hxxps://hubspot[.]domaines-villages[.]com/e3t/Ctc/DR+113/dk8fRY04/VV_BWQ7xgFLxW7Bv8p02hyHrvW5wYw0_5WPphwN6WXHZH3l5QzW7lCdLW6lZ3nFW2Z99Cl77kq2VW1dL1DP86FgbdW3wSppx3yz30GW8GZnbz5qVLwSW3D78Qj2j_Qh9W4vS3hJ1_j_YGN8n1-GDgjB-RW89Gqfw97q2DkW77fj8k4_gDv1W8kGndX2mwl80W3mrjX_1qWK9WW3H8yxX5j-tWLN7-Dy3Jc3sbSW6dx3M_7CzY7QW3C2xjZ1cwDS9W8rMDr98Bd2hrW7LnLsk7rpxQCN1xPrt31p9RlW1lY2Pv4nJ3X7W3WMKH_7bK5JhW34HtjD8MycNYW7V0szh2frxKGW2RQwmq1WXLV7W2mW34q3sbHswf8l4qlx04

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://hubspot.domaines-villages.com/e3t/Ctc/DR+113/dk8fRY04/VV_BWQ7xgFLxW7Bv8p02hyHrvW5wYw0_5WPphwN6WXHZH3l5QzW7lCdLW6lZ3nFW2Z99Cl77kq2VW1dL1DP86FgbdW3wSppx3yz30GW8GZnbz5qVLwSW3D78Qj2j_Qh9W4vS3hJ1_j_YGN8n1-GDgjB-RW89Gqfw97q2DkW77fj8k4_gDv1W8kGndX2mwl80W3mrjX_1qWK9WW3H8yxX5j-tWLN7-Dy3Jc3sbSW6dx3M_7CzY7QW3C2xjZ1cwDS9W8rMDr98Bd2hrW7LnLsk7rpxQCN1xPrt31p9RlW1lY2Pv4nJ3X7W3WMKH_7bK5JhW34HtjD8MycNYW7V0szh2frxKGW2RQwmq1WXLV7W2mW34q3sbHswf8l4qlx04
Sample261102-ld3xjsstby

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{171E5AAB-3AF6-4FEC-9CF5-9B978CA368D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1752	3924	msedge.exe	85
PID 3924 wrote to memory of 896	3924	msedge.exe	86
PID 3924 wrote to memory of 4232	3924	msedge.exe	87
PID 3924 wrote to memory of 896	3924	msedge.exe	86
PID 3924 wrote to memory of 896	3924	msedge.exe	86
PID 3924 wrote to memory of 4488	3924	msedge.exe	89
PID 3924 wrote to memory of 4488	3924	msedge.exe	89
PID 3924 wrote to memory of 3024	3924	msedge.exe	90
PID 3924 wrote to memory of 3024	3924	msedge.exe	90
PID 3924 wrote to memory of 3024	3924	msedge.exe	90
PID 3924 wrote to memory of 4428	3924	msedge.exe	91
PID 3924 wrote to memory of 4428	3924	msedge.exe	91
PID 3924 wrote to memory of 4428	3924	msedge.exe	91
PID 3924 wrote to memory of 3276	3924	msedge.exe	92
PID 3924 wrote to memory of 3276	3924	msedge.exe	92
PID 3924 wrote to memory of 3276	3924	msedge.exe	92
PID 3924 wrote to memory of 884	3924	msedge.exe	93
PID 3924 wrote to memory of 884	3924	msedge.exe	93
PID 3924 wrote to memory of 884	3924	msedge.exe	93
PID 3924 wrote to memory of 3976	3924	msedge.exe	97
PID 3924 wrote to memory of 3976	3924	msedge.exe	97
PID 3924 wrote to memory of 3976	3924	msedge.exe	97
PID 3924 wrote to memory of 4024	3924	msedge.exe	99
PID 3924 wrote to memory of 4024	3924	msedge.exe	99
PID 3924 wrote to memory of 4604	3924	msedge.exe	98
PID 3924 wrote to memory of 4604	3924	msedge.exe	98
PID 3924 wrote to memory of 4536	3924	msedge.exe	104
PID 3924 wrote to memory of 4952	3924	msedge.exe	115
PID 3924 wrote to memory of 4500	3924	msedge.exe	116
PID 3924 wrote to memory of 4760	3924	msedge.exe	117
PID 3924 wrote to memory of 3292	3924	msedge.exe	126
PID 3924 wrote to memory of 3292	3924	msedge.exe	126
PID 3924 wrote to memory of 3456	3924	msedge.exe	129
PID 3924 wrote to memory of 3456	3924	msedge.exe	129
PID 3924 wrote to memory of 3116	3924	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hubspot.domaines-villages.com/e3t/Ctc/DR+113/dk8fRY04/VV_BWQ7xgFLxW7Bv8p02hyHrvW5wYw0_5WPphwN6WXHZH3l5QzW7lCdLW6lZ3nFW2Z99Cl77kq2VW1dL1DP86FgbdW3wSppx3yz30GW8GZnbz5qVLwSW3D78Qj2j_Qh9W4vS3hJ1_j_YGN8n1-GDgjB-RW89Gqfw97q2DkW77fj8k4_gDv1W8kGndX2mwl80W3mrjX_1qWK9WW3H8yxX5j-tWLN7-Dy3Jc3sbSW6dx3M_7CzY7QW3C2xjZ1cwDS9W8rMDr98Bd2hrW7LnLsk7rpxQCN1xPrt31p9RlW1lY2Pv4nJ3X7W3WMKH_7bK5JhW34HtjD8MycNYW7V0szh2frxKGW2RQwmq1WXLV7W2mW34q3sbHswf8l4qlx04
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x264,0x7ffd2d63c188,0x7ffd2d63c194,0x7ffd2d63c1a0
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,928888114856440292,7933345405822286050,262144 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:2
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,8462235351085882404,10313941171341086810,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,14185911229822659263,15535738824512464855,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,14811886800963133295,15897400819996924333,2097152 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,3524226954276316610,191847568144041064,2097152 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,17699113787376680222,9085121645224103993,2097152 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,14475806590505879030,8668468183604602232,2097152 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3680,i,15286846575081487551,2015518039030034657,2097152 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,8999317685690719212,5186856941104728426,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,2545317202083717300,6730971297762354872,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,18041852611704552124,9551605348234399708,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,18041852611704552124,9551605348234399708,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,14295027328664424585,10228099969435973071,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,1725449244392673137,8197221278065367923,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,17969959082380391752,11330212197089093650,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11651465883342057804,12279859936502469307,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,2327156076007351117,8563561025096974792,524288 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5896,i,14125024452254356342,2774522289386018672,262144 --field-trial-handle=2920,i,203322808413271685,8323273528867986656,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

63f8aa4c-7c55-4387-8221-1b37c8453a93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63f8aa4c-7c55-4387-8221-1b37c8453a93.tmp
Size 8KB
SHA256 00dd0f87101de32e7f346ce7967b14a46cb509990a98d52c65c5d7160712c49c
MD5 76743faada4b02820d6be782faca1bf2
SHA1 9ffc6637697a0373e5e434d0529262a93872c488
SHA512 6b0286678a3d9655241712d209b1afdbd9a1aff39ce80feac84b6030198f648eee098872f6f8f0e8d1775fa43d71a3692144633633f8bcfb9c8fd21dc5d90a00
SSDEEP 192:SONI6ygpQmiUy0vtOCTVgMEkOrf7zPh4U6:SONI6lHFtOCTVakOrXKU6
TLSH
T1D802E734BC786CBB8EA2AE45F58B37179FA4117BD9552B80D9E85E0C01D765C2307932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6465acf2-da40-425b-9227-e3c4d037ba92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6465acf2-da40-425b-9227-e3c4d037ba92.tmp
Size 8KB
SHA256 6527ad68c072f31390209d040fa4b272c2dc4d0611c564b33eddbe891d946291
MD5 c4056c1a3ba09f07323064ef90bf1746
SHA1 d6b15dfeaccb2ed924a3ee5892cf0003b970a4d4
SHA512 b009f5e190883fd4eb4f2ff3e4ae51b19a9925f83a3fb651f2d582972fa7f76dd7beeb82a4d9f20e896439dc9398d0edff62f58ad5798a55a9d0e1d0cbc8d5a2
SSDEEP 192:KON26ylQmiUyVvmOCTVgMEkOrftajb+2N3UAqVU6:KON26wymOCTVakOrlajb+2eTU6
TLSH
T143121835BC786C779EA2A585F48732179FA85167DA467B80D4DC2F1C01DFAAC234B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

26ba0ca1-addc-48e0-b0c9-936dc616a48d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26ba0ca1-addc-48e0-b0c9-936dc616a48d.tmp
Size 10KB
SHA256 205a639188a2efaab364ec6f5c2e62684f42691503aa575cdcc3f07fc12c7f00
MD5 d38b9876c40ea53bd59d308de5ec5d35
SHA1 bb21d737dcbdeb60e5ed2b7906ef8ecaaba62f58
SHA512 6f306389e1838809a2708c3592b67e246f32c52632ea6deea95fb872bc0ee13e6169d3e4867c3891c0ff4ad065df2f4fefcbbd46776c9687aed3ac6a0ceb2f3c
SSDEEP 192:sxZHRxWAb/fcshKDIdp/g4KHW6+WNWGaiHfV/YRPmEX+Y4Ig5EJ:sxZHOAb/fcsUcoHHbW3it/mX7UG
TLSH
T17432C7666E34A97B8CC7D31DBA15BF53E7F9503291902E48EAFC851C05E67CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b6f68b8-fe39-4455-b3be-f79076354c14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b6f68b8-fe39-4455-b3be-f79076354c14.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82c5c63c-25a2-4dd1-9e18-4f0e2fced079.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82c5c63c-25a2-4dd1-9e18-4f0e2fced079.tmp
Size 10KB
SHA256 6b987b6266fbff4fcdea9e7a13b46d16ca08a1999c88b2ade803bdd4503861e6
MD5 e54cf7dd02182d444b19507642ae28d6
SHA1 942edb00fe9e286acf3e5ccdfac507e667c37524
SHA512 003209514f59f5d623b0bd096fbd01802de3e0af6c54ff33dbb3a07604ba617ed6498c4feac04f7ccb0de65fbc92cee889941e6d9adf67ebbcf3a36113d1ef1e
SSDEEP 192:sxZHRxWAb/fcsZKDIdp/g4KHW6+WNWGaiHfV/YRPmEX+Y4IgrJ:sxZHOAb/fcsccoHHbW3it/mX7U9
TLSH
T15C22C7666E34A97B8CC7D30DBA15BF53E7F9503291902E48EAFC851C04E6ADE130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

970965f5-7d48-4d18-8fec-ffb0d4bef7fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\970965f5-7d48-4d18-8fec-ffb0d4bef7fb.tmp
Size 11KB
SHA256 1211727633e67aa77797ac81baa25560b99f184c8406650c9cb8e6500f921676
MD5 864ea84871acfa772895d82ca240e79e
SHA1 69b9be542a2c64ca93580615e427e7eb54145421
SHA512 dd52bf77f4cf639612a88a60e0a9ec9711a562a35d7c23cc187db4c9ece9f916f7c06639001a9ac48eb1a65ee21a0990a1e747c9e71cac7d463fc1ca164f175f
SSDEEP 192:sxZHRxWAb/fcshADIdpZg4KHW6+WNWGaiHfV/YRP6bA+Y4Ig5mJ:sxZHOAb/fcsucqHHbW3it/mn7UE
TLSH
T16732C7666D346D7B9CC7D35DBA15BF13E7F9503291902E48AAFC861C05E6ACE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 45cf5a6ca5b99ee08dad285b5127abc0b5d2a9763245f7ecc5f35224624b882c
MD5 8c947dfe60c93e6afc0f5dfb20385d43
SHA1 b7904b04b115a55b95d711b6b37d30d53e1c0f09
SHA512 9ac6fd0a1e0027c19b0f42f0dea81e143576c6dd3ee0fc681f10e935fe24a40d52a0f82b89e574a35eaff434cc7967ce794d61483c27f7b93a9c137724ff4cc1
TLSH
T113E026B508CCC22FA208A48702EC4B0CD380361F93C06DCE3708C8D9B682151E686AA0
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 449KB
SHA256 e385bfdf32647cfc4a753510ddc9a5e6f2d6a76ed77d2369d4aafe38571e6154
MD5 251eb892f248e61c9314e8f856b90833
SHA1 8db7ed519251023ec37266bfcd513316e1b7a14c
SHA512 c053f26277c534fb0426983c34fd041c8b4fbde2d5b43232e82ef9c3bdb803f44c54ec8ae0b54bb0b5d42782a04d2eea5f5cedd2e8b51d0ff90d7bab27b10c3b
SSDEEP 12288:qAG2wjnbJ7ClCcHh33gG7Pm1Css5dMrK62/yNAsNvgC:ZGNNcC3GTMwMMw
TLSH
T1EFA4236B69B958A0F7E4063BC086339037F6A7718863900F653D5F8D6BBCD49B180D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 14418fb8b923f90623bce82add9b70b505fba61c5048ba427969871392d63caf
MD5 787ba52964828cff1a578e09a4ce7b20
SHA1 d1ae7d4fbfc3afcf770e0af7a210a7167ccd77d2
SHA512 ffe151f304d747d9a2444025e2aad7f09a7b0015abe5e1ef0dba49452163a8886764972a5c9a992efd29f6017413a4b1ef15bb3a661ca730bb5222b7ba0d3161
TLSH
T18D7150708BAF8F54DB541EBE65D40AC63AA347F71C829EF60684F1768BC67A431E3042
MD5 SHA1 SHA512 TLSH

Submit Download

9ce0ca9e-8601-4d5e-877c-d90dccb1c165.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9ce0ca9e-8601-4d5e-877c-d90dccb1c165.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

027de6df-85b7-451a-915a-8ecd9deb517c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\027de6df-85b7-451a-915a-8ecd9deb517c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

99137312-d08a-4a61-8288-875be0ae4dcb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\99137312-d08a-4a61-8288-875be0ae4dcb.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a2a005db-870e-4951-9ef0-9f853f32d7f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2a005db-870e-4951-9ef0-9f853f32d7f6.tmp
Size 4KB
SHA256 fcca4402e0c3ef45cea5bad775df44b01eeeec555d87b4fd1614e7e28544d04c
MD5 4b3004ae388fe3529d6df1599d97ac11
SHA1 3ced9efa80923f618142b04665e5206ba1b48985
SHA512 a7b4aac7e380cce9da598b4db0950c6c2209477abe7da76c227b7e611c380d4ba75985455d79f3fa609c6e9aa02608d2db8e6e20cbe974b9848126305c7a02b6
SSDEEP 48:YALlNuO9fK1fP/7S3/7YP/7SM/7b0sWzEsD9f8fzsI/xsz/p/aKss/ag/G/isn16:DMOtQn08dfazXt8pAxi2VuHbGeCbqSwQ
TLSH
T197816DF783E4C96DCA2292F0B6246F2BCF5A0A1982283C1DC9D99E57E7E3470D14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0d5d441a26358f51e0bcb6c23c32940ff843e49ce528ce5deb9bbf61a7684435
MD5 b1f608980e2228079220db75ec671c32
SHA1 d33546c7a85a7ef9645b010dac293a7dbc6dde7a
SHA512 43750b2c1c9f5ea48fbc19726c342ec7126dfe155d616d77bc6bb92b9f8cf67e86e57b6eb4cdede9a7caabfc3a356b6a0f474ccac919a2ca3900081682ad70a5
SSDEEP 48:K0mImvmvBGh8g+kkdbofQIS4dK9c1edx2NY3IkmyLDmHjNl12blo9ISj2K9T1B2F:K0mrKTFqK24K6cAKNW20YKH
TLSH
T1FC916715307F228139BD385C51B4975A568131B3302AE66B7FBC4462CEABE064EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa7a0227-72b8-4f04-8637-c49afd1e806a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa7a0227-72b8-4f04-8637-c49afd1e806a.tmp
Size 27KB
SHA256 3cb07cc13e11af3e9d197d7ebc1e33a3e7d11b132faa9f8ad114ff916567cb01
MD5 3b63c7135b198d28710382f0418a63a8
SHA1 67e6b7f5a3de92a3e7c42ed75734ffdf6a2ab02b
SHA512 314fad496535b01b619690e2f61ab795bd02dcfccd0fd72394e3e04cc31e67b8d09625831ba4ba77259471bf2752c77b6f9460e60f70ae7fddacfa494f83b356
SSDEEP 768:yAK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k39roW+bn0:yAK9uzYWvcQWsu1ja0HL7Q32W+b0
TLSH
T11CC2093F640CCB7E4FC01A9DDC5A6F963E9802D7A6688D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc46f96e-de67-4a8a-a06b-e8cd669d9231.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc46f96e-de67-4a8a-a06b-e8cd669d9231.tmp
Size 10KB
SHA256 e4df80c82ec277b984a8c7e2a5b5244f8cbb262bf58c6f42adf4ccf9eed44242
MD5 5ec0c7ca52b515043a082f1ea326e55a
SHA1 535d21f4813c72808419b7acd2cd7ab95ab180ae
SHA512 ff540cc71ad6d5d9f575cb3bac69d0453f6a0ddb697bb91f8ec2f66553b97f7eaa493f4d255fc024d67f597b9f74b1a741f3b26b83771a4a06501a76c6cb4dc6
SSDEEP 192:sxZHRxWAb/fcshADIdp/g4KHW6+WNWGaiHfV/YRPgMX+Y4Ig5mJ:sxZHOAb/fcsucoHHbW3it/mz7UE
TLSH
T1FA32B7666D34697B9CC7D34DBA15BF53E7F9503291902E48EAFC861C05E66CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdff3c62-fe78-4035-8016-ae204f8179b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdff3c62-fe78-4035-8016-ae204f8179b7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ded16087-3617-4e39-92fb-047a4c9950c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ded16087-3617-4e39-92fb-047a4c9950c7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae6ca38a-1b12-4410-8766-298b9e7a2359.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ae6ca38a-1b12-4410-8766-298b9e7a2359.tmp
Size 18KB
SHA256 c7d7d4a7c9ed4576ea4dc8845121e2656d853b349e46529da41f3f03d88e1591
MD5 6f8d57c00d4750a319f77fdcee32ba34
SHA1 99fc2acc27470eee339985557c583aa964e551b0
SHA512 3a184fbc6176e9ca6ff61f3ab5206b1bc6b270870d05fb4e5e19e16be8541fc0416398cd1f935bb0a590034ba84134795d0f55117f774c498a8c990ddfb2df95
SSDEEP 384:3QkUSv0sNEU3w4Rdj+6OjTVakOrlajb+2nTH7vBEb3IIlx:J0iC5ntOsjblnTH75EzL3
TLSH
T1D2827C35B8785D7B4EA2A240E14E3617DFB8916BC6D92B80D4DDAF1C00CB69C334F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb145cee-1819-4e5b-aad7-7f1128fce7f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb145cee-1819-4e5b-aad7-7f1128fce7f0.tmp
Size 18KB
SHA256 b808729eb4f150d82533cd11d22cc3c3a63abb07702fb7994ac913483a1dc754
MD5 4635095a91ec881e238b670728654ed3
SHA1 554aff9d515a458bad1058924036c0e58c3758e6
SHA512 d8e13e262b4f93a9dad18f9a70f6fff91fec8d8a8e6430a20ac2cf9be21803e0bb0b818e592ec67cc2be6812abd5e47b3f4b26654071d348cec7a18d598aa17a
SSDEEP 384:JQkUSv0sNEUmw4Rdj+6OjTVakOrlajb+2nTH7vBEb3IIlx:r0nC5ntOsjblnTH75EzL3
TLSH
T1D1827C35A8685D7B4EA2A640F14E3617DFB8916BC6D92B80E4DDAF1C00CB69C334B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d323ef5-da3d-41f1-9b8c-6ccab909b806.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5d323ef5-da3d-41f1-9b8c-6ccab909b806.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fcc889b1-2e91-4e58-bf57-55571d3dd9f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fcc889b1-2e91-4e58-bf57-55571d3dd9f3.tmp
Size 26KB
SHA256 a09290b02afdb73074dd72baa45de884d08a4135c8adab787d87812672eaccd5
MD5 09ab12e6d38710ab729f25969fd4450d
SHA1 be028f98a2eb6aba65a281f0168a88b1884544b4
SHA512 0196f5e30cfb9459b9443b12f45c5bfc8d096787a3e66c32a1a9e96f541e15e7b47782d5e8b1586f37888bc8cd4ba23f696ed0b7b1b77ca63a42b30ef2b4ae3b
SSDEEP 384:/iFzQkUSvzzsNF8TUNTUlIlmw4RdjR6OjTVakOrlajb+2nTH7vBEb3IIlx:KFdXUwguN5ntOsjblnTH75EzL3
TLSH
T10AC2F6F258D74D3AD9AE5743E37D2E038EBCC067B4956690B3885A0CCC861BFE34A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 82de0483ec2b02466fda135a7ec31de8d874be5bb6580690ae352ecc10c1c51f
MD5 a75847e45e7800128c4918b32535eb67
SHA1 1edfa2400d6b078b4ab593e040ab9882f08b54d0
SHA512 3f581291d8b6d4e15d916448f57c615fafdcf87150720b321429b16375de91c8d7d93369c5cd95b3cff1bbcc10c6975aef21b240e0f0ef9368bb55b2a091f541
TLSH
T17241E758A6F91148B3B76F5AABF6696E487AB9772F0AD45D00110D4F0A23B00C972B37
MD5 SHA1 SHA512 TLSH

Submit Download