URL:	https://wezgol.click/css/webmail.aruba.it/user/login/retrieve.pendingMsg/mailbox/aruba.client.user_id/customer.sign_mailaccess/db/index03.htm
Full analysis:	https://app.any.run/tasks/f515e002-9c72-405e-83b9-63f2c4fb24bb
Verdict:	Malicious activity
Analysis date:	July 08, 2025, 06:02:31
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	phishing
Indicators:
MD5:	58633E067C50493A89B818B4E45F3E38
SHA1:	4C967207715BA103D10EF452D91B86486DA023D2
SHA256:	18410B5217EAB900290FA354FF234369D78744F7EFBCDD6D82FE61929ED83F2C
SSDEEP:	3:N8RqSLGtlHSJiQCQLW6FRXwyo7JHK5iadlAPIChBqa4aDIn:2crSJeQdg7Nq51ahXqaPDIn


(PID) Process:	(6240) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(6240) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(6240) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(6240) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(6240) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:	write	Name:	S-1-5-21-1693682860-607145093-2874071422-1001
Value: 1CFDB7FDFA972F00
(PID) Process:	(6240) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262912
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {F1E6E086-1C13-483D-8D27-4A9F9BC7703E}
(PID) Process:	(6240) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262912
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {356A3E6A-A53C-4078-B293-6A70075130DE}
(PID) Process:	(6240) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262912
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {4326570B-071D-4F8C-BB77-C918C8B862C9}
(PID) Process:	(6240) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262912
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {C73DF070-9EEF-4388-8FF9-84AF03C81EE1}
(PID) Process:	(6240) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:	write	Name:	S-1-5-21-1693682860-607145093-2874071422-1001
Value: 8849F3FDFA972F00

PID	Process	Filename		Type
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF175880.TMP		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF175890.TMP		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF17589f.TMP		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1758ce.TMP		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF17589f.TMP		—
		MD5:—	SHA256:—
6240	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6796	msedge.exe	GET	200	150.171.27.11:80	http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:Q_gKLDooZtpycStoogEjo-4qL-wwq7-GMCrTomvA63M&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
8028	SIHClient.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
2668	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
8028	SIHClient.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
5328	SearchApp.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
3936	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
6796	msedge.exe	150.171.27.11:80	edge.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6796	msedge.exe	13.107.42.16:443	config.edge.skype.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6796	msedge.exe	150.171.27.11:443	edge.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6796	msedge.exe	92.123.104.45:443	copilot.microsoft.com	Akamai International B.V.	DE	whitelisted
6796	msedge.exe	172.93.121.27:443	wezgol.click	HOST4GEEKS-LLC	US	unknown

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 20.73.194.208 51.104.136.2	whitelisted
google.com	142.250.181.238	whitelisted
edge.microsoft.com	150.171.27.11 150.171.28.11	whitelisted
config.edge.skype.com	13.107.42.16	whitelisted
copilot.microsoft.com	92.123.104.45 92.123.104.53	whitelisted
wezgol.click	172.93.121.27	unknown
www.bing.com	92.123.104.16 92.123.104.5 92.123.104.12 92.123.104.10 92.123.104.7 92.123.104.18 92.123.104.13 92.123.104.21 92.123.104.14 92.123.104.58 92.123.104.61 92.123.104.57 92.123.104.46 92.123.104.53 92.123.104.45 92.123.104.50 92.123.104.49 92.123.104.59	whitelisted
i.imgur.com	199.232.192.193 199.232.196.193	whitelisted
arc.msn.com	20.223.36.55	whitelisted
xpaywalletcdn.azureedge.net	13.107.253.45	whitelisted

PID	Process	Class	Message
6796	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Image Sharing Service (imgur.com)
6796	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Image Sharing Service (imgur.com)
6796	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Image Sharing Service (imgur.com)
6796	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Image Sharing Service (imgur.com)
—	—	Potentially Bad Traffic	ET INFO Possible Chrome Plugin install
—	—	Possible Social Engineering Attempted	PHISHING [ANY.RUN] Suspicious unencrypted POST request sending an email address

General Info

https://wezgol.click/css/webmail.aruba.it/user/login/retrieve.pendingMsg/mailbox/aruba.client.user_id/customer.sign_mailaccess/db/index03.htm

58633E067C50493A89B818B4E45F3E38

4C967207715BA103D10EF452D91B86486DA023D2

18410B5217EAB900290FA354FF234369D78744F7EFBCDD6D82FE61929ED83F2C

3:N8RqSLGtlHSJiQCQLW6FRXwyo7JHK5iadlAPIChBqa4aDIn:2crSJeQdg7Nq51ahXqaPDIn

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Checks supported languages

Reads the computer name

Application launched itself

Reads Environment values

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings