hxxps://webportal[.]govoyages[.]com/

Analysis

user interaction
yes
max time kernel
76s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://webportal.govoyages.com/
Sample261020-p26j5azvbx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5428	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{75DC260B-F0BD-41FD-8FB7-BF959EE06E4B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4936	2180	msedge.exe	84
PID 2180 wrote to memory of 2272	2180	msedge.exe	86
PID 2180 wrote to memory of 5428	2180	msedge.exe	87
PID 2180 wrote to memory of 2272	2180	msedge.exe	86
PID 2180 wrote to memory of 2272	2180	msedge.exe	86
PID 2180 wrote to memory of 2336	2180	msedge.exe	88
PID 2180 wrote to memory of 2336	2180	msedge.exe	88
PID 2180 wrote to memory of 3224	2180	msedge.exe	89
PID 2180 wrote to memory of 4060	2180	msedge.exe	90
PID 2180 wrote to memory of 3224	2180	msedge.exe	89
PID 2180 wrote to memory of 3224	2180	msedge.exe	89
PID 2180 wrote to memory of 4060	2180	msedge.exe	90
PID 2180 wrote to memory of 4060	2180	msedge.exe	90
PID 2180 wrote to memory of 2996	2180	msedge.exe	93
PID 2180 wrote to memory of 2996	2180	msedge.exe	93
PID 2180 wrote to memory of 2996	2180	msedge.exe	93
PID 2180 wrote to memory of 4040	2180	msedge.exe	95
PID 2180 wrote to memory of 5388	2180	msedge.exe	94
PID 2180 wrote to memory of 4040	2180	msedge.exe	95
PID 2180 wrote to memory of 5388	2180	msedge.exe	94
PID 2180 wrote to memory of 4272	2180	msedge.exe	99
PID 2180 wrote to memory of 5260	2180	msedge.exe	111
PID 2180 wrote to memory of 5376	2180	msedge.exe	112
PID 2180 wrote to memory of 1332	2180	msedge.exe	113
PID 2180 wrote to memory of 3340	2180	msedge.exe	115
PID 2180 wrote to memory of 3340	2180	msedge.exe	115
PID 2180 wrote to memory of 1736	2180	msedge.exe	116
PID 2180 wrote to memory of 1736	2180	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://webportal.govoyages.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x23c,0x240,0x238,0x25c,0x7ff8e7a0c188,0x7ff8e7a0c194,0x7ff8e7a0c1a0
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6594621980256957177,16663868805690368279,262144 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,17208683006156965105,3620085701419678261,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,17453489556024791931,7814691155479462637,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,167857826908684642,14944461610146019290,2097152 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,9726377456824918472,9202815247132105317,2097152 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4960,i,2290214675921692127,3626289207951920052,2097152 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,15034189663134262445,15234140027391131922,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,2874993576533060690,6966128157617906527,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,8583537069274160367,1961456413832083770,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,8583537069274160367,1961456413832083770,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10784875247975184801,17962873409389285963,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,300283266495192991,9048705724357153499,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,9069922166693503596,10310669597196933318,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8251945493257199654,5358148167760666231,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1102578115770465154,1899218226206793083,524288 --field-trial-handle=2976,i,13501936293359504692,17090769362430212658,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:8
  2⤵
  PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

56b281f4-9e70-40bd-ade7-2190fc49e46c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\56b281f4-9e70-40bd-ade7-2190fc49e46c.tmp
Size 32KB
SHA256 130f23ac583999596fe0b7628badc07b54050d7d0fa813be83bb9bf281b57e53
MD5 4d0f07ccae132477c2f7da5f2348f1b8
SHA1 2dfe92065415d69e122883473795a55243104024
SHA512 6aeb296b12a3fac5f0d5507e3112a55ef18db2337f0cec58416efe0fb9dfda945cfdb9b85111d3e801fb97de371bde550a97c2b585b418ba0bc9324d2451fd12
SSDEEP 384:n3iFzQkUSvbX3sNx8TUNTUlI4e5mg3StK2flBVTPUVY5gFCIgL/7IzgIIll:yFdj3MwgoFnBVTPUC/L7
TLSH
T1F0E2B2F198E799B7D9AE4B87A37D2D4299FCC113B5885A94B7C80C1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

610b440d-19f5-4858-962f-a496946c7135.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\610b440d-19f5-4858-962f-a496946c7135.tmp
Size 25KB
SHA256 251ed3f2827067b7993514ba56765ee52c0679168071373326d2f8d0e6d6c5cc
MD5 226a822d598d818d95d3f411aa0eaf88
SHA1 98666e47f366e50a1eeb41870f87ef4298deff63
SHA512 6dfd48e561f857135bf99b8a9fca94c4b8ef6bd8e7886fcc2af4b5b34e20104c8e7936681e44cd8cd0d1b58066709f8872961dbcd9588c0daa0225d7c0b283b6
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mg5RnK2flBVTPUVDi7O6R2FeoCWgL/7Izgow:qFQ63AwgS+JBVTPyi7TR/N3
TLSH
T19EC23A32EC68C9BBEDFB4F9AA74A7A07EEF00163959C8AC0D5C81D1D009759D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

663c2d7d-94b7-4beb-923a-8cad3621c8f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\663c2d7d-94b7-4beb-923a-8cad3621c8f6.tmp
Size 26KB
SHA256 11716eae52eda663ce89c2810601c616c2b99de22b8ebdcaf33ae1c91220dec4
MD5 c4cecd290249ca3c3abddc625606294b
SHA1 63eeea1f6393bbf695767b4cb874e79807543a9c
SHA512 726b8a737220fd9e0482478b8088615e5631cd0332f2793d2dc999a7182b7c63377e09f7c75a4764544bfede795c687af8853012853c4b17aa77b57d5f89bf17
SSDEEP 384:nciFiZcI63sNN8TUNTUlIm25mgOH+K2flBVTPUVY5EC7O6R2FeoCWgL/7Izgow:HFQ63cwgSpEBVTPKC7TR/N3
TLSH
T12AC24B32E8A4C9BBEDEB4BDAA74A7607DDF44253968C9AC0D5C81D1D009B5ED430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ac9e502-2aeb-420e-8e10-2d8343427773.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9ac9e502-2aeb-420e-8e10-2d8343427773.tmp
Size 26KB
SHA256 06b02b0aca64a70881724fdf7fcd53874d77d6a92f85fb19f784923f74224928
MD5 1907a0789a23207ea41babe1624a4877
SHA1 1f2557a9839d94f44023d404e71229b8a68adef6
SHA512 05a4136e0d742eb71822fc10a75ab729ab0e96f7c6e06ef4a6fc8847c490c8a895040ba9afb4123e5be4e1441d8064d12ba4d172185e40a67db472751cbd94ef
SSDEEP 384:nhiFzQkUSv23sNx8TUNTUlI4e5mg3HtK2flBVTPUVY5Q9CIgL/7IzgIIll:IFd23MwgognBVTPAC/L7
TLSH
T1C0C25B32EC68DABBEDEB4B95A74A3643DEE04217D58C9AD4D9C91C1C00DB1DE530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

394c0721-a7f4-4718-9e4b-41613ede1721.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\394c0721-a7f4-4718-9e4b-41613ede1721.tmp
Size 12KB
SHA256 9332d88b4f9539a4ed3105877910933692c1c1f60b0c195db176fc3fed787126
MD5 1be6ae78df1624d0ae02a59e725c533f
SHA1 77a82e6ccebc0344fcc80ae3e27e05523f97c8ee
SHA512 50d26db6f5c52df89272553804845b5265a4488e9e32b1019b7e0fdb879f68da88a0eb642745191d89a933f2c68789181999a9e0211824a03331d5a7ce350aa0
SSDEEP 192:sxZn+XRfkC/fXs8QZZ+5AzodpK7HW6+WNJCbdYbIM6QY10WIg5EKaJ:sxZsWC/fXs8OZ+NwHbydFGY1VmL
TLSH
T10442D6156E28A97B8CC7D21DBA55BF53E7F95032A0941E48A6FC8A1C05EB6CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4008333d-6d2d-42e1-873f-653b532d4c41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4008333d-6d2d-42e1-873f-653b532d4c41.tmp
Size 414B
SHA256 624937275c0db21753be4d84c66a419d1840d3418b7162378b8f3b675e1baacd
MD5 8da8c77ea27671426dfefc5304a17a42
SHA1 8215f2c0081b4a373735a0faecd37f56fe764ff8
SHA512 ddf80651520fd1e4edc34d01388aec2fc97dda6aac8119b61e1cd72bb6976bf51d44ab8a8d1b7cf9ee6731020dd61cd4a4dfce64e2a1b0832620c0c98311bea2
TLSH
T16AE02BE9C929FC3708FC571C50540645EA41035F2A80858F773C900D8FB5636928687C
MD5 SHA1 SHA512 TLSH

Submit Download

6da573c1-dbd9-437e-868e-8be44cea88dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6da573c1-dbd9-437e-868e-8be44cea88dc.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3621b11ead0dda43bd61016129c1792522298d6ec681233a4fc289b4e0e034e3
MD5 44afe1524c8461c680eea436af02a803
SHA1 7e2ce5634b976087bf3260d4e23deb94e6afc16a
SHA512 f2c2b6c912023dda40beca9d557f5a3bf9eca0bbb5b8c497cbe5142689356f981464dc2a349d7c1b1dd6109e464423809c49529db315d498c48d2f9e0cbdbb8b
TLSH
T1DBE07D8D05EEC62EF708B5C701EC538C87A0365ED3C06D4E1F08C588728A888B7E2690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bb8f42f829c91a8765eedb0dc66c6fbbbc5685e62714e93be8f327e99458bb94
MD5 7e477146c4b17ab9621e021e6ed52258
SHA1 7158f6fff7596b2ed963376e2dbc170bd813495b
SHA512 9704a60ea36234752bcfe78c3f012b15ec609bb87e4f32f3356d72f8e520154ac76b7ea8412567dfe8433cb158f5e98368b9b7e1c496a38755994ed8c26306c1
TLSH
T18061C6818843B427D3982430A3DF72CB393478B0B5E7AD1207ABED768B4E7494D07082
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9b4fab197477f9fd83606df16642a3ab531bb4f66342b880754799478d54e792
MD5 c0a6ee4e4c68b6b4627e40d8b7e941e7
SHA1 53c1c0e58eb3a016cd9127ab052b162bee712eca
SHA512 aa823f20cdbb461b0bacb6ab11a1cf9279c78b1d317deb42057f78472cf88ecad07e4e10620d4d93a9f79e9e55ef893de26d86ab3c9ed27e6dc9961d253727ed
TLSH
T1A07164918483B093DB48283197DF758B393874B172A79E120EF7ED75AB8F7894D06081
MD5 SHA1 SHA512 TLSH

Submit Download

4d3f1d1a-f479-477e-b857-900c84ee4540.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4d3f1d1a-f479-477e-b857-900c84ee4540.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

69e61b7a-ed39-4e80-89fd-e7ca982851d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\69e61b7a-ed39-4e80-89fd-e7ca982851d1.tmp
Size 4KB
SHA256 1e5c821b1fe46743d50634a94fbcaffa6c0a34dc7d4c46a3b9442249608c6f50
MD5 475650dbaf9f6bd545723837f546ae8f
SHA1 bb7a20b9fcada915571606f2a0a05e9516257a42
SHA512 8b11e503854704d1e03f400fea89d19390ca2499f3d75a8b4c3158a26076e63573e54784dfb3335a510ee062a65e800c567e77f5c3ae516ec5979b3c3b685cc1
SSDEEP 96:D1aNOH9H0HJaasz1s9Bd9bVbvbpvMpbhGwQ:D1agH9H0HJaasJs7d9bVbvbpvwbhGT
TLSH
T1C7919CF383E8966EDD0155F06A24BE1ACF5D0A25432C3C2A99D4BF5B83E3C32D14255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf072f2b-4886-4d3b-9312-8800e828f9da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bf072f2b-4886-4d3b-9312-8800e828f9da.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e05fb5bd-8597-42c3-8c61-245f2a23eaf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e05fb5bd-8597-42c3-8c61-245f2a23eaf5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4335afa7932cf04d87c131f57ec50adb07c6b9031216a8eacab379063cdae5df
MD5 7034a45f4734caa287f289706aa1e564
SHA1 aebfd36afd0f4b2863e198d71d8e46ffaeef34c4
SHA512 bd2d6714a4480e94b02f678d3c597955742696050d5bd9545ea4de0bee2ab733097c2b995c2703667c1533e51656006041531bf371240a4bc680cba79b1bb12c
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX47fe:OtfFvpopPxrB4Rhf4Te
TLSH
T168B2341571BA121038FE790C81B5972E064232B33259E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c244520f-97a3-4ca8-bbdf-31ce3fadc25f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c244520f-97a3-4ca8-bbdf-31ce3fadc25f.tmp
Size 12KB
SHA256 78639d787abb1c525565b9cc05d37f19a0efe5e974089eb9f807655489097e0b
MD5 469b6a928d3b1b11dd16ca7dddcc6ae5
SHA1 1963ab213229e51bc41f9bafa63d1192ee517aac
SHA512 9a8f1451424be54ef16228370d2636cfe0bc4f9af9d2d441a0567734c7bdb16afc19d64f27af4dbb31c4b8ea2ea6d3b7a4bf923afa4a2763f790514c730b5837
SSDEEP 192:sxZn+XRfkC/fXs2QZZ+5AzodpK7HW6+WNJXsXYbIa6QY10WIg5EKaJ:sxZsWC/fXs2OZ+NwHbWXFUY1VmL
TLSH
T14142C7156E28A97B8CC7D21DFA55BF53E7F95032A0941E44A6FCCA2C05EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df1512d0-92d6-44e2-89cb-d343cb92e699.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df1512d0-92d6-44e2-89cb-d343cb92e699.tmp
Size 11KB
SHA256 01399456355040ef68aa1cf100b3ec5bac6c7c6cbb8b3c8ef8419bfb1c11136f
MD5 64d588e7c73af173f3ca05262648c025
SHA1 5a9184b8586f7382009d852343a2d5045dd65faa
SHA512 2013886f3cee4e8fbb90cc53b05333d601e6c9d4688bfd71288a55d638c8467f2fa275531cc3219b8f03bb7c775babd41aff991c459ee36a1db3a8e845efcddc
SSDEEP 192:sxZn+XRfkC/fXsXQZZ+5AzodpK7HW6+WNJyM/YbIP6QY10WIgjKaJ:sxZsWC/fXsXOZ+NwHbB/FnY1VjL
TLSH
T1E942D7156E28A97B8CC7D20DFA55BF53E7F95032A0941E44A6FCCA1C05EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8e4528e-ff96-47bf-8437-1f9469139ae9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8e4528e-ff96-47bf-8437-1f9469139ae9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

adbc5116-b476-426a-b3b5-494f20dbbe1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adbc5116-b476-426a-b3b5-494f20dbbe1f.tmp
Size 26KB
SHA256 a079954457fb15ec5534b4ceeacd74b6cc2fcdfb4b59f5f41f676a89d06158d3
MD5 c2f6052e5be037b4c14c2c5b75c5a6da
SHA1 3b257d8e15bef43e3c2586951170ef90daf03b97
SHA512 682e9b77654090380b578f7212ed8da59d3adea8f6981e4054640f2cb878722a694280695f0e351246c7622e7e244250464c8d2f46b3d03d07d1eb510bfbe57d
SSDEEP 384:nTiFzQkUSv23sNx8TUNTUlI4e5mgnHtK2flBVTPUVY5Q9CIgL/7IzgIIll:+Fd23MwgownBVTPAC/L7
TLSH
T1A5C25B32EC68DABBEDEB4B95A74A3643DEE04217D58C9AD4D9C91C1C00DB1DE530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ecf1b1aa21bcfb3905b9872d4e2ff784366b89cc01ae8dd032337a6e48c5d7dd
MD5 6199a09673c8c4e66ef9a37e7928b110
SHA1 49ed94fea6dbe5d99108ad8ba3a12fc2401bb865
SHA512 ee5a08d5f1c11ec7500351915bade9d96b12c059c912a42003810ecf58a8aecdcc420c3facdb48cff45bbea38d09ea115f7f53fa1f8136bc9a24f7ada34c64d3
TLSH
T17F411858B6F91148B3B36E5AAFF7B82E447E78772F0A959D00110E4F0A62A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads