hxxps://my[.]rtmark[.]net/gid[.]js?userId=0083e22d39c642ebeb4d3f3c6a00b4aa&set2ud=true&z=5117867&p_rid=542316e6-f754-41c6-9ef3-c326c5b7930c&p_src=sf&csflbck=normal_pixel&fsa=1

Analysis

user interaction
yes
max time kernel
149s
max time network
122s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://my.rtmark.net/gid.js?userId=0083e22d39c642ebeb4d3f3c6a00b4aa&set2ud=true&z=5117867&p_rid=542316e6-f754-41c6-9ef3-c326c5b7930c&p_src=sf&csflbck=normal_pixel&fsa=1
Sample261102-drqv5sss8r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5072	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{3EE50D0C-C896-4AEE-A739-2C91945FC077}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 1444	3476	msedge.exe	81
PID 3476 wrote to memory of 5072	3476	msedge.exe	82
PID 3476 wrote to memory of 4364	3476	msedge.exe	83
PID 3476 wrote to memory of 4364	3476	msedge.exe	83
PID 3476 wrote to memory of 4364	3476	msedge.exe	83
PID 3476 wrote to memory of 1548	3476	msedge.exe	84
PID 3476 wrote to memory of 1548	3476	msedge.exe	84
PID 3476 wrote to memory of 2976	3476	msedge.exe	86
PID 3476 wrote to memory of 4704	3476	msedge.exe	87
PID 3476 wrote to memory of 2976	3476	msedge.exe	86
PID 3476 wrote to memory of 2976	3476	msedge.exe	86
PID 3476 wrote to memory of 4704	3476	msedge.exe	87
PID 3476 wrote to memory of 4704	3476	msedge.exe	87
PID 3476 wrote to memory of 1848	3476	msedge.exe	88
PID 3476 wrote to memory of 1736	3476	msedge.exe	89
PID 3476 wrote to memory of 1848	3476	msedge.exe	88
PID 3476 wrote to memory of 1848	3476	msedge.exe	88
PID 3476 wrote to memory of 1736	3476	msedge.exe	89
PID 3476 wrote to memory of 1736	3476	msedge.exe	89
PID 3476 wrote to memory of 628	3476	msedge.exe	90
PID 3476 wrote to memory of 3132	3476	msedge.exe	91
PID 3476 wrote to memory of 628	3476	msedge.exe	90
PID 3476 wrote to memory of 628	3476	msedge.exe	90
PID 3476 wrote to memory of 3132	3476	msedge.exe	91
PID 3476 wrote to memory of 3132	3476	msedge.exe	91
PID 3476 wrote to memory of 2272	3476	msedge.exe	94
PID 3476 wrote to memory of 2272	3476	msedge.exe	94
PID 3476 wrote to memory of 4712	3476	msedge.exe	95
PID 3476 wrote to memory of 4712	3476	msedge.exe	95
PID 3476 wrote to memory of 4008	3476	msedge.exe	96
PID 3476 wrote to memory of 4772	3476	msedge.exe	98
PID 4008 wrote to memory of 2132	4008	msedge.exe	99

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://my.rtmark.net/gid.js?userId=0083e22d39c642ebeb4d3f3c6a00b4aa&set2ud=true&z=5117867&p_rid=542316e6-f754-41c6-9ef3-c326c5b7930c&p_src=sf&csflbck=normal_pixel&fsa=1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x2f0,0x7ffb77d0c188,0x7ffb77d0c194,0x7ffb77d0c1a0
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,6653596907564124410,11480207070276974933,524288 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,1512368955461509130,17042821793273549895,262144 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,4392472749788976595,1151257131051064265,524288 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,16050208073043185069,15564227383576103173,2097152 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,6621554067688618843,15592389433183200591,2097152 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,10407033640061132886,6953741304097652526,2097152 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4240,i,10604587138124443064,17192929526391818865,2097152 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,16220493290983449328,9986997472366986825,2097152 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4252,i,13180310258135571739,6534674359057516252,2097152 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,6552998248157522255,4750329938297515395,524288 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,9272471849470855594,11175067031708274818,524288 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1169826971494077200,3069727847782815150,524288 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9448972169918264997,4852451288846745823,524288 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9448972169918264997,4852451288846745823,524288 --field-trial-handle=1884,i,15771392006289547068,999027011307465276,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3bab5be5-0103-47f7-953b-adf34b52aa92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3bab5be5-0103-47f7-953b-adf34b52aa92.tmp
Size 8KB
SHA256 d513364c983d87a55f863ccd7642b87013c74c1efd01537f3e2ab9b4858e4176
MD5 e9febd50787415a0efb5cd58ccad2b79
SHA1 7872321099696a01aecc6ab5b799a0f004dbab46
SHA512 2df54bd7a3a578301bdd06235f98b2317f35b6cb71eb525b64c8b598edb2de5fde8f03358cc1dcbfda981c7c1792f009fb3aa367b858c483a21db3b6d7aa4ccc
SSDEEP 192:9GNK76UbxQmiUyDJpI+W9XPaTORyiyr5NuU6:9GNU6IP8J++kSboU6
TLSH
T16202D735A8B83C6B9EF3AE15B48737175FA5116FEA852F84D9E81A1C40D768C1307932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac802d42e2a8c83b8ce1169fa590ec312d08c34384e50e83be866431bd1afd1e
MD5 b8c6c59a37faa922d11889aac434129c
SHA1 d3c62f9951dcf92ed81c0efd43ca6fa2074779cc
SHA512 3912dd5e870efa5e89277bb10438cdc267f459d9387772174b06f12ab6a5bc75731a56f3ab2ab94b343d4755aaa4d965c3982ce3a04526f5b1eeb24ee83d5218
TLSH
T18AD0C019B8333ED9E11FE230002CF9800100C983CD4104040B070D1495D00030CA2FEC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0714e6f61cb4ee87df081093ea45647348bd6b088c2ac1e6188d495c78e99d7e
MD5 2fe08827a42341294e10b9edd0b51268
SHA1 9825b24ae78e2cde9480297e7e4013d6c0959b16
SHA512 7a0465cafbdfbb547a5cef98322581d1e80a528dd4189337fb6b5b13ed414e2f42b21bf71aa7a23f7a751b405de9800d7ecb96c64b25f954ebb7a1f0780507ac
TLSH
T19CD0112AFA222E02E000E232802ABA82020080828C8208088A800222A8C2802882B22A
MD5 SHA1 SHA512 TLSH

Submit Download

68b2d0a4-6e15-43be-996d-99d4b4a2380b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68b2d0a4-6e15-43be-996d-99d4b4a2380b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8df64ae0-3ab3-44a3-9bcf-6a316fa47edf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8df64ae0-3ab3-44a3-9bcf-6a316fa47edf.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 249f2e2de73ecea6bea3e01cd719086f675d9b322b6458bbdca20c39fa4973ee
MD5 f56ad8811745510486966a6ee5800335
SHA1 1ed609e5cc8b50c34576f7a46314d661e6ca0fc3
SHA512 248778095e3f3a533fc46bdfe581796f328e2c7b35c8edf74112cb30367cc82d1a7e7da6955216946e62e0db5dd2663ad4410a983aaa1cfd11895001d43f2ec5
TLSH
T174512BB51150CFA8FFA00E78A19C128FBD30CA85FEC33DE52090D9BA8906F645D151D8
MD5 SHA1 SHA512 TLSH

Submit Download

57574ed7-dc07-405f-b249-6bf072fd5812.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\57574ed7-dc07-405f-b249-6bf072fd5812.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2885cb37-658f-4054-9657-ee21af61c7b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2885cb37-658f-4054-9657-ee21af61c7b5.tmp
Size 1KB
SHA256 dcc5df167619544e8cb323add3198190c51459b732dbc3920dbd8658b1cd86c2
MD5 b1ed9fcdd7096722c850290200385e79
SHA1 c2daaf7b9c6f59129ab90b6e9347f71ba76913cc
SHA512 28a7a7e831bb2f04b7a0175271eeb400fdbe57a4bd035a1c5375d27ca3a65ec067dcfe303f664f5f97c39caeba905910edf2403df12be206ace75eb30312d7d8
TLSH
T1C5214BF2C6D5866ED90156F0AB24AD1BCE1D0A1642283C2AC9D4EF6B97E3071E142A5F
MD5 SHA1 SHA512 TLSH

Submit Download

7be081d5-0a6c-4fa9-bbef-86eaf580e776.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7be081d5-0a6c-4fa9-bbef-86eaf580e776.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 be3df4dc78f5e4e164180b6290ce6308a65d4dfc526541f277a542cf18580eea
MD5 1be56b4f48ac91c88cb609dbaf53f4bb
SHA1 fb0b6510503f7752dedd272ffbb8fafdfd42c963
SHA512 e578f6b45cb51d254814ade6e0730955b0bc790ac323ded7522acda0df7e154fc82061e148a233ed5e56a216d0819336d614cc79f5af842cb0c16547fd56fff0
SSDEEP 768:oglTj8Gr2ymWRm+KQEC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MxLl/C80fDjroRu:oglTj8Gr2ymWRm+KQECu1jaKMxLpCNfx
TLSH
T1C9D21B3F640CCB7E5FC00A9DDD566F976E9802C7A6688D4047FE984C02D77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c2b417d02222123180362518c6dd70bba08d1120e15104090f2adfc026fd9a01
MD5 973a305d9167b7399985ed040614cc71
SHA1 3c21595734872c127daebed8e527e0db07a8d66d
SHA512 cac0f372a1ca2650cfaaa2d346f40a911deea1b2d4f7900d20653640e1b280dee70d99339301ed845aba526709db44493927959a23b4b4c51c790fc6fa77ba25
SSDEEP 24:KZ/EjgXIvKLh+1iSq9ryXyBi1UpI/Ktha1qSgL0R6tc5IvKVhC1mSg33yX+1q+:KUUIvKN+cPypCI/KLacvmIvKTCILyG
TLSH
T10A915360317A024539BD650E41FEA61B224131B3712CE56F7BBC44E24E7AE680EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6639ac5-4e22-4d3f-acfa-5fbba98cef7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6639ac5-4e22-4d3f-acfa-5fbba98cef7e.tmp
Size 11KB
SHA256 0a2e93212222430cecd332d9ff5c5935264e64e3e239081d0896d3ab9ebbb6b9
MD5 8129c930b1afa5d7c1aa940499f078fd
SHA1 5265ced85469600731a8213c91dd4af18ea683aa
SHA512 7cd4d5157a602459cd2f0e8744f9785d2417a58cdfad5b33754de39fb072d65c994d6e730628caa73113947c8588f42aae2cb3413e928d72881b945f5c8947e8
SSDEEP 192:sxZPRrbq/f/snWpVHhOHIdpwH/W6+WNViyJ/Y0GW23LJHuIgFJ:sxZPNq/f/snWvHhJy/bH/5KLov
TLSH
T1E532B611A938A97F9CC7D21DBB25BF13E6FD543295912E44A6FC8A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

c0de0632-df98-443c-8682-3c9e665a56f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c0de0632-df98-443c-8682-3c9e665a56f4.tmp
Size 22KB
SHA256 ec99192e56e5f3b376516262c7972925566790971690502213020ce2e52a29e5
MD5 2e151b9235a992a0b41cdf4951fb5434
SHA1 954e67d3fe5714a1259ccfde4ff6c4f8988bd064
SHA512 c8ecb1d00432ee9c26ee3d74bd4993b8cca8ac712b97c0927785b6995b6d3fe7b5e9bb0eb5bc1f9153b02e4f9e7c3fe6ad9667841adb9c3057ff146c35776572
SSDEEP 384:iQkUSv08N7Ufkik76LOf5S/IYoQNW1f3n9J5HH7vBEhjIIli:a0Mp3YwfX9J5HH75ExL4
TLSH
T1A0A25A3C9C685C3E4ABFB708A14E3A279D68413FD9B06A98D7D58B0CC0B269CF747911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea8a6ed9-b22c-4f96-bb05-a78f416f9163.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea8a6ed9-b22c-4f96-bb05-a78f416f9163.tmp
Size 8KB
SHA256 405426effeebeff1b0aab366968699fd2dd13c443b4383e4307a3d4c30db8c01
MD5 98d95a853075a1b76daa1c9ce4ee28ad
SHA1 2fe1763c6a7bb2c65181cef255220415c8d74e15
SHA512 e490831fb69946165b16d51ee4d02114720287e818e88222357a92d5fa72d24c7e1bd2882f20ab01fecbd417c5eb6c3653cdeedf39597acd17693609a6b89dc4
SSDEEP 192:9GNp6UbSQmiUykI9W9XPaTORyiqSbPwozPKJq+LU6:9GNp6IO29kS/IYo2FU6
TLSH
T151121A3198B87C2F5DE3D965B48736175EB4822BDBC97F84D5EC2A1C05DB29C030B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads