hxxps://www[.]pacentalg[.]monster/TWuu1025?gad_source=2&gad_campaignid=24388197108&gclid=CjwKCAjw9PvWBhAxEiwAddzYycc7BmRGf9HYiMor_65fIgqPdOwyS2WnhBKdBezFnbVd-5lg_9m70hoCeLkQAvD_BwE

Analysis

user interaction
yes
max time kernel
298s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.pacentalg.monster/TWuu1025?gad_source=2&gad_campaignid=24388197108&gclid=CjwKCAjw9PvWBhAxEiwAddzYycc7BmRGf9HYiMor_65fIgqPdOwyS2WnhBKdBezFnbVd-5lg_9m70hoCeLkQAvD_BwE
Sample261027-h89rssch98

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1444	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{369B428C-5474-4DB6-A7DD-07E61AFA700C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1224	2240	msedge.exe	85
PID 2240 wrote to memory of 1444	2240	msedge.exe	86
PID 2240 wrote to memory of 4328	2240	msedge.exe	87
PID 2240 wrote to memory of 4328	2240	msedge.exe	87
PID 2240 wrote to memory of 4328	2240	msedge.exe	87
PID 2240 wrote to memory of 3060	2240	msedge.exe	89
PID 2240 wrote to memory of 3060	2240	msedge.exe	89
PID 2240 wrote to memory of 2848	2240	msedge.exe	90
PID 2240 wrote to memory of 4396	2240	msedge.exe	91
PID 2240 wrote to memory of 2848	2240	msedge.exe	90
PID 2240 wrote to memory of 2848	2240	msedge.exe	90
PID 2240 wrote to memory of 4396	2240	msedge.exe	91
PID 2240 wrote to memory of 4396	2240	msedge.exe	91
PID 2240 wrote to memory of 4412	2240	msedge.exe	92
PID 2240 wrote to memory of 4412	2240	msedge.exe	92
PID 2240 wrote to memory of 4412	2240	msedge.exe	92
PID 2240 wrote to memory of 2612	2240	msedge.exe	93
PID 2240 wrote to memory of 2612	2240	msedge.exe	93
PID 2240 wrote to memory of 2612	2240	msedge.exe	93
PID 2240 wrote to memory of 1568	2240	msedge.exe	98
PID 2240 wrote to memory of 1568	2240	msedge.exe	98
PID 2240 wrote to memory of 2360	2240	msedge.exe	97
PID 2240 wrote to memory of 2360	2240	msedge.exe	97
PID 2240 wrote to memory of 4912	2240	msedge.exe	100
PID 2240 wrote to memory of 3524	2240	msedge.exe	109
PID 2240 wrote to memory of 1980	2240	msedge.exe	110
PID 2240 wrote to memory of 2640	2240	msedge.exe	111
PID 2240 wrote to memory of 1928	2240	msedge.exe	113
PID 2240 wrote to memory of 1928	2240	msedge.exe	113
PID 2240 wrote to memory of 4216	2240	msedge.exe	114
PID 2240 wrote to memory of 4216	2240	msedge.exe	114
PID 2240 wrote to memory of 4780	2240	msedge.exe	115
PID 2240 wrote to memory of 4780	2240	msedge.exe	115
PID 2240 wrote to memory of 3984	2240	msedge.exe	116
PID 2240 wrote to memory of 3984	2240	msedge.exe	116
PID 2240 wrote to memory of 4956	2240	msedge.exe	117
PID 2240 wrote to memory of 5004	2240	msedge.exe	118
PID 2240 wrote to memory of 5004	2240	msedge.exe	118
PID 2240 wrote to memory of 4556	2240	msedge.exe	119
PID 2240 wrote to memory of 4556	2240	msedge.exe	119
PID 2240 wrote to memory of 4048	2240	msedge.exe	120
PID 2240 wrote to memory of 4048	2240	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.pacentalg.monster/TWuu1025?gad_source=2&gad_campaignid=24388197108&gclid=CjwKCAjw9PvWBhAxEiwAddzYycc7BmRGf9HYiMor_65fIgqPdOwyS2WnhBKdBezFnbVd-5lg_9m70hoCeLkQAvD_BwE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffb74ebc188,0x7ffb74ebc194,0x7ffb74ebc1a0
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,10347347024568108029,9563029633617763239,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7454132897091010990,11006936071826196891,262144 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,15400650164426167256,2611416812586612735,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,11082467279814080561,4275498473260401705,2097152 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,6835214086352940001,13756461938405456729,2097152 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,825139932133398965,13547957166427589855,2097152 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,12725794294640600645,14268056759017575715,2097152 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,15345812762034448699,7977039185740934312,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,4290394199638322508,10407036023884116385,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10330651122865267712,11302849983639914727,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10330651122865267712,11302849983639914727,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,5113480718466846446,17180738065956976021,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,2845289522535047263,2854094579264247082,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,6010560345521715005,10389860932334471163,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2832,i,9487418120432208380,9137317955594186318,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,2219549141204777698,11880566260146347335,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,7397015440380098234,8143818820997956094,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,3919032849254358444,818688563335793181,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6760,i,5650461995778462183,10561601000341802985,262144 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,5322556880901993709,2806251417797428402,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,13430804146342286341,1640513535387710552,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,10408919388132727725,9497042476802602974,524288 --field-trial-handle=2252,i,813959891677159363,5896486827619547329,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35abbe05-4752-4963-87a1-fbc713bf36b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35abbe05-4752-4963-87a1-fbc713bf36b3.tmp
Size 26KB
SHA256 2469decdd242858a474efb9dcecaa9a5b29a26ce7fcf847573594c8c8f64e3b5
MD5 5c17c5a3eb250d132b1deca99d205ea5
SHA1 23c2de139830d00a1a2df2a51c25497b912a2fe6
SHA512 d1fa3ea3156e875b208a26808f66a933446542964a0de306495592e2262dbdb049d323061e024f040ec6c5815e2bc1361946ec32079574190a3572f715908a13
SSDEEP 384:niFzQkUSvKzsNq8TUNTUlIlcDScZK3YduHX58Ek8TJrXtVCJvaTZcFbtoIIlF:iFdCjwggqYWacrCJvaTZcboLf
TLSH
T113C219F294DB993AD9AE9743A37D2D029EBCC053F5845A50F398961CCC9A1BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a011d8e-8c38-4d60-8ec8-becfcf5220fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8a011d8e-8c38-4d60-8ec8-becfcf5220fc.tmp
Size 8KB
SHA256 901e080283d7782f8261b8144b9396bad9af8f1808d68079b382fc2a8ad6b75f
MD5 5c06b597ce2421561e869cb7e84b1097
SHA1 e19ac458c1e2fbfdb060862a1d06dcfb6d4fbdb9
SHA512 fd6fa04449a7648bf3ee2d898865bd1ff892d56d55741c54c284632f657675c9e2d7c5291d1cbbbc2dbbf8ae2233f8c2b94cd6c0253bfa8e8a394c36094bdf44
SSDEEP 192:cONj6wlD9QmiUyiwL4X58gZ0jzorTJrXHNxve1qrJU6:cONj6k7kL4X58Ek8TJrXtACJU6
TLSH
T161120935E578BC2B5DE3A585B0863603AFE58117EA897F90D6EC1B2C01EF29C530AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

2df28e27-80f1-46c6-b776-9c0731bf162b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2df28e27-80f1-46c6-b776-9c0731bf162b.tmp
Size 10KB
SHA256 068552fab222063d4d79e933fe634a8e133231fc3475fa0add18b06288105e76
MD5 aa3258b199c5de42bf8df34d86103447
SHA1 20e78bcf6f91ec0046e7e812b8224a44a8538260
SHA512 263e3101bc0ffb2a1e289b3511243b3d49a4650dd14bbfdecfacf1750454f6ceccc0811d74192f361a4487a3f69cd4565149f9c0c55a1adebeaf7f840d7b5772
SSDEEP 192:sxZ7gRUWt/fksBvIdpyiHW6+WNEpR/YrgMqrIIg5oJ:sxZ7gNt/fksBAVHb8/Hqi
TLSH
T11822A9526E24A97B8CC7E209BB15BF53E6F9903261D51E44AAFCD61C05E7ACD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e5755c6-08b9-4e51-ac5c-2bb609839f0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e5755c6-08b9-4e51-ac5c-2bb609839f0e.tmp
Size 27KB
SHA256 b8640fffa684cf9f7374290eac6fad42be7b316cff89db6cc1d47b13fec7b44b
MD5 b7cdb0f59312e8c6bba9d0b9337b6629
SHA1 3f3cc66c4420cd4b2406d168d8f49e8dd038bc38
SHA512 e925251106f5fb70dc2172575abb22cddb5e931d3e12251cef97dbfeed5d999ac8f0976eb93d5a5f554f37f6f74ec2fd020cf7a7782c753a75f2f8e3dc6472c9
SSDEEP 768:3gy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbAroRPG:3gy4J/DWvbtBhu1jajiLm0bLNG
TLSH
T1B5C20B3B644CCA7E4FC01A9DED5E6FD73E9802C7AA948D4047FA994C02C77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69dfcc9c-2417-45bf-9c3f-e3870abda998.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69dfcc9c-2417-45bf-9c3f-e3870abda998.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fd5d567-fb6c-410c-beea-01c0d91db939.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6fd5d567-fb6c-410c-beea-01c0d91db939.tmp
Size 10KB
SHA256 530a6ccb4f4a323ed35e15abb98a651d01a7e634d6b834de132d9d3bab696d76
MD5 1d5249f578470c3ff509f8b2c64cb67b
SHA1 55fb304c51037b2da60fee96c6d0fc964bac523f
SHA512 762a10e92cca396d91fa23f7194d670bec428cfaeea37e45fa507aa6a37e483f40f74ad056d92cfb7c83e9eb3111e94a1f3f674deb961ca2f67cfc8e8bedfc6b
SSDEEP 192:sxZ7gRUWt/fksBvIdpoiHW6+WNEpR/YrjMBrIIg5oJ:sxZ7gNt/fksBAHHb8/wvi
TLSH
T1E822B9526E28A97B8CC7D20DBB15BF53E6F9903261D51E44AAFCD61C05E7ACD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7cc9d465f21b6c83bbd4d6fa61d5ec5a298e342c8c3964971b6421448789d8cd
MD5 5376c9e19025b8583d2017bdc6c228ca
SHA1 4d0144774711a1a3a1b256c119559d9aabef67e6
SHA512 75188e8451faf03afa42b42f397d813d6677dd2b3a022236e5ddfd5e5e7c29624da7a045bc3cfed1da14c1997f4faad79feaec2ffa7da3f4e375b79f649c6c7a
TLSH
T1B0E026C404CBC32FB70C688B0A78470CD7A1275A96C069EE2B00CA8974CA140E7E37A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 57a35b049e9b5d850d5479a0f736265f0c13e7decad8decfe96d6ef0bfb03e19
MD5 32336427eeaf4e33a05fd4b2ff16d2ae
SHA1 0a97e6faded5a8cd5edfc8888dda023c9a5b22c6
SHA512 06520700e036dedb0144b23000928b71d6fdc6941bfdcefb974b5e9f479aca09f86ede6a0d242a2be3073cc147185b99937a9549c434f58ae7bfb0dafc0885f4
TLSH
T146E026A414CFC36FA60C64C70978430CC381262E97C0AADE2700CA8DB087684EBE3F91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dfcdad849ae36000ed1a68c35c8fad42f6bf8acb5db660cdf485bb532264ab9a
MD5 62edd1cc1eb6eef9eb1fe26438ef2c36
SHA1 ad8265c8b83cc7bbe1437d282a4eea795cb0b69d
SHA512 5f4e1972d01f489dc65f6edf296f3a5664ab1660811c04b94eedbcc50b2c3249169b065107f3ea03e5558e7c4772d6f6d7f6f9f49fd385c5ba08f533d6ef2e9a
TLSH
T142E026E448CAC32FA60C748B4978478CD3C1261E93C0BD9E5708C68C7087840EFF6790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3d0b3743e8ce5f9fe763e142964ee61c941d04ba6175821a1c8461d9aadf1b5d
MD5 3130e0916d07f20b98c2b5cd2df92eb2
SHA1 57a0556caa20abaa86bf5626f45ffb74f376bfe6
SHA512 fa68b2744550aedfcaa689614ce1c80f8aff73c7ca0dafcae3c5811f3f226fd1cb02325f06c07602d9f2a4c55cb3f5277ac9ff4a59a8938933db6d05239ffb64
TLSH
T1FDE0268494CAC32FBA1C644B0568834CD391265B96C0799E2700C78A710F040EEA2790
MD5 SHA1 SHA512 TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 472KB
SHA256 5cca272a944058a27ec9e9b5bb6ab10aae16df5989bc7aca10337b3b6415dadb
MD5 7f266ca57f4f9137d2a14d8048d5fedc
SHA1 7475f566f11c5a8e1b8858ec05dfc120b785e36c
SHA512 40a86691092faf8e28acf555e3e5a5c604be4fd756b02daa24ac32dfaf26c8aa77176ee82a94394b11719e858fdcedee55e5863c076a9cdbdd157195b22579db
SSDEEP 6144:GI5JpA+8BVO7acooAKWybk81q2sROcxYghflcjT9+CNL7bUyqMKh+cTXztNDOzIY:LJCcoofAJOcxVf6QCNLLuFrULXhsi
TLSH
T148A423884BE8B69584B03576EFACE0D03445735CA7EE2118536DC1D9D4309FADABEB1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 530KB
SHA256 5566c3f54f8b5a76d46454b756d051c336a27b29618575dea07a83e0afc48ee5
MD5 ecf25b8621f27a5ce8f2d9c13f88ca50
SHA1 9fe40a61c27f477aa1d711286266f977dab28ad3
SHA512 fa2a8ebf7ca7a30ad650d9883b1f9103be7e1c6d1051b45b53bb47cc3fa801348214a13dc8673c12bbb740200460ec81118f167f6428e7ece3e19859599c5dbd
SSDEEP 12288:Z/F+BDDmutIibJe46aNLw/n2Epvyh/tDC+ll+iD:Z/OlFNJNWEfTfD
TLSH
T16FB4236D46F888F95407DBB50F9BDC2A05C7B8046366B532C26E3AE46E8CFDD0116DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 478KB
SHA256 18a01f1a06b2b639704e4ce2eb5641d29b63ce5092a54b8774e92c210911c5a3
MD5 e89c11b180bcfd652d8883da4b0f68e5
SHA1 a8429ad4fe249543616c0bbee4ac6f61e1088ece
SHA512 7b0b248fca57231ee99b3aead3f645522c37f5639a054c05212e595fa2c38ef7661970bce5a68a35ae5ae0c2e445d82ab074c7ea9d548bafb438dc824ca993a5
SSDEEP 12288:2lyIMLk+To/aVvNLEW1RIljkekJQtahrKNiVdyZFPL9I8:2V2kyo/aqXljkbQtsrVVoDPL9I8
TLSH
T163A4238A3A4339FBD4A120359278E02D9F5B272AB7D0B3FE0BB5992CCD1454DD285727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 463KB
SHA256 bf93761a9c3b6a032780071d01505f0d481718ae2b5d15f66b56091055967d27
MD5 de413ebbaa72dafa0b6cb468ef55aa26
SHA1 d80dea74a64feaa535b4fa64e95736ac028d0248
SHA512 61222e3e98ce27a26a96ef072a27ea6cc8afd0e98e2e91060a193e0ab047bde72ed426b6236b19176df82c9f9d462370d9cffccab2bd905abfa874cddd730b31
SSDEEP 12288:WBMFlvBe72otwuS4YEfiBQyGu2GmlSUsoep25xbn:WuFlJe75XYWiBQIZESPE7bn
TLSH
T17FA423A7923A373AB42D9F7951A39276104526BF47B7ABC04ADA2DC04C3CC39756D382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 516KB
SHA256 57ed0c93d3fcbe8863c78c8fe0ec5034c6af2e33f0a3bc8578cbe5e4ed27154c
MD5 e211d123cb5c471a3a1372ccc9aa4965
SHA1 ee86d77e14bd75cf03e5aad9a6dbd2c7d8727d22
SHA512 599b293892c933cddf3bb12e710b92e84767bab4da8b7a3a935038bd128c60ef6e9d27cd213d2f71a86713fcbde46ea67ea9a4e069bbf75a37afd752766b1937
SSDEEP 12288:7/s7qobJYjPPA7WCMBJjiQ4rLMKFCDBXf3t50wGl2yRAKnHebIG:7/iqox7WPLji6KYDBvb0wGl2iAKn+bIG
TLSH
T1D5B4239FE48EDA96C0B39C299776D2A9B7426866EB717CB7C073811D116D2C23383743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b9a9988ca09d3629875d8a814e557b8f30b96b39ddf24aaa468de7d237a45a1f
MD5 8ebb894750ee232a73019926c13afbce
SHA1 7d1ed5563c27656f691d3d775d440adb46dd66e1
SHA512 9fb5ffcb8f79442fcf2c47527035830a5eecc33461dc5a9245d7b19e8e3d80067336719f745ecf213f2792e2cdb850fdbfd9cbc40f827989621d9b3b4697104b
TLSH
T1F081CA80C392405AFBE5A43091EED9A6757F448FE983DE56CCF4F1BAE98A3C47125740
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 781fc973e9969133e9c54243bd477705a6c51761a60ec80113360c982279dd7c
MD5 2c258418314d4b19011c190118b7e4c6
SHA1 d67a62c421acaac7dd9068d3ba66c739faf2d208
SHA512 7d38c4407159bc688964ae777e8f0c4d0d4208d18218aad4ec2cebb118f80091771970cdded77a80d5ed7a39259a4a05fbe25a841cd09654eb3e6b22bad35116
TLSH
T1F05194C1D3924598F7E6A470D2ECD2A7B6BC44C3E983DE4AC5F5F6BEDA0A3806024340
MD5 SHA1 SHA512 TLSH

Submit Download

7198161e-5fad-4c54-8190-3a9c8ac39df8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7198161e-5fad-4c54-8190-3a9c8ac39df8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8c84ba25-a496-48d3-af14-ca9bf6d09de9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8c84ba25-a496-48d3-af14-ca9bf6d09de9.tmp
Size 3KB
SHA256 463b7d2810ce36125008bf6dd0831f483a9b9796de8fe83f7c0c7f1ee079ed0f
MD5 74615bb5c101517223ea2ddb46d61ad7
SHA1 3a33d30384a6e7ce57f3f1f624aa429996d7f5f5
SHA512 c15a3d01faef59e55534a87034b764b2771e913a59754d95f981b265016d138937e5dd115f55ee38220106d8444787c54c5de51710167e5e05934c4c94bcde90
TLSH
T1EB61DEB6C7E4892D891162F599142E27CF7C0425632C3C47C4D8AF9FE3F28B0F24155A
MD5 SHA1 SHA512 TLSH

Submit Download

a6057d02-09b4-4ac6-a5b9-a8cb6bf48925.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6057d02-09b4-4ac6-a5b9-a8cb6bf48925.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

af8a3087-1f09-49fd-942d-f46387692d43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\af8a3087-1f09-49fd-942d-f46387692d43.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d9ca9af50ff06a867839cd9ce8f6f39680cd4aee50b5a02717093ed99649c176
MD5 4326fed7a9500e41f0b1bcea242b1261
SHA1 006d3bf84264c775defcf01f1dc4621860d19bf5
SHA512 9cd49266f3edd5ff32bd5a7e1e2edf4d549090b1b19996df5f6f97447ad57e96c60bb496a83586064377d6b63dff8b2d32918fb1b59ef0f43e57031959733857
SSDEEP 48:KIDI1Ks04jyLaFoUaYoZbED0ISMZK9w1qZxCJY7coqyLQ5QIQVQpQzQ3QLQkbQ3P:KIDCKs0+eZeKCMKGn2KY/v
TLSH
T11191E25431BF020179BD298880B5C71B02523677715DEA6B7F7D40A58A6FE086EFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a575f774-d547-46ac-9d7f-48c496a61387.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a575f774-d547-46ac-9d7f-48c496a61387.tmp
Size 9KB
SHA256 e30a1142eb0f2589c4d7c630296bf11888ba78134c6aa9b4bd07cb2ed439ba52
MD5 1b9a1e52617ff3b304101c791a4162be
SHA1 90986df9690f422e0cad64506b6846dc8069245c
SHA512 a807196bf4c377c2f71844a733d4b4f31e338e2cef7390863da9bc94a2b603cae626e413fd7485ff5ecbbd4a6b1b984445ecb5947a9e0f1e3f19fbbaa15addb1
SSDEEP 192:sxZ7gRUWt/fks5vIdpyiHW6+WNEpR/Yr0qrIIgrJ:sxZ7gNt/fks5AVHb8/19
TLSH
T13822A8526E28A97B8CC7D209BB25BF53D6F9903261D51E44AAFCD51C04E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e26b6d3c-e86e-4d6d-8fdf-49be6e032b1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e26b6d3c-e86e-4d6d-8fdf-49be6e032b1d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e999699f-8236-4816-ba7f-e1f205366457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e999699f-8236-4816-ba7f-e1f205366457.tmp
Size 10KB
SHA256 debcf44acfaa7aaabaeab0c9441e7edf856bf80054fc99fa30075631e1c7a7b4
MD5 fb33a9751f782b81e3f622448c81ccab
SHA1 79a179b7ee7077072711ad0a9618655dee4efeb4
SHA512 5d67a08a80e23d7b05596efa4360b7f8b9ea9285568abf11ef67d8a9efe6764aa1fb9b43f6748d7d47574f13c7bd34de7c063cb48cc78418c02788778b112f4a
SSDEEP 192:sxZ7gRUWt/fksOvIdpyiHW6+WNEpR/Yr0qrIIg5CJ:sxZ7gNt/fksOAVHb8/14
TLSH
T11E22A8526E28A97B8CCBD209BB15BF53D6F9903261D51E44AAFC961C05E7ACD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff9187da-b72c-4e8c-b058-47333e129235.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ff9187da-b72c-4e8c-b058-47333e129235.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c183e259-5c40-4a8e-a078-08cd61b2526a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c183e259-5c40-4a8e-a078-08cd61b2526a.tmp
Size 18KB
SHA256 5869d3198a840d02afa0135afa70da34bd7616b73bea1530a212a6c2ae352b20
MD5 8126e99911a57503dea6e4ef49cb6a08
SHA1 794875ff5788d48482e4c900c6e1c0050581ae60
SHA512 098ff194ba29bdbc53fbedbcd3578110627c7f6a0ddb05ef6dd50bdde5d170221baac9517ca43451879477a443b92ab505981bad4876ad8cfd32f78223ce5097
SSDEEP 384:dQkUSv0sNSxDScZKgYduHX58Ek8TJrXtoCJvaTZcFbtoIIlF:H0ZxYWacWCJvaTZcboLf
TLSH
T199826C35E4B8AD3B4EE6A141B14A3603AFF4C017D6C82F54D6EDAB2C01DE69C235AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6544513-48e8-45cb-a7ff-1ff2f9f7f464.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6544513-48e8-45cb-a7ff-1ff2f9f7f464.tmp
Size 8KB
SHA256 2f5c7dc88eb02379c58e99c755c55aa4eb54f636ba7f1f2272598e4c71ad28aa
MD5 7582008819e1daa9c5ec5127c23ba695
SHA1 cd292f78b631bb8de170459d2c66b067a25d0392
SHA512 de776a91565246bec53cffebf866878a878d9111abe3462a9812dc42a93db5fa4d0109cbc9a950ebd93c3cd82a7ed15c5cc86984225965e2fa057c260285162e
SSDEEP 192:1ONE6wlDgQmiUywwW4X58gZ0jzorTJfDlejU6:1ONE6kgUW4X58Ek8TJJgU6
TLSH
T1E102E934E9687C6B8EF2AD09B44637139FE5112BE5952F44CAE81B2D00DB69C2306D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69b3c015-86ca-4101-a24a-99aa344253a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\69b3c015-86ca-4101-a24a-99aa344253a1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fb302b6a-c8ee-4bc5-a216-1e864ac322f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb302b6a-c8ee-4bc5-a216-1e864ac322f0.tmp
Size 18KB
SHA256 a18a4987918f83f2947a69bc8f89fe33db005068aa7eb52f25262dfdf5823de6
MD5 6f486a22e176b7e628c8f12258341d02
SHA1 710551e126cbf776761c53d701a54656e5a9f5b4
SHA512 4235108e7ca0d1605b5c2e2e8a6780ed88cb633d14a484920dc9499d8f3d22d7ee8d27d11edfa2bc3d1c80bfd505d5ca436d53f063263f3e3b8ba6b5003289c2
SSDEEP 384:6QkUSv0sNScDScZKgYduHX58Ek8TJrXtoCJvaTZcFbtoIIlF:i0ExYWacWCJvaTZcboLf
TLSH
T1AE827C35E4B8AD2B4EE6A141B14A3603AFF4D017D6C81F50D6EDAB2C01DE69C235BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 35821bbf0ea2d9329ddd6e376e7811d2f5d5afbb123a6322f8fb062604ff4032
MD5 55ba4fd56da34e2e928b95a18358abbc
SHA1 f4576316b5ab91ddadfddd793735a1cb9d40b7ff
SHA512 3a15ff71b34dfa0450b818e19933a23caa281dbebeba8b8862691e1e00b6588f4449886219ecc46a9654ecbf56fa4354ea1c6c3cab9a03cd7210d8ba7725f510
TLSH
T12B410958BAEA1148B3B7AF066FF6986D44BB7C272E0AD45D10110D4F0662F40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download