hxxps://fun[.]asztal[.]xyz/

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fun.asztal.xyz/
Sample261017-sdznfsfe53

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
88	discord.com
89	discord.com
117	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3708	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{9885B412-2405-40D0-966C-F4E76BE56F86}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{B9DEA18A-A6D3-467F-BCA5-9F3D42E326F0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5644	CredentialUIBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 632	4220	msedge.exe	85
PID 4220 wrote to memory of 3708	4220	msedge.exe	86
PID 4220 wrote to memory of 3772	4220	msedge.exe	87
PID 4220 wrote to memory of 3772	4220	msedge.exe	87
PID 4220 wrote to memory of 3772	4220	msedge.exe	87
PID 4220 wrote to memory of 3936	4220	msedge.exe	88
PID 4220 wrote to memory of 3936	4220	msedge.exe	88
PID 4220 wrote to memory of 1032	4220	msedge.exe	89
PID 4220 wrote to memory of 1032	4220	msedge.exe	89
PID 4220 wrote to memory of 1032	4220	msedge.exe	89
PID 4220 wrote to memory of 4736	4220	msedge.exe	90
PID 4220 wrote to memory of 4736	4220	msedge.exe	90
PID 4220 wrote to memory of 4736	4220	msedge.exe	90
PID 4220 wrote to memory of 2100	4220	msedge.exe	92
PID 4220 wrote to memory of 2100	4220	msedge.exe	92
PID 4220 wrote to memory of 2100	4220	msedge.exe	92
PID 4220 wrote to memory of 2076	4220	msedge.exe	93
PID 4220 wrote to memory of 2076	4220	msedge.exe	93
PID 4220 wrote to memory of 2076	4220	msedge.exe	93
PID 4220 wrote to memory of 4716	4220	msedge.exe	96
PID 4220 wrote to memory of 4716	4220	msedge.exe	96
PID 4220 wrote to memory of 3812	4220	msedge.exe	98
PID 4220 wrote to memory of 3812	4220	msedge.exe	98
PID 4220 wrote to memory of 924	4220	msedge.exe	99
PID 4220 wrote to memory of 924	4220	msedge.exe	99
PID 4220 wrote to memory of 1600	4220	msedge.exe	101
PID 4220 wrote to memory of 3520	4220	msedge.exe	106
PID 4220 wrote to memory of 4496	4220	msedge.exe	107
PID 4220 wrote to memory of 3520	4220	msedge.exe	106
PID 4220 wrote to memory of 3520	4220	msedge.exe	106
PID 4220 wrote to memory of 4496	4220	msedge.exe	107
PID 4220 wrote to memory of 4496	4220	msedge.exe	107
PID 4220 wrote to memory of 5104	4220	msedge.exe	109
PID 4220 wrote to memory of 5104	4220	msedge.exe	109
PID 4220 wrote to memory of 5104	4220	msedge.exe	109
PID 4220 wrote to memory of 1708	4220	msedge.exe	110
PID 4220 wrote to memory of 1708	4220	msedge.exe	110
PID 4220 wrote to memory of 1708	4220	msedge.exe	110
PID 4220 wrote to memory of 2700	4220	msedge.exe	116
PID 4220 wrote to memory of 2700	4220	msedge.exe	116
PID 4220 wrote to memory of 3116	4220	msedge.exe	117
PID 4220 wrote to memory of 3116	4220	msedge.exe	117
PID 4220 wrote to memory of 3116	4220	msedge.exe	117
PID 4220 wrote to memory of 3612	4220	msedge.exe	118
PID 4220 wrote to memory of 1644	4220	msedge.exe	119
PID 4220 wrote to memory of 1644	4220	msedge.exe	119
PID 4220 wrote to memory of 1644	4220	msedge.exe	119
PID 4220 wrote to memory of 1148	4220	msedge.exe	121
PID 4220 wrote to memory of 1148	4220	msedge.exe	121
PID 4220 wrote to memory of 1148	4220	msedge.exe	121
PID 4220 wrote to memory of 3304	4220	msedge.exe	122
PID 4220 wrote to memory of 3304	4220	msedge.exe	122
PID 4220 wrote to memory of 3304	4220	msedge.exe	122
PID 4220 wrote to memory of 1964	4220	msedge.exe	123
PID 4220 wrote to memory of 1964	4220	msedge.exe	123
PID 4220 wrote to memory of 1964	4220	msedge.exe	123
PID 4220 wrote to memory of 1584	4220	msedge.exe	124
PID 4220 wrote to memory of 1584	4220	msedge.exe	124
PID 4220 wrote to memory of 1584	4220	msedge.exe	124
PID 4220 wrote to memory of 1420	4220	msedge.exe	125
PID 4220 wrote to memory of 1420	4220	msedge.exe	125
PID 4220 wrote to memory of 1420	4220	msedge.exe	125
PID 4220 wrote to memory of 5100	4220	msedge.exe	126
PID 4220 wrote to memory of 5100	4220	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fun.asztal.xyz/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffcf3b4c188,0x7ffcf3b4c194,0x7ffcf3b4c1a0
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14168250658635778536,5545070119121353313,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7238597276880583142,10027317937790632733,262144 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,3618860431054108746,10132714984525355706,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,18145621457363296242,1092541554122348861,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3268,i,7615800200843179489,1789833543653571556,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,33550276686352505,7156853306046348110,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,15318549559709330981,8964855026485249658,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,1179433718061310900,1552703516488698918,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,18096218651275282145,11510220711623650944,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,4257612497047985991,16964796723028130773,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,3920103773364264072,10751177396874134354,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,3920103773364264072,10751177396874134354,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6328,i,10102530039321474976,12153936088074343401,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6376,i,13317422170604869307,1345099107967684796,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7268,i,409065112314590357,16131294531478211336,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7248,i,14618040650982908669,7164207176439685258,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,5311634970095681683,18381354964795403546,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6932,i,1725716683933019000,7316649159368052791,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,5163996188023046909,7676167928988803562,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7680,i,1520583232005278983,2232689995552303417,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=8412,i,17242814458563052808,3826240909738503094,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=8456,i,5094160060342155648,1289172450054213402,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8700,i,17971965233837158345,8272888434620289364,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8712,i,7033759317929667520,5019066658497618106,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8696,i,9971039848159876705,8632176730818864541,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8956,i,1787201648727564351,3388543853536776687,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9284,i,2575508745716731555,11995711226531321141,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=9360,i,13210852186964414327,4807836959560826837,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=9372 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=9752,i,3903243861362586317,4537386430623134714,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8276,i,18074746577384703141,4158403665148717559,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8300,i,12555452745433702538,1760591045786634157,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8296,i,9497669994252725416,7599090236080272935,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=9896 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8308,i,13575722953413027841,18027962056227832271,2097152 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=10224 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintCompositor --lang=en-US --service-sandbox-type=print_compositor --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,12250295674493905315,14052818890153966521,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,8996910321002526341,8928357726378253056,65536 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:3
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,1216482737810706859,15488150652726365606,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11030674253503528151,1183832331381771552,524288 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5372,i,8265468413620554601,1289398758881945061,262144 --field-trial-handle=2568,i,1600463335151755482,17535932954470909498,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2616

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384 0x464
1⤵
PID:2140

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13f7d504-0e1b-4a14-b33a-f4f9f13084c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13f7d504-0e1b-4a14-b33a-f4f9f13084c9.tmp
Size 18KB
SHA256 1f0aa3a0ca2ce4342f138c7a05095c2c9bae2d2b8b49f629b83c27f19a4f6d4f
MD5 626bee82cfc654f5599404a3ba0516a5
SHA1 9f55dc1560e607d7e429a8eba84fbb48539d4b6d
SHA512 5f06c77aa73b59c46987882c450c5368ab111389810bc58ae2dbb77dacf58611ca60fed193cd5a2a0a148bb23ef2e7d02d82ac8590957bfaceb88586dd047920
SSDEEP 384:jQkUSv0sNeDBZ2cPuHX58EMOzAAsYMT/sIIlR:N0jBAaHOZsYMT/sLn
TLSH
T1F9826C32A8A8AD374EF3E255F65A35039FB89027D6C42F94D6CDAB1C01CB29D2307907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

638b6895-fcac-4aa6-a563-a1a7d9537292.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\638b6895-fcac-4aa6-a563-a1a7d9537292.tmp
Size 8KB
SHA256 182f7319091c2e666f5aecdb5a24851785141bdd275fcbc9159812cab78f45ed
MD5 71bb7a8fff58e5738729b5bdaaf94da6
SHA1 5fe49f90d6a5f87ed4b3c69f97ddfa2f60d63c64
SHA512 11a0fc102ccf85aa40b841fcf06427c0ff3d8cf3f2bf8fc02bc528d3e9801b977b5d442c78115d922a782716a439af1ee1f79478902e8181b3380601c032104f
SSDEEP 192:dONv6wlDfQmiUyHLy4X58gZMOKoAA7ve3OqLAU6:dONv6khGy4X58EMOzAAqYU6
TLSH
T19D120A31B9A8AC3B4EE2A545F58735039FE95127E7897FD0C5DC2A2C01DF6AC134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d58bd44-217c-40a8-863d-ea83a6aaae7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d58bd44-217c-40a8-863d-ea83a6aaae7c.tmp
Size 8KB
SHA256 447516cfea2b3e8f77cd90fa53aa4253d21ae1ed368f268fd7e9b6f15b3fd678
MD5 a717dc69ca14d1dc0729fd1cac1804b5
SHA1 fde232ee7f530b2cc2b4278fa982775b18494c1f
SHA512 48e2df6c065d5d9884c58e724abb5e7a7c59a6bfcab90eced5711d7b0bbbdcba3732996a2825b35b87fefa66ad01eaa6d96310dab028cf600e4a3750e701ff36
SSDEEP 192:1ONf6wlDgQmiUy5LW4X58gZMOKoAaDl3QqnU6:1ONf6kgSW4X58EMOzAqPU6
TLSH
T13102F935F9687C7B8EF2AE09F58B27139FE4102BE5552F84DAEC1A2D00D769C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 49ad6872da0e53fa2156de2ab29aae15d756e399214100166ee3b981776c9e71
MD5 ec47d7bcfb6fcae0bf0c2b01172a50ce
SHA1 20474467d868ddc238b4a6f05bd8c60a9a69235e
SHA512 38fc241b6dcada0c5d074fcd3a03d2786292deff2b4e86af77e745f823ab3f7a20920fec3c454838305c94f586355a5c360fd844cb107f4a9279878245548c61
TLSH
T19FD0807175273DFDD19D667C05515A405104CE53595115108A134D551E9C6C27CD3EDC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

4a73c79c-79f8-4c6c-be5e-e6b522d5840d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a73c79c-79f8-4c6c-be5e-e6b522d5840d.tmp
Size 9KB
SHA256 fcf4282a8592aac9be92e268d3b7c48641da16edc7770043ef78dce087ccfcfc
MD5 84ff66eef189b655c05428a334344aa6
SHA1 dd1a8363a5ae79d92dfbd93f1ae4ad9db3646504
SHA512 0151f95d4f3c500c1303112ae4d2989c86926808755e58e968a210b372785c6ef332df751a4545651f5de9bad9263cbab88f72e66775ece0e2456cce87b5405c
SSDEEP 192:sxZ9R+WJ/fOs0rIdpJTHW6+WNTBu/YrIk/NIgrJ:sxZ9/J/fOs00NHbo/M9
TLSH
T1EF22B9526E28A97B8CC7D20DBB55BF13D6F9503261D41E54EAFC861C05EBADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ee3ca4f-26f2-4540-abb1-96f7f32c6968.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ee3ca4f-26f2-4540-abb1-96f7f32c6968.tmp
Size 72KB
SHA256 280f944bf0bbb061a48412485074694ac309b872a0536b6f515099eeaab91f22
MD5 2eeb4136c6d8e2a46c0cf6fd5020af00
SHA1 3a1e2020d7c8137bf8b4b804af28665c5d34b201
SHA512 6922a6ce36c63390856386ee5cf9dc67572e81c4a3e95fcec4e4f7449f835ec9ddb3d2a2364a5684ed2fd5bb941e7126d885ef2706e97939c38e9d62625dfbbf
SSDEEP 1536:A1y4J/DWvbtJhu1jaRmpgN2xK+MrHuDBJjqQYXf8TXijNRv0v6JBUgP9NsscEFKm:/O1jaRmpgN2xK+MrHuDBJjqQYXf8TXiB
TLSH
T1A573BF19304B4C7E4F401AED59AA5FE6397C12C771346A40E7EE9D88126E3DFE9280DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

856b10f5-e574-4628-9ddf-9c436871117f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\856b10f5-e574-4628-9ddf-9c436871117f.tmp
Size 11KB
SHA256 f61d806e65a5d336c5959b5bac5e1d9d099802759f6f60cc66ce21dfde7a387c
MD5 ee7c1bb40cab10fde313e232a09b499a
SHA1 76cb5305d60d1967d6b3e5c3adaddbf5a2f6cd12
SHA512 ed0d7021fc1da4ea1ff0287abf92e3d61cd08d5cefe42f3c058998e901726266e2d040a7d86d4247049d3d9413053279e38310ad880a3804f586987f69dbb1f0
SSDEEP 192:sxZYR+tJ/fOsrrIdpRYYTNHW6+WNTeFhYrd0/NIg5JJ:sxZYsJ/fOsr0CAHbohfZ
TLSH
T19032C8516A28A97B8CC7E20DFA69BF13E6F9503161D51E54EAFC861C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a7ebcd1-e258-46a8-bbdf-c03b0f537981.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a7ebcd1-e258-46a8-bbdf-c03b0f537981.tmp
Size 10KB
SHA256 d228ba9ec41103a93dec6858ec7c7bb7a43b5e82559f932c561eafc9574aed62
MD5 4462188adce26a8174f233c2ea53d3e0
SHA1 fc13b8ddec8286773d302e2d2e5f4d862b8dc8cb
SHA512 8d228e7099080ba3ad1a2fe4d2a40d195d5aff573fbc9c0de37036126cc20a6823e3a33f702f5a3f259df4508dfb139de2145a1111256001872c6fc97161b216
SSDEEP 192:sxZYR+rJ/fOsrrIdpJNHW6+WNTLglYrzw/NIg5JJ:sxZYcJ/fOsr0THbglrZ
TLSH
T1A822B7526E28A97B8CC7E20DBA597F13E6F9503261D51E58E6FC861C05E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f20e52155d210719be631af2fe01535447a45e2a6a713004170c948c9669593b
MD5 b1e0b89ad17916b8fcdc21eff292e39b
SHA1 551959ea0c797637e98014b19c3bad923d5471cc
SHA512 9f7749ec07c891c8ca92fb2ec8d5839d46f02ffc8a7a0c00b7fa6c7b028e5aa217b895b1dbcea6a41caba1b21fcfedb012fff40ffa01fc7bbc7aefd0e2ef7bdd
TLSH
T15AE0208405CFC21FD34965C702586F0CA391261F97C06A4D1F04C544F14E744F6D3590
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 128KB
SHA256 ec0e1345ef5461376becf98d07fd0f62230491b017e046fa4c98676813d14325
MD5 81c72a345442592a1270cc464173de01
SHA1 18bc0ef446d23143de77c9c67231df867750048b
SHA512 554d5789c54f57bd6ba21fc3d3b07b50ea2ca100068712a5170bfe9f554096bf73e930d20a8ca7e5acdadc81f3e125f26f189112c13309cb9032ecadcff9b64f
SSDEEP 3072:aTy/0D+r7Fr60WbvhomEItcDxbBHy8/layw/AAWC7:uZW7FrVzbxtvwaC7
TLSH
T15CD3F1F8B495197B49606FAC165F968E424E31F9D38C3B01C81DA5AFB63EF72841D228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 603KB
SHA256 16fc5fcddf2a4ce0835a40d54183698fe6e150acada604f174a3ba8eeaa53e78
MD5 fc3f35fb26d07c1ca6bf1d47148bc846
SHA1 8a8a6b1e32cf0237cd4e7e5383f3d9d8a62e117b
SHA512 72f1d432e5f0777f2197e164dc2c4bd30d5e86f6d0bd958bcdc70ba717117dde5c706f1ce57750715c7fb640e380de3546840ba4cbae3042f26f265acbb971d2
SSDEEP 3072:a8MAxpYf44Hx+rFl8V9k0l7abzU1R/G2heJPiHVB0D4kw3VbmMG7QSj:dxpA44R+rQhl7DrheJPWVq4bl6MUJj
TLSH
T190D4028C7776620BD9A323B0A0D4B30D3A34C2E13B4B31AB155273A69F793E99F451D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4810ea873e3c33497e3d6954a93c2ea30154406776b2642170923207811f960a
MD5 7082698cfd4611296bf639a00d8b36ff
SHA1 c0a983163a7bfe899b68472e5179908078c7d69c
SHA512 de73db042e4038a8c3e15ac41850a8f220dbdd3a97dbdcb178e3a65c495e8cc361c11eb182e0013b8cdcd47d35cd075a35633b592acaf4c125c0758abf6b30e1
TLSH
T1ED71DCA8CBA0407BFF96607091DC148735FD428AA7AFDF5A12B9FCB99F0A3967054214
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3e099776f30a353952d2b2d82aaab6776e4146b55c47a7a7f3900d59d4108241
MD5 d0d1ffc370d2c46cb549fbdc4668b173
SHA1 2f95ee0d1372ee4bc28b1bb157e39c6211976f14
SHA512 0d86b43ec7ad8e1e68718ab9523640055848863b90c2cdd9580abfb984d429cf4260debaa12691367f4dcd03353aa5893e72440893335132a4f063c89eb69df4
TLSH
T1D371EBA8DBA0407BFF86607091DC148735FD418EA7AFDF5A12A9F8B99F0A3A67054214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3fec0948e9723e5068d3bb2ed61097cd88acc57b6499de958a5bce5089b64fdc
MD5 6b7599a084544d9d0f995c62fcd15c8c
SHA1 3d9af082e3ca481026c4b896fdf19740169ea49a
SHA512 ff9dd64d1078976ceac8bee58a37cc13538fbd33972e270c56210c80af5c9b7de8137cc82fed2fbf58109cd8535a1041ad3b67d092de9afa55c87e213d9135f7
TLSH
T152611C88DBA0407BFB8AA07096EC108B36FD448E57AFDF5A12F8ECF95F0A3617044114
MD5 SHA1 SHA512 TLSH

Submit Download

91b11dba-c995-49d1-baf3-30e75e20bd87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\91b11dba-c995-49d1-baf3-30e75e20bd87.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

35e88477-c9dd-4f26-aa9d-9d03f20c39bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\35e88477-c9dd-4f26-aa9d-9d03f20c39bf.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a11090af-fa0f-4964-97f7-d7187decc10b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a11090af-fa0f-4964-97f7-d7187decc10b.tmp
Size 11KB
SHA256 c37ded5c8748371b514c400c22a1f8ce86a0d8c1ba0d390c3808d3a9881c3c99
MD5 683ac01da893d138f12bda677f6cb5d9
SHA1 2b3ba7102564b08c2aa6b164dc87235ce2fdfeda
SHA512 9004af0af8865021503b1e8f7b84506d87ba34fc0af2b6c2be84a910f96179e66f463e5a6825e57d5e09497b73c4bedd341dfedff11f42a3f7202a14a334748c
SSDEEP 192:Ds3QQG+Z09iB4MElGxW6n8j4I9s2V2ttYsy/e9evm9/gUwB1kG0ab7fhS6cuQajz:Ds3QQG+Z09iB4MElGxW6n8j4I9s2V2t+
TLSH
T1A9325CE783E5C63DFA0351F0BA68EE1BDE590614437C392E85D86E2793E18A1E50274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae86bba2-068d-4d59-a443-9499b90c5f7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ae86bba2-068d-4d59-a443-9499b90c5f7b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 817c013b1297213512e21ba8ae2d8c9dfc2837adc69602364e606f3a3d20c0b5
MD5 ee6a3769bfedf3e80015ca2f94299c75
SHA1 141e03833c6db83d80772262c345bec37c4c1d7a
SHA512 9ff91700fd7952cf9d5e048ba996181a3f4d9c26aa42c9cf699deb36dd374223ea4c1a2bd36863d3349ab7a8ca464480f0b8bdc1ddbd2021b89c2921a581c12c
SSDEEP 192:sxZYR+tJ/fOsrrIdpJNHW6+WNTN6tYrxw/NIg5JJ:sxZYsJ/fOsr0THb0tNZ
TLSH
T19C22B8526E28A97B8CC7E20DBB59BF13D6F9503261D51E58E6FC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 75316ed030655623e7ccf14e2a9b7234332bfdb1d202e803cf017f7ead813661
MD5 c8d69520dfaf93de710f3bf8a4778043
SHA1 20084a2d86f0e114de86c63af7ce0dbe7a9d6341
SHA512 4e4f782f2ea9f79524485d0fd0e69b37e7fb1fd4fe9a28e66083ecc9d055dd61f61b8ed01ee87d6de77142d04fb7fa37b18d04327666125e8e6ef17bd3768f6f
SSDEEP 48:KIDI1Ks04jyL2xMwuUUNb4PgISINK9s1uNxmdYHY02yLdcRtfLPwbD2jISlwK9l1:KIDCKs0+WheKiwKaq0Kzirs
TLSH
T17C912C4135BF020539FE2A8891B58B5F124236B77158E63B7FBD40A29A2FE045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b778bba7-c0be-4388-b19c-2b85c7c1d1ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b778bba7-c0be-4388-b19c-2b85c7c1d1ec.tmp
Size 9KB
SHA256 70f96e2bf93326919cd4df6726a88eca514dfbad66d8bb5559bfb548cdec62ec
MD5 bb12e3077d5050678650106f8136461e
SHA1 e99aa69c773b02c6c99ca3466081128bfb855d61
SHA512 a80152b47b39450ca51a7b0ef0a18c9f1a42e5d8768fe363260650fe6caef8e2a795f72c78658da5af4bd2219eff0097b84fca9b0000423be7f7e5dadd83b03e
SSDEEP 192:sxZ9R+WJ/fOsMrIdpJTHW6+WNTqEVYr3k/NIg5rJ:sxZ9/J/fOsM0NHb7VBn
TLSH
T12C22B7526E28A97B8CC7D209BB55BF13D6F9503261D51E54EAFC861C09EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbc5f099-2d0f-4d93-bf1f-b4850ec91452.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bbc5f099-2d0f-4d93-bf1f-b4850ec91452.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

dbe94c76-492e-47eb-9dc7-00998af2eb1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dbe94c76-492e-47eb-9dc7-00998af2eb1f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a08f6c00-8b78-4583-ac02-461560e7e691.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a08f6c00-8b78-4583-ac02-461560e7e691.tmp
Size 18KB
SHA256 52cf6a9c19df9d16e144857b21c59a3db8a6c2b239b01d93c844cb2b82657c3d
MD5 8585dddeed69e6bf5653c8129921607f
SHA1 78308ee9f2293fb3dda2e1f513f3b46af647f891
SHA512 ddbb262f5d127fa02b50de1fb06188c8a78e7e37e9c5ae55e007660d124ce3f6449939b193921532b3a76cfba8eabdd5dbc6e5aecaf0ca4b1cb493ebd5a1b072
SSDEEP 384:rQkUSvbsNeGBZPNPEHX58EMOzAAsYMT/sIIlR:lbyniaHOZsYMT/sLn
TLSH
T150827D31A8B8AD374EE3E245F65A35039FB89027D6C41F94D6DDAB2D01CB29D2307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e21eb62f-d4f8-478e-a48d-e4019187b0cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e21eb62f-d4f8-478e-a48d-e4019187b0cb.tmp
Size 26KB
SHA256 28dda15e81aa33f4c072811fe7b4de3fbc6660908db2b9859b3fea4ee081735a
MD5 17993b639d53fd331bf94539720fd144
SHA1 75b898a2eed12c6c6d74213e7d984c4f1dcf8d04
SHA512 e39d41897340e32e5ea2bb487e3f1b75e6844a36fc0bac7afee4c3e6768cdb91234f40d99f3715b896914d18274f3ec7f8e1b9f3aed52a4a6810f716625681eb
SSDEEP 384:RiFzQkUSvnwsNu8TUNTUlIlGBZPsPEHX58EMOzAAJYMT/sIIlR:4FdwHwg6yiaHOZJYMT/sLn
TLSH
T1ECC2E6F258D79D3ACAAE9743A77D2D038EBCD063B5845A90B3895A1CCD861BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6158b74-a047-48b6-9390-dabdb00a1021.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b6158b74-a047-48b6-9390-dabdb00a1021.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 091472e353de89fad700b92d45364c94941bb6c3827d543111b3743fc6e7e785
MD5 9f04c6cf4ce8160c5c780af554d35b0b
SHA1 f324c5af252f45f05e23c2cbf3e155427d80c2a7
SHA512 cc451c35660713042334dcd50bfa418f26c12ab41bae1fdbe398c0b9096b6e7b25312e4bd4bb30674498cfea7f55ba3f0a1de7bffb6c2eea550f3059a678dcf2
TLSH
T135412F5CBAEA1159B3B77E466FF7A86E847F79372E06D45E10110E4F0A62B00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

media_images_grubyptok.jpg.crdownload

Path C:\Users\Admin\Downloads\media_images_grubyptok.jpg.crdownload
Size 149KB
SHA256 f9197ec99fb6cfccca9b5ad6af20c455f7e0b5cf15c9baf197164b2e6f7bfe78
MD5 26a2c7b4bddada15f52a82e4b8a1a4a1
SHA1 12d0ffae14529df8e771db4fff4e13b6ba56008d
SHA512 b99c657f18d79b8154752d4c995d8c768bffd6a0358eb5be7c2cff9d26dd2946c59c64fd91d70fe8cb3417dd129d288c474626bebceb6b54d8566cb0c5d469c5
SSDEEP 3072:C2GgAUugk4mxDZnm1u6PMJW+vvRo/tx5vKqR/V+UyTA05ydd:CzLJxDZn2u94+vG/tx5yqZV+UyTA05e
TLSH
T169E3239E1D8A56EB659C3014E532128F76016BF919F460B900B8EFD4EC116ACF1E37AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download