1B7A091D37FCF006892A7BB5F4B0B5605C14229EF56B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 100KB
SHA256 35d0a2d4109dc195673816319a1d743b0c61161fe8d2ac33e029ef477e9a548c
MD5 67635fe438b02bde77fea24b8cfb486e
SHA1 831fda32bfe7782e92f075c6220afec24fd2f918
SHA512 a3330d4f8116d03170b5ae41882b148a65109d8047d3fd7c47f3a83293c1759117338405ecdc127c5fe8118a6a82a4b5a6f112a408ba526bc0bedbf1a8545d8d
SSDEEP 3072:QcwX8u8ss3jMBg6dMBbWqB8KSGYt+UKGrW:QRMu86BPs3B8KBbU5W
TLSH
T1E4A312A3E3C3087645639171B437EA0DBEC7925275B3B28A25CECF4258E0E38D6C7265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 52a19b81ebe669affbfa3de205ebb418157e5d0638da1a6c56410e527c83b556
MD5 ea2499813d9645cd9dcac6a754728bec
SHA1 948c7af6dd6b8ba3932e87d35aff600da1f74568
SHA512 ff6cac91bd7b1873129c33273123260048579f4d232c8ba21f791040f1a4f58ec35cbd070d12111eb21f103a626e067c30e462cf6049052935e7e4822b696bb0
SSDEEP 48:i1JCTGTMuxLbfokKGvy/JoCB7SnNiFxiAmxp4E/ZW3xvz0T+SxZPjskVNpXBhzsg:/GUkKZ/GCBEWEcxvz+bjskvpRlsg
TLSH
T1FE9131C249C248F0FB95D6B7A3F65EA7F620C9C6AD8B3F5B0454F8B6C407BD480A0149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eccd1f67dd2471fa1bd8c104901c63ce646ccd1bedfbe9fcefc12ae6bfe81984
MD5 ac7a54ab6dbc6086e998a58e808d8376
SHA1 db4b58aa2405e1cdbcb091512f96fc2f1b3ab711
SHA512 b0b988b0467953f7be0a472ebc94265164fb993f701b9dafa2c3c893e43721ed2d4add1281550964988a09090f149a7f2e0580acfb12d635105a301815e80437
TLSH
T1E95177C741524C60F796C3B7A7F689E7BA34CAC71D9F2E520484ECFA894AFD4C18014A
MD5 SHA1 SHA512 TLSH

Submit Download

ea889e4b-168c-4e78-815e-1610025ba4cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ea889e4b-168c-4e78-815e-1610025ba4cb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

38d4ff30-715a-4e2b-a1ac-c1ae07e2b5ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\38d4ff30-715a-4e2b-a1ac-c1ae07e2b5ae.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9903888f-6791-4097-a181-78e532ced583.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9903888f-6791-4097-a181-78e532ced583.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 cf15e9ea63e257d9d93e7964e560e5941288394a9895b9bdb2bce578ef21eab8
MD5 bf3db2ec3fee18f3af32c48626c1e25f
SHA1 b813fb1b413204369285073e0e02aad3485d8376
SHA512 8220dc0ae92c89f896f09b33a40c1c65aa3c0b63f10f02c23eb51deec138ba1af038272725fdf2a01e5dc81fd48dee4e07864ea93283e05e5cb40355a0f7427a
TLSH
T13B111FC2D2D440499FC9B751811ED403D4B1BE7F534D1CB5222DC2F28F8C8100A6E9A6
MD5 SHA1 SHA512 TLSH

Submit Download

97227509-775b-491b-a3d4-4b669eebbdef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\97227509-775b-491b-a3d4-4b669eebbdef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c5b5539be7a83a5c3467b809285934e3a39c67dbfc5058a37d93c0331e4de7a3
MD5 8b7a3782ddbeaa4bc7a6bad979594b3a
SHA1 243abc583eaef57587d8acdeceac4b614e6478b0
SHA512 211b4d10f44216d3bab81cd3b9df2a7d1d88c777cc3bdf4a9e44fae4c6828680cd5b58eb9470d9e417f6bd23eba1a5ef6a3c5798e118c77b560ec82495580bff
TLSH
T132413F68BAE91108B3B76F569BF6B86D487BBD772E0AC55D10110D4F0A23B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads