hxxps://onedrive[.]live[.]com/[:]b[:]/g/personal/7FD97B06AB538E49/IQCBgCciJI4FT6-H8x7q5AKRAZYSoYy2HymlGVkyJt6otA8?resid=7FD97B06AB538E49!s222780818e244f05af87f31eeae40291&ithint=file%2cpdf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL2IvYy83ZmQ5N2IwNmFiNTM4ZTQ5L0lRQ0JnQ2NpSkk0RlQ2LUg4eDdxNUFLUkFaWVNvWXkySHltbEdWa3lKdDZvdEE4

Analysis

user interaction
yes
max time kernel
3s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://onedrive.live.com/:b:/g/personal/7FD97B06AB538E49/IQCBgCciJI4FT6-H8x7q5AKRAZYSoYy2HymlGVkyJt6otA8?resid=7FD97B06AB538E49!s222780818e244f05af87f31eeae40291&ithint=file%2cpdf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL2IvYy83ZmQ5N2IwNmFiNTM4ZTQ5L0lRQ0JnQ2NpSkk0RlQ2LUg4eDdxNUFLUkFaWVNvWXkySHltbEdWa3lKdDZvdEE4
Sample261030-saffeacz9s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2164	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 4568	2216	msedge.exe	83
PID 2216 wrote to memory of 2164	2216	msedge.exe	84
PID 2216 wrote to memory of 2908	2216	msedge.exe	85
PID 2216 wrote to memory of 2908	2216	msedge.exe	85
PID 2216 wrote to memory of 2908	2216	msedge.exe	85
PID 2216 wrote to memory of 1356	2216	msedge.exe	86
PID 2216 wrote to memory of 1356	2216	msedge.exe	86
PID 2216 wrote to memory of 3944	2216	msedge.exe	88
PID 2216 wrote to memory of 3944	2216	msedge.exe	88
PID 2216 wrote to memory of 3944	2216	msedge.exe	88
PID 2216 wrote to memory of 3064	2216	msedge.exe	89
PID 2216 wrote to memory of 3064	2216	msedge.exe	89
PID 2216 wrote to memory of 3064	2216	msedge.exe	89
PID 2216 wrote to memory of 2200	2216	msedge.exe	90
PID 2216 wrote to memory of 2200	2216	msedge.exe	90
PID 2216 wrote to memory of 2200	2216	msedge.exe	90
PID 2216 wrote to memory of 3380	2216	msedge.exe	91
PID 2216 wrote to memory of 3380	2216	msedge.exe	91
PID 2216 wrote to memory of 3380	2216	msedge.exe	91
PID 2216 wrote to memory of 1588	2216	msedge.exe	95
PID 2216 wrote to memory of 1588	2216	msedge.exe	95
PID 2216 wrote to memory of 844	2216	msedge.exe	96
PID 2216 wrote to memory of 844	2216	msedge.exe	96

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onedrive.live.com/:b:/g/personal/7FD97B06AB538E49/IQCBgCciJI4FT6-H8x7q5AKRAZYSoYy2HymlGVkyJt6otA8?resid=7FD97B06AB538E49!s222780818e244f05af87f31eeae40291&ithint=file%2cpdf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL2IvYy83ZmQ5N2IwNmFiNTM4ZTQ5L0lRQ0JnQ2NpSkk0RlQ2LUg4eDdxNUFLUkFaWVNvWXkySHltbEdWa3lKdDZvdEE4
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff8597c188,0x7fff8597c194,0x7fff8597c1a0
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,17696945938039408002,3943226000524793856,524288 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2746128717272800861,5722138016444503648,262144 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,2402903311608616677,13572957351007097428,524288 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,9699769890232799760,5036883081078285047,2097152 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,14813600962149370303,10155719190684459418,2097152 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,16782056440031384197,7020748808004701263,2097152 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,16796686718530204617,16734902408772841963,2097152 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,14474471110080253668,5423930841203992719,524288 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14258149347336310214,15074842336204198262,524288 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,11724749090397640827,8048536946004231841,524288 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,11724749090397640827,8048536946004231841,524288 --field-trial-handle=2264,i,3094180340918774375,6940986382907439406,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1b8820d8-0fa7-4013-9896-709c86c48129.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1b8820d8-0fa7-4013-9896-709c86c48129.tmp
Size 8KB
SHA256 dd2ee6145064e405bd91e4f06ae49f5c0e45b2783da9107eaac06bb49053d2d9
MD5 02984aa74808817a9e7ffcd2907816c5
SHA1 db37e4162566c43fb697485681631d44512aa71c
SHA512 b41c99021021651d6ba1d62fe89137a7f6d948e346ad1a93c45ea764bca3aeed61a6e9765dbc997e6672fb5a44347647ea6a85fc640800ad4e6b72809f3b4f64
SSDEEP 96:PqONkjQsjpfwDISp5ih/cIPURHl8h4otop5AmD/BfPGxvw45RxmJm78lFLxT+XkS:SONj6iDCQmiUyTJHq5u88PIUSqSwHiU6
TLSH
T10A0209396C783CBBAEE3AD05B5473B175FA5112FE6952B84C9E8062C01E729C1307523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44d7c15a-7dbb-4a67-a1af-977b99f968f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44d7c15a-7dbb-4a67-a1af-977b99f968f6.tmp
Size 8KB
SHA256 6d0e0e8a459bad730319e60308e1949c7eaa0a9df6599ec0264a617a6af683af
MD5 bac6bb4508aa64e7ff56ea259c22ae07
SHA1 6ff0555e7a5d20fa2915c7e35184ee112be58885
SHA512 91e1804a313925af60bce154e010686eeaef80c78e1770624f94c1ae18451774184986deb72690a4c55a36b5f3cfc7f98765a063ca7f351f9e1a7c1dd68dde11
SSDEEP 192:9ONi6iDuQmiUymcEJuq5u88PI2mKWJBuZSPqhxU6:9ONi6HbcKuq5u8iI23c4SUU6
TLSH
T10A122B3668787C2B6DA39851B58736179EA9422FEB897FC0C5DC162C01FF29C2307613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

881a4e2f-1b20-44fd-9ecb-8b144aabfad2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\881a4e2f-1b20-44fd-9ecb-8b144aabfad2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 44KB
SHA256 d8d2f31bc30d605bef3663367fa75384ab59309b11a5cedebe04fc4d2f15ef8e
MD5 dac9e4f53a7950952b862db983b4bb5e
SHA1 3277a4f930317ce4e98528ad3088b28210bddaed
SHA512 ad09ebde6ae80f1d83c44237bacd36ef19d89cf7960ff3fd6699f27c4bc1a571ad280bd7947e1267ec185af7f784021b428e2e137b8d0caeb2ddc97fdb7918b8
SSDEEP 768:x1v+ifBtCOQpEK77BE32JhHsx6yO+iXraTrcNNLHaz2WhPeJz1LwOXcCLH5carVc:z5fC5pEqBE32vHs31Tbz2V10OXcG5cyc
TLSH
T1A31301F952745E2B8484D325EE3AFBCE92571523810C2C35B1BAE8B0A7F640768ACC5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 49KB
SHA256 4f7ce4d67c42b9656745f9b0e0f72fe8eb83e525fb2929c577c77b109badbd7e
MD5 c54476fde6deb62e7b7e6abde160faa2
SHA1 0e3c39d8c53504e4c4c51e4a65de55263ee735bd
SHA512 40e6f7c41a265c5d8e272e08ff47c2580751111b682fb02f8c80ecc37452ea6eb674e39bf6e612e231cd79487cbbb2dc926b5286903f1d2bb24b8ad0e02c116b
SSDEEP 1536:qlnmT5ER66pLF4bEaWMLldUOtVrL4sCXCYv8:enX66NSbBPLldUO3rL4swCYU
TLSH
T18F33F19DC3E40CB6B67B1D7F9E89FC570D8B00318B86C7DE0F5407D969297A265D0889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 20KB
SHA256 2afd9fd93664d3fa7228f3b8e0cfeaad19a308482ca431ca3f59a0c07b8e2fc9
MD5 8235dc94b38e00256e8049ce624c08cd
SHA1 ae5e1c29864fd1632e8d2d6a91029f6ec010868d
SHA512 25bd35340ab4e9746773ef1fe11013bad9dcc420a4bf287ccd409f624e57d37a4be43d3ca1168e83f486d3965b4791ad4b010312f6c70a42af30ae78c4c45566
SSDEEP 384:NWMDaJ0qtvOS6FOnuCJc9xvPQ+QZT+00aP8iaii2XgvIbT:xDaiQvIF0wxcK0n1u2wvu
TLSH
T1F492E1221D9CDC4AB30D816FE47394F339E2F6560F4DCB6A2468425EB1E0F53A7914CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 1.6MB
SHA256 21d05dc4c7ddc1991a921cc13b5badd0ca619252fc54d250fe1b95bd5c9f9f47
MD5 e48c82d798fde3c0ef8e9907c7ea4e30
SHA1 10e406c645faa6191721ee9397f68ef3c9954636
SHA512 2204d579f8f2a021a91b3da7ea07c4819e330c0f10435f6d8d45eef90c593cd01091aa57abb4b305abe41fd20091afc37a5f74ab96a31f45e28fa98c085fc070
SSDEEP 24576:X5avUtmLhvA+gncPCzGBK25EEzJRJeC2lpvDyAU2Qx63D1v/:XQvUtmVvrfKG5EELJV2lxZU2C6Zv/
TLSH
T1827533841502C329741DBF20FC854E6B2A096D2EE4A9A3DEB5A3B076D6720CF434DDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 59KB
SHA256 8ae1157b34912f3cde67e84b8efe1218b778bc2e5d6950015cd18dfd250e6a43
MD5 626824f784958916aa2901ce5e97ae04
SHA1 3521fb99307428b687e4958911c2d0537c375cd3
SHA512 0d8ae4b222a96407838b4d3a1045a035021f9812925fbbc2ea52aae072a2fecf6aed5a296bbbe59a3ea956780f4e002d89869784d2295d84ab4ce0aebcdd2a17
SSDEEP 1536:qIanR0ZwkQmq1zQXfLLrza6k+jfqYRvj4:qIanREwv1z0L/k+jyYRvk
TLSH
T11453021CB1B80D544D97DD1A986611C97EB9DD3F5320A81A5CF884C9FEE28E8F3022DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 47KB
SHA256 e3d23b432fa1403a3a98f3fb939656eae3c7a454c1935c6cc079d4d031281865
MD5 8ef3904205f4813d43204ba9ee72d905
SHA1 2046995464802582556c5220afa95c82c869c96e
SHA512 5014f3a06e1c46d7bbd1c93f464aa459acbb03f3f556b70d9b2bd209162bef18cd38796064eeb09a21b031f99240e6e46f98a3760e2695bee6216ceb6b588625
SSDEEP 768:XpvtPV9lxA5S1PVlD7v6li5rJelWw5X/r2a7VIlFjO2kVdIhdWSXY9jG03:XZtPV97C+PVF5wZZ7YkPhF9t
TLSH
T1AA23F1844DA57A0B92E26A906CF4E2633FED7F7351E06585E07CC227217CBB9599CF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 27KB
SHA256 643419859585cbbc302e462c447060343aa9eed4563b58fc55a13fb861c74004
MD5 0afe662f7e8ad9db29706b20713ea9c1
SHA1 64553fcdeef9b36f2e9d1faca7c1674f936b85a2
SHA512 7e017d040455b3b33631f5550364af2b0b173b74bf9791f4e4c726bbdbaae4ae3100e751c31c01193c37ff97eb997a2066c669dfacbafccdb3e8f8e54ddf43ed
SSDEEP 768:zXoQgAKTlxd/SSiv6opsty7Fa6++b6OcoXG+9Y/h6hjN5R:FQQ6w57c6pccG+ih6hJ3
TLSH
T1D8C2E1CC6CE76338D1D817FDD00EC8CAAD43B11E6C6CE9195819968AB9D0FC4201AFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 16KB
SHA256 1f7216458568f394c796e011cb5da2285c6d9c919e3d7c224cfd09df6197ac50
MD5 c67215019b9fd89b9e29a16916be5264
SHA1 d4448c620ffa5574ed0fccbdb1ad2bee466f136d
SHA512 2d111fdde602ccab07090b296b485cfe3790bde13c92a62f5c506ec1d4637b8b53e7a46f15506eb4487d9cafbf15f066caee883292b3e24c7cb5498e05b1c712
SSDEEP 384:AjVuYVspQW7Zrs1N11tKuETb+Gh306Xd55Q:ApumUQW7ZYFobv3Xd55Q
TLSH
T1CD72E1502E091450C21F11BF1DF1D2DA3C1BE5036BBED068AFE4B93A4C4E325DAAE55C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b8671b2-a862-452b-8851-11a58bf809eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0b8671b2-a862-452b-8851-11a58bf809eb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_onedrive.live.com_0.indexeddb.leveldb\000003.log
Size 225KB
SHA256 6b1182d29ff4d01a2ef01ecd14045adf48163ea6c1847912729ffb90822cb103
MD5 e9bb546ddf039356a6ff146f407423dc
SHA1 0066ded084d237e492298641ea426d456d5fb2d9
SHA512 7e89d3cab541e1b2c60ce08b32469ecf7e78cff92ca3604885c4e21937ae7580aeb25a5af6347f302401555d2b14f5872dd036f11c75bbfb8ddad444dd21f7c5
SSDEEP 3072:V9ajp26+5p0qbktjYtVq8nJLMllimoqbkB0+/cLjPE9Ymm8cTkQgSMQ6ZfDEUChU:1qIJEPE9FmxTsIUChl4lSihuy
TLSH
T17B34035EDCC71916C0377D314F6F25C7AE9A6E497DC348CDA8E1B92A8034AD2CBA0C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_onedrive.live.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_onedrive.live.com_0.indexeddb.leveldb\LOG
Size 355B
SHA256 e1a76b1c15a1d53ab30dccaaec5323a3af3448298cc0b5834ce4083f31127b0b
MD5 3c714581fe166d859e6d96e59538c906
SHA1 03acf395956d2bc9ab38e6d8ceef629cfcc3976f
SHA512 9cd19814a33e9ac5c637d4a0837d7381fb42cec565aa2da0065ff6942abd27cd5c24935329f966fe0f31bd4b11ac0a9e963a983cc5e8b21b4bbe617907783833
TLSH
T1CCE0D83DC9C9C61F92185496053DBB0ED7A3551FDAC46D892F04ED54F4CA0C8B07E1D1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_onedrive.live.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

be46dc55-7653-4fe5-8445-7fd4d73be8a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\be46dc55-7653-4fe5-8445-7fd4d73be8a4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\index.txt
Size 232B
SHA256 6fa4ba2ab80af65aee767f903b75201a97e7999688aa224778e5ad276c6dd281
MD5 77ddda14c24237b2d64c177aa431907b
SHA1 900ad65915807ce5ef31d8bcb6450ff49a59111f
SHA512 eae3e744f1d0abb171d58b6e62d0be392475a86e200818a43ea106279fb3a7613079c731b62eaa688680a2bcb9f0124c566daa88545c6611030775c3167a4644
TLSH
T159D0A53E1C100994BD79C741419D715B745F5D973C4DDC4855C012619C71761E43CD1B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\index.txt.tmp
Size 381B
SHA256 46d575ddbbd354849bc1dca21d1a6ad643a852b9599e82cb770e6f5007655486
MD5 8080f0e37c5bfafe204c46aa03a27d02
SHA1 f74be7af6c814071ee6a07b762b351f9d23ec56d
SHA512 69ba078cad80de5ff9041dd0df238e791f18270a09e70119aa7ada8754eb9923600462413c275cbbef1eceb4e5f4b449e10c391e5b4d250e183693d003371926
TLSH
T147E02B3D19204A59B9BAC78201DC70AB366E9D937C498C4498806252DC26362E439F1F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 616b54b7d17b6a9bb8bd95a72fbe57eabf0843b8199a40e9b5b8dd54add1ef4d
MD5 1f64cf96c992e1e63a16a73345b739b2
SHA1 fba283390c15552b48a4cf7f56c2614eb17234c9
SHA512 dc3b7e7029036ea58403c25bba2529f7682fdacf2eb24d17c46a31f1ea05c16b80807dbba6f5d52b3d9c696374ec1c38c60b3837c584e2b7eb3c5d233e1ea6e9
TLSH
T145410768B6F91158F3B77E56ABF7A86D487EB9732E06D46D00010D4E4A22B44C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads