hxxps://b0prvktm[.]r[.]ca-central-1[.]awstrack[.]me/L0/https[:]/intranet[.]groupeldl[.]com/fr/portal/access_link/303e9636-9ea4-4a8d-b999-6ae23bc0b18c/1/010d01a1d4cdafa8-94d73387-5057-471d-9e34-2111b858e3f6-000000/Rl1WS6hUWXJLQmifgcuhj5cJ1_g=258

Analysis

user interaction
yes
max time kernel
34s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://b0prvktm.r.ca-central-1.awstrack.me/L0/https:/intranet.groupeldl.com/fr/portal/access_link/303e9636-9ea4-4a8d-b999-6ae23bc0b18c/1/010d01a1d4cdafa8-94d73387-5057-471d-9e34-2111b858e3f6-000000/Rl1WS6hUWXJLQmifgcuhj5cJ1_g=258
Sample261113-tp552sdv5v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2308	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{B444E386-5D73-4DA8-A99C-C75B8B94AAF6}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 6044	2076	msedge.exe	86
PID 2076 wrote to memory of 2308	2076	msedge.exe	87
PID 2076 wrote to memory of 3676	2076	msedge.exe	89
PID 2076 wrote to memory of 3676	2076	msedge.exe	89
PID 2076 wrote to memory of 448	2076	msedge.exe	88
PID 2076 wrote to memory of 448	2076	msedge.exe	88
PID 2076 wrote to memory of 448	2076	msedge.exe	88
PID 2076 wrote to memory of 2248	2076	msedge.exe	90
PID 2076 wrote to memory of 2248	2076	msedge.exe	90
PID 2076 wrote to memory of 2248	2076	msedge.exe	90
PID 2076 wrote to memory of 6040	2076	msedge.exe	91
PID 2076 wrote to memory of 6040	2076	msedge.exe	91
PID 2076 wrote to memory of 6040	2076	msedge.exe	91
PID 2076 wrote to memory of 2380	2076	msedge.exe	95
PID 2076 wrote to memory of 2380	2076	msedge.exe	95
PID 2076 wrote to memory of 2380	2076	msedge.exe	95
PID 2076 wrote to memory of 5360	2076	msedge.exe	96
PID 2076 wrote to memory of 5360	2076	msedge.exe	96
PID 2076 wrote to memory of 5360	2076	msedge.exe	96
PID 2076 wrote to memory of 5080	2076	msedge.exe	97
PID 2076 wrote to memory of 5080	2076	msedge.exe	97
PID 2076 wrote to memory of 5080	2076	msedge.exe	97
PID 2076 wrote to memory of 4880	2076	msedge.exe	98
PID 2076 wrote to memory of 4880	2076	msedge.exe	98
PID 2076 wrote to memory of 5160	2076	msedge.exe	99
PID 2076 wrote to memory of 5160	2076	msedge.exe	99
PID 2076 wrote to memory of 5400	2076	msedge.exe	103
PID 2076 wrote to memory of 772	2076	msedge.exe	114
PID 2076 wrote to memory of 3428	2076	msedge.exe	115
PID 2076 wrote to memory of 2944	2076	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://b0prvktm.r.ca-central-1.awstrack.me/L0/https:/intranet.groupeldl.com/fr/portal/access_link/303e9636-9ea4-4a8d-b999-6ae23bc0b18c/1/010d01a1d4cdafa8-94d73387-5057-471d-9e34-2111b858e3f6-000000/Rl1WS6hUWXJLQmifgcuhj5cJ1_g=258
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffddd09c188,0x7ffddd09c194,0x7ffddd09c1a0
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,9859417175218922446,2433393184535620440,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,8389907854783207078,401036047164233839,262144 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,17053776458575233571,16643377623141534479,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9788632254761043406,16286755413319390428,2097152 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11193704908184217344,15261395213554950117,2097152 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4840,i,7808514501135959513,17232305257287261040,2097152 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,14501116143331806928,16448605051333921217,2097152 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,4352586649533599692,12981429397703583319,2097152 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,7497667776629499245,9899971795541487336,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2258763958092364685,3570633816283676819,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,4368307730435718223,11251476932373403119,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,4368307730435718223,11251476932373403119,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,2155581308240320720,9379193936153589957,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6924722203838322278,8036527685822096673,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,5943985919641714524,10608795344647464294,524288 --field-trial-handle=2472,i,12967783976916636935,1750583030251825238,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

42b1a98f-41c1-4711-ba38-d893d1f2d1b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\42b1a98f-41c1-4711-ba38-d893d1f2d1b0.tmp
Size 25KB
SHA256 30569ff543ac3d4d71415fae962e1c1f4d7e60e82c21e5ae33fa756655143f0a
MD5 96dde9e71fe3352f8a95b1603116ea5a
SHA1 13be6ad0b37536b416f16f1c70a90111624d6885
SHA512 02b4dc92ce22ef861d4d20264145d3d3bb242ee8f19ca752c79bc06ce259a98fe46f7dc848c89451267b3e3536ef5e1a617f1b0afb3707d78e6a6765f047ec0f
SSDEEP 384:nYiFiZcI63sN/8TUNTUlIm2aKMij4w2fiBCWrBP9RF6sa+VY68gL/7IzuoA:jFQ63qwgccnBCgBPvF6hgpP
TLSH
T130C24936EC98D9BBE8EB4FD6AB4A7A03EEF4016395DC5AD4D9D81D1C108359D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71d0b551-e7c5-4f7a-9679-cde03b8f1553.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71d0b551-e7c5-4f7a-9679-cde03b8f1553.tmp
Size 26KB
SHA256 a2d9f5d5f4151c24373ae5bc869259f15713e794275d0bb8fc9bb762dfcf5f95
MD5 3b79f5b2586c1c16bc712d91f0c53a34
SHA1 496133ef40521bac3afb67f927e0a35b551ffaf0
SHA512 9bb7cfe06f4715d3eb6499ddd1b3a6e4f1793064f0660acbae5d30506935e8eb8f1ad3e4989140ca4db8218f3a0bacb785d3280d3e4bb0c828aa85436350ab41
SSDEEP 384:nLiFiZcI63sNc8TUNTUlIm2aKM9NDw2fiBCWrBP9Y5+Unifsa+VY68gL/7IzuoA:mFQ63dwgcdcBCgBPIrnifhgpP
TLSH
T18EC23A72EC98D9BBECE64BD6B74A3603DEF4426385CC9AD4D9D81D1C00975AD034BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

490c7a04-77ac-4f61-be85-36369f520d97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\490c7a04-77ac-4f61-be85-36369f520d97.tmp
Size 11KB
SHA256 e99ca7a98a2a943026873f234b33d13c80a32b48c3a35e578d96c7a114f44c3a
MD5 fbc40b3fd65876debabcb3ba2c9c5cfa
SHA1 27249ae60926b018f2171834d8f31ccc9186884f
SHA512 f238c3ced1faf7bb838690aeb9801b9c244896e060560893bf0e6f61d7dc4afe783674d97461659cb4a8aeea064d6fff3e8bc85b807d2191d11c2b318535a3f5
SSDEEP 192:sxZcRmkJ/fOs3+aQZLp+8HzodplYHW6+WNGYorecSFvIg5btFjJ:sxZcTJ/fOs3XOtlM2HbGlSp5tFV
TLSH
T13242D7556D28A93B9CC7D219BB55BF53E3FD103390910E48AAFC8A1C15EB6CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4eeabec3-ed81-4a8a-99b8-b44a613d9ff8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4eeabec3-ed81-4a8a-99b8-b44a613d9ff8.tmp
Size 414B
SHA256 f4cb4a90b904d65a228921b3b67552b4af237d88af24c872008cfb832d8b5690
MD5 d1e6e06e0cacaa0a129b0eaeb1cbc023
SHA1 dbeca1fb577cb8855c0b9810a7bbd5e5bbebfd2f
SHA512 f4363a80b303e4615636c76bf62505dc2e0aa1414bb6b129ba734a30f2fe731aebde1e51131ad50e67460650369b301bc3a7fb4a9046719d92b225904bd9c5eb
TLSH
T14FE022AACC21EC3B18FD1B7960944A45EF41236B2E409C5B3B3E91088FB1637458686C
MD5 SHA1 SHA512 TLSH

Submit Download

5701f684-33fc-455d-a0c8-122e337add6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5701f684-33fc-455d-a0c8-122e337add6f.tmp
Size 11KB
SHA256 2d78e7f426d0bf8735d4cbe4b79eb0df8ba928e040370233653f1704a45c5c20
MD5 2d1f53a570fc3965c7062264430471d0
SHA1 cbea73115a1391cb3b47f1f1f42ba80087b262fc
SHA512 05d90ccab2624d98cf7df40c25d59c39b2e8f2f64806a6c7e95b2424bb5e91f8013392373aa43ddcab5856dbf62b060c0b91b6310be76b6e491bc0cf1b31a49b
SSDEEP 192:sxZcRmkJ/fOsj+aQZLp+8HzodplYHW6+WNGYorecSFvIgjtFjJ:sxZcTJ/fOsjXOtlM2HbGlSpjtFV
TLSH
T19D42D7556D28A93B9CC7D219BB55BF53E3FD103390910E48AAFC8A1C15EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

789c30a0-6dd5-4845-8d43-8dbe9b0a5300.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\789c30a0-6dd5-4845-8d43-8dbe9b0a5300.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9a92fa56-cbe6-4503-9167-2302029deef0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a92fa56-cbe6-4503-9167-2302029deef0.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a45f94f-de4f-40ad-98ab-cbe932488648.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4a45f94f-de4f-40ad-98ab-cbe932488648.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

74e29723-c9a1-45aa-8e91-29a6fb83702a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\74e29723-c9a1-45aa-8e91-29a6fb83702a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e8338beb2e2aa5118075ae93de20f28afd2b591036116245b9dfef12d4390c50
MD5 ed57b090e61798fd8343ee3da7663856
SHA1 c317ee51ed23c516d04da3b3151d6910ea4ad008
SHA512 62544ea05b1e20e8831b13030cd76f7e1f7899a5a2b37eb19b0b7254de708aef648d0ccd4e99c29922127c633a1b336c10f1cdf3059f14b11850240fa2e6505b
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgv:ST/2dXOJhJlpfnpp3tNXVrN3GVL2
TLSH
T16AB2221571BB421039FE391892B69B2E064231733119E66B7FBD04B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b32f00c8-af8c-4e0d-a34d-1274974c1553.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b32f00c8-af8c-4e0d-a34d-1274974c1553.tmp
Size 26KB
SHA256 674f35d7cdbefe134656129a0567ac17a077dc984041d0ea9a2f810d67eb6a63
MD5 081e832b25fc1aa71503801ddcf60b01
SHA1 bccda479ebc8f68431ca797cd2f067b599878e8c
SHA512 de381fd6df48df464474e706e04030c19ebc5863c430c30407c57cf232639473115d418825fcc9d06ec4406ce210f43030772126d388127413dd94034f08634a
SSDEEP 384:nqiFzQkUSvF3sNY8TUNTUlI43aKMvMyw2fiBCWrBP9Y5+UIifH7vBEOt2gL/7IzB:hFdF3NwgtuNBCgBPIrIifH75EwlLW
TLSH
T118C24936E898DEBBADE64BD5E30A3A43EEE44263C98C4AD4E9C91D5C00875DD134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 980ae5ca9be5dc44812b2ce5c7b82ffca97d7f64636f1757ec53c8fe2260bcbe
MD5 7b60282c0f58bcc714237899e5ac0e73
SHA1 4f3996ad7f1c78b8c4fe18366fe1f9b81387b477
SHA512 074a8d2ea5cf1ee9a7f830f6bd90eedcc152db187e02b13307f0e3994993615ac1ba6fc5060c14af0b48048fc8bdf8259282786b67c2a4139f00fe6d6050713f
TLSH
T18B411898A7FA1108B3B77F56ABF6686D487B78772E06949D10010E4F4672B40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5400-203-0x0000028D3F150000-0x0000028D40150000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads