hxxps://hs[.]garda[.]com/e3t/Ctc/GI%20113/d5lYj204/VWcfzb3W4NfcW6R3FMX7gy0RDW4gSXWJ5WRmY6N78LwvT3qgz0W95jsWP6lZ3l0W1cXB2w5XGqx7W1z1Rr_30Jp94N7vYLbDLYZFCW1kry0z8kzFSkW4ngWpj79gTjgW4qNmNM5Xz71TW3NFbyV9dZrPmW3qd7BH8DT3VMV-jg-06WWMPsW3PBm2L5RVzwVW2T1ClV2PgZ4_W32DlG98QmhnCW55QjlN32THFPW3zwDwM1R38TbW5M3X1K62wQbyW5LwWzQ2qcz1vN2n-PBf_TTCdVHP3kt8_qwC8W3XNDfh4nMRS0VzDdw04D-HGxW3V9yCK8wdxNzW2lvCJ52qb1JMVKQ5MH5Ych4bW3MbjbL40WZkFW583-0v605MN_Vc7Gpw6DnmB6W6v6B933-pnPHW281gdw66y4txN7j14LxJM5k2W7c9WcY1qqlMff18rdR004

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
42s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://hs.garda.com/e3t/Ctc/GI%20113/d5lYj204/VWcfzb3W4NfcW6R3FMX7gy0RDW4gSXWJ5WRmY6N78LwvT3qgz0W95jsWP6lZ3l0W1cXB2w5XGqx7W1z1Rr_30Jp94N7vYLbDLYZFCW1kry0z8kzFSkW4ngWpj79gTjgW4qNmNM5Xz71TW3NFbyV9dZrPmW3qd7BH8DT3VMV-jg-06WWMPsW3PBm2L5RVzwVW2T1ClV2PgZ4_W32DlG98QmhnCW55QjlN32THFPW3zwDwM1R38TbW5M3X1K62wQbyW5LwWzQ2qcz1vN2n-PBf_TTCdVHP3kt8_qwC8W3XNDfh4nMRS0VzDdw04D-HGxW3V9yCK8wdxNzW2lvCJ52qb1JMVKQ5MH5Ych4bW3MbjbL40WZkFW583-0v605MN_Vc7Gpw6DnmB6W6v6B933-pnPHW281gdw66y4txN7j14LxJM5k2W7c9WcY1qqlMff18rdR004
Sample261102-t3btcsff58

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3728	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{26E7805D-8C96-4016-9DDB-ECD2B50A81A4}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3692	2660	msedge.exe	84
PID 2660 wrote to memory of 3728	2660	msedge.exe	85
PID 2660 wrote to memory of 3964	2660	msedge.exe	86
PID 2660 wrote to memory of 3964	2660	msedge.exe	86
PID 2660 wrote to memory of 3964	2660	msedge.exe	86
PID 2660 wrote to memory of 3020	2660	msedge.exe	87
PID 2660 wrote to memory of 3020	2660	msedge.exe	87
PID 2660 wrote to memory of 1480	2660	msedge.exe	88
PID 2660 wrote to memory of 1480	2660	msedge.exe	88
PID 2660 wrote to memory of 716	2660	msedge.exe	89
PID 2660 wrote to memory of 1480	2660	msedge.exe	88
PID 2660 wrote to memory of 716	2660	msedge.exe	89
PID 2660 wrote to memory of 716	2660	msedge.exe	89
PID 2660 wrote to memory of 2008	2660	msedge.exe	91
PID 2660 wrote to memory of 3760	2660	msedge.exe	92
PID 2660 wrote to memory of 2008	2660	msedge.exe	91
PID 2660 wrote to memory of 2008	2660	msedge.exe	91
PID 2660 wrote to memory of 3760	2660	msedge.exe	92
PID 2660 wrote to memory of 3760	2660	msedge.exe	92
PID 2660 wrote to memory of 1772	2660	msedge.exe	96
PID 2660 wrote to memory of 1772	2660	msedge.exe	96
PID 2660 wrote to memory of 2696	2660	msedge.exe	97
PID 2660 wrote to memory of 2696	2660	msedge.exe	97
PID 2660 wrote to memory of 2652	2660	msedge.exe	101
PID 2660 wrote to memory of 4744	2660	msedge.exe	102
PID 2660 wrote to memory of 4744	2660	msedge.exe	102
PID 2660 wrote to memory of 4744	2660	msedge.exe	102
PID 2660 wrote to memory of 1804	2660	msedge.exe	106
PID 2660 wrote to memory of 1804	2660	msedge.exe	106
PID 2660 wrote to memory of 1804	2660	msedge.exe	106
PID 2660 wrote to memory of 3452	2660	msedge.exe	110
PID 2660 wrote to memory of 2188	2660	msedge.exe	111
PID 2660 wrote to memory of 5104	2660	msedge.exe	112
PID 2660 wrote to memory of 4340	2660	msedge.exe	113
PID 2660 wrote to memory of 4340	2660	msedge.exe	113
PID 2660 wrote to memory of 4340	2660	msedge.exe	113
PID 2660 wrote to memory of 1648	2660	msedge.exe	114
PID 2660 wrote to memory of 1648	2660	msedge.exe	114
PID 2660 wrote to memory of 1648	2660	msedge.exe	114
PID 2660 wrote to memory of 1048	2660	msedge.exe	115
PID 2660 wrote to memory of 1048	2660	msedge.exe	115
PID 2660 wrote to memory of 1048	2660	msedge.exe	115
PID 2660 wrote to memory of 3688	2660	msedge.exe	116
PID 2660 wrote to memory of 3688	2660	msedge.exe	116
PID 2660 wrote to memory of 3688	2660	msedge.exe	116
PID 2660 wrote to memory of 1052	2660	msedge.exe	117
PID 2660 wrote to memory of 1052	2660	msedge.exe	117
PID 2660 wrote to memory of 1052	2660	msedge.exe	117
PID 2660 wrote to memory of 4244	2660	msedge.exe	119
PID 2660 wrote to memory of 4244	2660	msedge.exe	119
PID 2660 wrote to memory of 4244	2660	msedge.exe	119
PID 2660 wrote to memory of 4368	2660	msedge.exe	120
PID 2660 wrote to memory of 4368	2660	msedge.exe	120
PID 2660 wrote to memory of 4368	2660	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hs.garda.com/e3t/Ctc/GI%20113/d5lYj204/VWcfzb3W4NfcW6R3FMX7gy0RDW4gSXWJ5WRmY6N78LwvT3qgz0W95jsWP6lZ3l0W1cXB2w5XGqx7W1z1Rr_30Jp94N7vYLbDLYZFCW1kry0z8kzFSkW4ngWpj79gTjgW4qNmNM5Xz71TW3NFbyV9dZrPmW3qd7BH8DT3VMV-jg-06WWMPsW3PBm2L5RVzwVW2T1ClV2PgZ4_W32DlG98QmhnCW55QjlN32THFPW3zwDwM1R38TbW5M3X1K62wQbyW5LwWzQ2qcz1vN2n-PBf_TTCdVHP3kt8_qwC8W3XNDfh4nMRS0VzDdw04D-HGxW3V9yCK8wdxNzW2lvCJ52qb1JMVKQ5MH5Ych4bW3MbjbL40WZkFW583-0v605MN_Vc7Gpw6DnmB6W6v6B933-pnPHW281gdw66y4txN7j14LxJM5k2W7c9WcY1qqlMff18rdR004
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffa9cb6c188,0x7ffa9cb6c194,0x7ffa9cb6c1a0
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,14361215925971679764,17744518515209627356,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,2431399249741676670,12275594500659158639,262144 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,9184457339405931018,797530573032647037,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,17106959884913574883,8073266808284997445,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,2959909057194174064,13896481042691790453,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,14320872213429024318,5347018391708141817,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,4739298737430222706,10899118135139727953,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,7596894477345811329,10372069815829422271,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,7208180659556607403,7378983270703774170,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5738776010269519139,3857234337151524435,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5738776010269519139,3857234337151524435,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6176,i,16342315216965647303,13325960546475250819,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3800,i,10312548605326564081,9003310009057020800,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,935080345988422356,8520076542559663268,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,4301556499166375127,3339448384187089254,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,8533022051398481208,2539263918724271680,524288 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5116,i,14327471486631060934,5159325474501793160,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6256,i,8523233389163895363,14223084250906374323,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6352,i,9944059137316340600,624404937498188507,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6504,i,5074908568058881776,671165162226763049,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6652,i,5740044578354945009,15170425761715338789,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6380,i,15288902063899105895,15283015984217459588,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3752,i,12741370592167475230,3152880833631079771,2097152 --field-trial-handle=2308,i,2878678516416859551,16282925328323424876,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3738db57-f521-4dd0-bdd5-48fa42257959.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3738db57-f521-4dd0-bdd5-48fa42257959.tmp
Size 18KB
SHA256 aac432d663d018ae82f3df14d28102696c75fb13ecefa334970b0b15b0b6faa2
MD5 c73445ec9c3a0014ca3408a0898df658
SHA1 23f574f2a95de8eb2f975264d9ba0e4dc2ae7509
SHA512 9f5e803cd9354af86fe6f1094e090710e8516b4f8554208db9c1e6560b05991cb406f59fd1c4c9db9b40ab38494dece1a5874145a3da1727c09a84288a510c02
SSDEEP 384:UQkUSv0sNE2gbSc5/p5u8i4tk7dvVfZBblL:E0DDXkZ7vZdlL
TLSH
T1DE827E36ACB86C3B5DA6A541F40F3603EFA48567D7C41F94CDDDAB2D02DB2982307616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69894ce2-d81b-4f08-b912-8596bc5076d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69894ce2-d81b-4f08-b912-8596bc5076d2.tmp
Size 8KB
SHA256 82c3b11ae6499970b10c065e4a9b91411d87f5378d9f76fe1e27c525f791dec7
MD5 941b27b367a0f622152b51b3078b5abb
SHA1 a436adb9d4a499ff6946ef81fbd88bd4804057dc
SHA512 70eaf1f5fc9c8c2b5f72817c027956287de7df27abbdc610f368d8ecfc744610fb2c666a6a70bb9159c41272cde9f54fa4e8e7b809b4710012af161c46577c95
SSDEEP 96:PqONkOQsjpfwDISp5ih/cIPURHl8h4otop5cmDrBfPGxvw45RxmJm78lFfxQpLka:SONu6iDCQmiUyfVHq5u88P4ASqG1zU6
TLSH
T12602E839BC783C6B9EF3AD05B44737279F99116FE6942B84C9E81A2D01D729C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a829a1c-7163-4572-a546-d0161398881f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a829a1c-7163-4572-a546-d0161398881f.tmp
Size 392B
SHA256 49a66750c9ee93385558a01b4d8890ea332f91ab8b9d939cfc383e953239df0b
MD5 f455b7e25c2b20b2448fee894f66f724
SHA1 4435e1f67a011e8baee94971823911073e4360fd
SHA512 3354b027c961045777a452f29317a390fd6bea1673a44d1081a45c87d8e45d64df09e5c617dd0135e75fc440d8149f143ec1cc82874a477a09d9d54dd7218917
MD5 SHA1 SHA512

Submit Download

821d6970-9c32-43b5-af96-f81d3cc38863.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\821d6970-9c32-43b5-af96-f81d3cc38863.tmp
Size 8KB
SHA256 658140aa0cc9f460267fee0ce4acce96cf44e9524a080826e6d793697bc0d972
MD5 2fa2194386b124f125bb990a6d77fb3d
SHA1 f23f1db3edb67ae7050a30739079be5a2a871529
SHA512 09d0e1f7cd2eae3eb3bac6c3b52046bcea9b7cde0eac9b0f5fb4e4aeec4f84016f041d3d00533fb02ea09e36fcadf8b1d5ca57d3645be20febfb938dd829f22b
SSDEEP 192:BONV6iD7QmiUy5Vdq5u88P4tmethDuZ4qxU6:BONV68odq5u8i4ts7U6
TLSH
T199120B36A8BC7C3F6DE3A955B48736179E954227D7886F84D9DC161C01EF2AC130B523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a41e6220-da1d-4e2d-987f-b1854107aa0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a41e6220-da1d-4e2d-987f-b1854107aa0e.tmp
Size 105KB
SHA256 2f9fb064f94eccdb3d8edbb1c1ba4bbadd27d3337cdce780bdc569a5e9e5440b
MD5 61c338d2bfa85767e515882bc177704a
SHA1 e9fba59e919d0fc771951653a3bf48507da7c5bb
SHA512 04b2821b92e8d2df67c52463bbc9f7eac8cc2bcfa2586f1162db3bcc9271d7becc0b425e68e1ccac9adf9a665d51c335eb9b558dad463a21639973170264c5a9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T11FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

0e8fe564-9623-45c5-8a60-34c22f0767c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e8fe564-9623-45c5-8a60-34c22f0767c8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b2962dd-022c-4481-8250-c6418d806ba0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b2962dd-022c-4481-8250-c6418d806ba0.tmp
Size 10KB
SHA256 e11046903796e96fe6bc5edabcdff3f958c89dd99dba64e4edda553dfd7bba5c
MD5 24629860e66321a0e90b3af27232d2ad
SHA1 3be0f3185f225825c2fdade3599abaeacd09aeb4
SHA512 f433ddc40906ee44b1ad37c1d5d4dc9fe81e29eee4c61f78ecad491d53d3f5e108c58ef6afa18608d97fb2efb1377cac2151ece31ce6d6aedf87fd20a1178899
SSDEEP 192:sxZuRsW4/fVs/sTqdpdK8HW6+WNtfTo/YaCPAAdPIgrJ:sxZuN4/fVs/seRHbC/uv9
TLSH
T16922C852AE28A57B4CC7D20EBA15BF53E6F9503291D01E88BBFC851C05E77DE220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e2ecc29-6cfb-4ffa-a9a9-2938f95de8d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e2ecc29-6cfb-4ffa-a9a9-2938f95de8d1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 101KB
SHA256 f01a429c1412189c1c4106239c077347c947c275f6effe4ec9abe8688512de3f
MD5 de0b07bb42c699ec7366a0c3ee539ec8
SHA1 4315cc2c97bf5fd40664ee86baaf2990c1e48e5f
SHA512 84c9511420c178d28175c229376c6c0728bc30647f334569d152d0003c713a3f90b1618653cdcd80384c06c190b361a70ef4344807f68f24377de25924474fa5
SSDEEP 1536:41O6Ny/DmIzHHAz882Z+v0E8RIDEPFuXgUNPhUVWZMnUo7im3CinQ/Y3o7O+iV:41BNQDJjd8tv0I91w7imyinAY35P
TLSH
T13EA3120D5AE4552EC093AC63B41AEE77E89A592B4BCCBD6C6FCD5141E3DC0B8D5C3248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 33KB
SHA256 c7e022d03458278aabb7ce6892ddeef5736041de037d0d64adedc2eb1d82850b
MD5 13244bd99451605c61b32c9617162c1f
SHA1 0e76a3a33245d9276580c0b4d8ecac07d9936e66
SHA512 ddf74fcb1a02f0f90b658a25bf5d7ca4a1478acaaa3f72208bbd7e33a9d56dd04834a2b229fc2303abcc63270d28d7b3df2c26084df3e5f981d54bac56bdd442
SSDEEP 768:NTzY5H9o95VUWuWLtaQdp3q9Sjub2aq+C/0TMjKueJRdJP:NTUGzUWjLtNPoSCS+C/04jkxF
TLSH
T1A6F2E1418161747797BE6BDA9090D2BD1A512CCDDC7C20A852CA4541DCEADDC2FC0D7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 16KB
SHA256 53c7c08337b4f5be6f7942897b364afd73bf4753786664659d303b5e660b118b
MD5 9830fb86af17e1952070d26eaac42196
SHA1 4e12ffa4ffa6e553032bb751c66a6da416561880
SHA512 a8bdf80580813515b71e15ec369cdc2c436972f4fa09e72d1314b007c9ebb9e396638081265852b6e09365f8940f38f90404766c903d4e2d8ac34cd6894dd13a
SSDEEP 384:XTir8ItJp0ygYyZ03GIXp7LsQyN0LcS6/NueyF:D7MdgaG8sQygLFF
TLSH
T1A672E099B782FAF42C2E30B5868E2D7EA02274C9A5F5938243D01F902119A1826F31F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 21KB
SHA256 8c3e9c1a653451f07edae74ef4d31b3cd4c2a64f4aeb8ff9a7609691aa21fda6
MD5 683f1e4f73a432f95fb16168f4fe53e3
SHA1 289d5bd9ee46b2cdadf18f22ba3af8cf4dbcbc2f
SHA512 1f0bb35c276f2006bc075bfc410d0c91999ffbfc890ef515f5fb03237132a7706d8901b0327bb70fc45e86ba23546676e40df44838976f99cda5e5287728cede
SSDEEP 384:HKxMULvG6G4VZpnKkdU23ZaDwiCHFbkB1aZc5OTSqwyFEoQoFkze7/YT:H+MyVZxUgaDwiCHO/ASqw9NIkzO/YT
TLSH
T130A2E1647F6F6248FA787235BCC153A45DAF3067B1025456B7E02393CB929A00D8BD7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 36KB
SHA256 9d1ac6865e4ba78d64acb5316f123a17a0840cbd8439415a8a66440697524e99
MD5 1ebab08781dd6eebbe312e6f97f6e26a
SHA1 e70a14ebabe5d90f7c1f06fb6a91e787575a6268
SHA512 229429cf523862e6c2a4ce2635580e03adc37161f4af6cf24d2f8746310da0e9d23ed407ca9e9c67e8b9c7a383690162f61052671b98a601f7ba4c2d329a01a9
SSDEEP 768:fVxAgVCdMLMaANl5QvyUYSYx7s/irNB/U/ZWuIXvVxZEbgHUo+Aw0TMjKueJRdJP:fjAUCdMLVWCvyU/Y5QqNAZWuINxZTw0D
TLSH
T152F2F232F0E237990F5A7F6517C24E0316E778394F0D6F0926BA58A87C52F1A8DBCA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fd48075-e816-49cc-844f-08076c2e211d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1fd48075-e816-49cc-844f-08076c2e211d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.surveymonkey.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.surveymonkey.com_0.indexeddb.leveldb\LOG.old
Size 361B
SHA256 1ee0a2385f66a057026fbf226a40b6f18070ff7cf3f2fc2342b371b2db2271ad
MD5 7ef0e92743e81fd332f397763d531078
SHA1 51d680ab787bf52036eb0ade3a35255294318bf3
SHA512 b528be83fa52f1e3e8aceef4995e34842f59add08e44f1807e623bf929258cd7ec6f039d2cdd36a1cb9a157bad377f800dfda4ef44e8cf16bf2475bf8c762d4e
TLSH
T1F0E0686C81C9C61F12B424D324B0BB0A9393211F9BCCBD4E0F68D804B4864C8E02D2B0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.surveymonkey.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

62986468-c591-4c88-b89a-a2a9fc352cc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\62986468-c591-4c88-b89a-a2a9fc352cc7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8516e678-d489-426c-9347-e3b6962c2fdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8516e678-d489-426c-9347-e3b6962c2fdb.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d90ab4d5-f5f1-4a02-bac7-02f632b9792d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d90ab4d5-f5f1-4a02-bac7-02f632b9792d.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1d47bfc53b2680b0aaa6df7f0a52b66d93d68922214dcc97533f5eceaf5d62d6
MD5 ae6861d9b13ff1a4525261f88e5a52d5
SHA1 0400911f95b838d5fc94cf4a48603ae920099fcd
SHA512 d6d7c9a59c93f5abcb19b0fd4f28e05c3a6914336d12fbd0157986ae46a62ef9b97c283fb23c7a44aef5337908253bbb283107cb9d54b4ea0939405d06979bf0
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL+5UY28slbQ3YISwlK9U1mlxe1YPQmL:KYduKGwC2JSK60F3OKk8iqcAKtu9
TLSH
T10FA10F0831BB425079BE399C40B49A1A468235B33119F57FBFBC84A74E6BE145DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bab1f324-7f74-445a-9f0a-0b2f851efaa1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bab1f324-7f74-445a-9f0a-0b2f851efaa1.tmp
Size 11KB
SHA256 6107e4d32b0978c2cd208998b645decf0a8fb2fb19f33a181a42bf028c255abe
MD5 a809ffe140532048082a083c6e7c39c3
SHA1 fa277fceb5062d5e95aaceaddbe4f348a8d1b518
SHA512 17080dd9401b38705a0053c91e690527cd25546fa789e4b90d318863f712da3be8e97997ea1a89d48866d3fd0559875419b96c2d665b5473bd8e16ac7e464cb5
SSDEEP 192:sxZuRsW4/fVskR4TqdpdKJHW6+WNU2fWToy9t/Ya+PAAdPIg51J:sxZuN4/fVskR4e0HbvY/0vF
TLSH
T12232D952A934597B4CD7D20ABA24BF17E6F5503291D01E48AFFD8A1C05E77DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8ed590e-becf-4113-8a8d-11328b47adf8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8ed590e-becf-4113-8a8d-11328b47adf8.tmp
Size 27KB
SHA256 2db22e4b56a0472a5c01e120c00465747e2352837eb1bd2a14f6a089a290848b
MD5 bd6b567deb316785d3e72dba84c7beb9
SHA1 31bec140f76b01f880ca88d41c70f9feba67205b
SHA512 d220f9f6313d116aedafa3c83601e10b36b53713cf93de1ac9086cecd9b9a03303bad25e4b78c21302769e98db23bfd8588517bfdcd8dd0f84a066e91bd1a20d
SSDEEP 768:o5yQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3/roqZQDF:o5yQRbrWvvlpZu1jaXKLf33sqZWF
TLSH
T16BC2E93B640CCB7E5FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eefde65c-2c49-4774-b23f-a7a092796d54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eefde65c-2c49-4774-b23f-a7a092796d54.tmp
Size 10KB
SHA256 a84e3bde0b5914054bc790a3471665ab1eb02a9bfcf12d0aa50c6c1ade7fe605
MD5 f99d7bdc62356ca9c4f40ce3c9e0db45
SHA1 42553918632ced3edd286de817fcd8b3fa6597ba
SHA512 24b2b451a8325496c5853014ed65fabe55e5065e063fb8ca2b228b9d5e03cd1daaa891260708a564c8ec146811eb4e244f99127f38a4339b2ccbd309d367a763
SSDEEP 192:sxZuRsW4/fVskwsTqdpdK8HW6+WNtfTo/YaCPAAdPIg5nJ:sxZuN4/fVskwseRHbC/uvT
TLSH
T14622C812AE28A57B4CC7D20EBA14BF53E6F5503291D01E88BBFC851C05E77DE220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6fe137f08c7f3d541f000cb67d78e1d4e9cd7f95866817e36155806b103eb34f
MD5 d37be786a623852252349549cbcb08af
SHA1 b6de4d58eed4a7ec85b06fa46be865c5b3170f28
SHA512 dffa3ccc24b38c2f8e572814d6588d989b00e78403f9612637830cfb7f4368767880749b787215d30fd7f128b89ad93767c3c70b57193e31c0a42e07f856be38
MD5 SHA1 SHA512

Submit Download

d3454e1c-6010-4fa8-81a2-3b26ed50313a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3454e1c-6010-4fa8-81a2-3b26ed50313a.tmp
Size 18KB
SHA256 6a7405ff04ed819abc19751b0f65a99735e4765d15e5dac67336e3d563debc00
MD5 3e907ca943c5cd89b4b34e802bad5335
SHA1 b516fbc5b6cee629b3a3f439bcf7ba9f576bdd27
SHA512 8e9da16ca2b19e6067c15c8d2d0526fc753b7ae113c635a526f2f1f1439f5f2e71920ebfcd681dc70fea788bc9758d5eaf7641fd7a91f6127004a471d68bf361
SSDEEP 384:bQkUSv0sNE7gbSc5/p5u8i4tk7dvVfZBblL:V04DXkZ7vZdlL
TLSH
T14F828E36ACB86C3B5DA7A541F40B3603EFA48567D7C41F94CDDDAB2D02DB2982307616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5270d6b5-9c29-4348-9264-589cc1d7c5d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5270d6b5-9c29-4348-9264-589cc1d7c5d3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c65c981b7c013416be39b9e2f0768ae732670e7ac0ad85d4ee5c81c87b84227
MD5 acbb5236cced6a5522469c4b8bb97e5b
SHA1 50302a0b8c10a1a5099c551f03ac4682cfe877f5
SHA512 74f17ebc09da21940a95ea6baa62191c8fb85a08c1b134eb19d0365fd1c54ecbed82be701da34ad0ff7458afcbe97db64fbc12cad123057792d86907b149a25b
TLSH
T1BC412668B6F91104B377AE16AFF6B86D887E7D771F07955E00010D4F0A22A80C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads