hxxp://discord[.]com/login

Analysis

max time kernel
898s
max time network
881s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://discord.com/login
Sample260620-3d4brabs4t

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	discord.com
16	discord.com
17	discord.com
21	discord.com
24	discord.com
36	discord.com
38	discord.com
5	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3672	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264728126073987"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{1F39081D-0396-48E6-9B7D-F74643766E65}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{33B09251-52BC-4A90-A2F1-49DA526C4102}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 6136 wrote to memory of 5108	6136	msedge.exe	80
PID 6136 wrote to memory of 3672	6136	msedge.exe	81
PID 6136 wrote to memory of 3992	6136	msedge.exe	82
PID 6136 wrote to memory of 3992	6136	msedge.exe	82
PID 6136 wrote to memory of 3992	6136	msedge.exe	82
PID 6136 wrote to memory of 5812	6136	msedge.exe	83
PID 6136 wrote to memory of 5812	6136	msedge.exe	83
PID 6136 wrote to memory of 4296	6136	msedge.exe	86
PID 6136 wrote to memory of 4384	6136	msedge.exe	85
PID 6136 wrote to memory of 4296	6136	msedge.exe	86
PID 6136 wrote to memory of 4296	6136	msedge.exe	86
PID 6136 wrote to memory of 4384	6136	msedge.exe	85
PID 6136 wrote to memory of 4384	6136	msedge.exe	85
PID 6136 wrote to memory of 3960	6136	msedge.exe	88
PID 6136 wrote to memory of 3960	6136	msedge.exe	88
PID 6136 wrote to memory of 3960	6136	msedge.exe	88
PID 6136 wrote to memory of 4892	6136	msedge.exe	89
PID 6136 wrote to memory of 3104	6136	msedge.exe	90
PID 6136 wrote to memory of 3104	6136	msedge.exe	90
PID 6136 wrote to memory of 4992	6136	msedge.exe	91
PID 6136 wrote to memory of 6092	6136	msedge.exe	92
PID 6136 wrote to memory of 4992	6136	msedge.exe	91
PID 6136 wrote to memory of 6092	6136	msedge.exe	92
PID 6136 wrote to memory of 1108	6136	msedge.exe	94
PID 6136 wrote to memory of 2596	6136	msedge.exe	95
PID 1108 wrote to memory of 4600	1108	msedge.exe	96
PID 6136 wrote to memory of 4136	6136	msedge.exe	99
PID 6136 wrote to memory of 4836	6136	msedge.exe	100
PID 6136 wrote to memory of 4912	6136	msedge.exe	101
PID 6136 wrote to memory of 1816	6136	msedge.exe	102
PID 6136 wrote to memory of 1816	6136	msedge.exe	102
PID 6136 wrote to memory of 4536	6136	msedge.exe	104
PID 6136 wrote to memory of 1496	6136	msedge.exe	105
PID 6136 wrote to memory of 1496	6136	msedge.exe	105
PID 6136 wrote to memory of 5664	6136	msedge.exe	106
PID 6136 wrote to memory of 5664	6136	msedge.exe	106
PID 6136 wrote to memory of 892	6136	msedge.exe	107
PID 6136 wrote to memory of 892	6136	msedge.exe	107
PID 6136 wrote to memory of 1004	6136	msedge.exe	108
PID 6136 wrote to memory of 1004	6136	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://discord.com/login
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffcbdfcc188,0x7ffcbdfcc194,0x7ffcbdfcc1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,14823297247215109002,181080187062967123,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,2226110051761433221,14793794084465139022,262144 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,12558132949158354682,11503793533044356472,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,1170212348252090977,8053132141683387438,2097152 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12370807623657018290,9660886123012777418,2097152 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,6586664263017955977,6950455230693749804,2097152 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,9681764026729316009,18129893732915526287,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,12332666262785138029,1135262447403851398,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:12
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,17346193373219982820,13530012309040238434,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,1161230601234337172,3111781072949407296,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,12831786422524042752,2768403969249277591,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17867491478736400073,4591199504160724687,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,12831786422524042752,2768403969249277591,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,1265594550681462168,15323882422238519346,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,4651430123101334780,9438899826179429245,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,17366260167834812759,8898344805801412285,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,560358396336091664,17126657736200622005,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5684,i,12584574947810855299,16391315557186439082,262144 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,2554453070745093376,17749852203590727033,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,3753123400778010823,7662681913015752060,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,2209214685864326618,1400397517366699871,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,13008060239061408957,7274405453257940360,524288 --field-trial-handle=2300,i,17787744081403385804,14445742353897245401,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
  2⤵
  PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ee0ab93005689d3811690641be668a0b23b12fe2aedf5fbface81496ac9ec55
MD5 6836a4aad6af456c4c86ef4fc6878b9e
SHA1 a0b4e38a5c41da630ec4ae61d2e42a6d83b79bac
SHA512 640747ac708f1635285ce6c25cd04c87cec94f14ba9f0e3f4e5de0a45e46d8ec659b673c48407e81b121c7c431ba96d190ce551e95ba3891b9d3e3c582371c56
TLSH
T1D1D02354365BF8D2D23D1035D9D04334756D85D3765142067554C80ECCF5094F7D39C7
MD5 SHA1 SHA512 TLSH

Submit Download

47660b97-ce54-4d32-a863-7584bc9a4fb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47660b97-ce54-4d32-a863-7584bc9a4fb4.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 78c8fa70de827141e789b6f0aa3e751ddab28788869988a524871544cb28dfb3
MD5 3693c7af2ea7429506e56803691df152
SHA1 f0de277b072346da25cc0fd91c1d1e68bbfb984d
SHA512 7cd70a9ff9a0ca2c5f9aad55e97fd79da106622d71d85b181caa23d4a2c50cb2af8a3d2c51ff46cd85881faf7d7cf3392431c5a00793760ede008cdd53333a8d
TLSH
T140E020B946D4C7DF930469C7C5F4670C8184361FD3D9BA0E2B12844D34417C47685D51
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 3b079d8b7e4c19c70e6ce15efee6dec5e75d430f3e44a3eb1c19f63e2ad7d88d
MD5 e3495dd726557ab5b6d7744b1d2fcf11
SHA1 3d553f84ca5b104c931719c9299cfb878c35fff2
SHA512 250eff0b6af7eb2eeedcb89994b1ea28bd89ebba1bc0b7213d3e42c54d9c7aac08d24e0986571406478a3b07f4c17f5ecb96d2c5c02a01d050eebb41dfeaafd5
TLSH
T1ABE0DF6AA3B6E6E9134EB7CFCCD4A31C204D304FD3BA54AE3214648D6802E0A7719C9C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 05e4691b61599d98a2ec578659a73034ec13e8fdc39ec5d4999552e8e8cb71ab
MD5 8440360287712930e364a6605f6cf2db
SHA1 2700097cae33f730acd0bcd90dce4e0d75846957
SHA512 71cbce3467335413bea089dfa178e9ea78ae75c88c4458c1620013f1c2d7eea3fa6399275adcd7e085a0fc09a0f1e91e6ecfa78066c9a81f6cfbbea65dc3cf72
TLSH
T170E026A447EEC3BEA308E58B8AEC532CA280B64FD2C869CE17108488B001340E3C7990
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 3f277b7ac25752903b9e4f7c6eaa9c3385d9aec8a999c93f30bf3146fdb9b64d
MD5 b7496c9a82617f2c6a79413575b36ddf
SHA1 1e018ef705b7205cf2871a574e2a0b321fd49b61
SHA512 56d3b8b8ef972c272b4bd81bc151d06f4c12a614459c53077d8f4f4a016c7965cfac564a7b0a0756c34fb9af6d54d51545b37cc398fb737e22204742925badc9
TLSH
T1B4D02BAD7DDC7D8ED6F419BF57A6B0001F5412824427EA130170FDC037805E01B69028
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 16bdbf9e11886dd812eaa5a9200799f232f5f4002de362823d620fbaa6dc5021
MD5 50483005c5781e4caed57f424bd4234d
SHA1 ae0b81f65380b2c13f59693b4be3687a66fdaa1b
SHA512 13527332bfa9800f3f0ff6a255a5ea41843ce7d134d1665e85a9a561f636cb440242a3f13cc60cf5d37479280bc7155beac35a943a4183328b26846ef57ecb01
TLSH
T1CEE02BE6C822AC2F08FE071874540745D701133B2A40595F363C830DCFB463E059AD5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 77d680792cdffc32b17efcfc7c107f66a65cb5d9daa32d928bba7823f43e6a87
MD5 b949b4b479243e9db126098f29ba3958
SHA1 6b07c4d737a17a377b300e2d464cd6ea78db98bc
SHA512 d36ba82347c5b9f34d16cd4942e3b4dd9d146cf4928848451dc83f3b8ec568c1804c18804a82750dabd2a7eb7e204171c88339d34bd8aa8db31a5fc0e5cd64a5
SSDEEP 192:LLlGlelulElYlAvIlLlLlGlHlHxlhlilKlDlIl2lrlllRl53lklNlYlllil72IVu:LRy6qMImYRRyFDzG+5YCx/D3s3I/G72H
TLSH
T16A22903D01556B5AF319D5B3B9D25E02F37D43906B831EC709ECA9F1F10A398A62A8F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6785fa3a55ee3f71a5d65b4882c2aa98622989827bf93580493264845bf7b969
MD5 bb67df9aa1e62e91d5193402c61bf7d1
SHA1 fc4e8adfcd69a1cec299d4eba238fd8ffd281098
SHA512 826a59e8f87856b4c5efbe9ca99c860974581d303b996cee8f06874143e432a4efe3cc924dbeccc23fec06f5f8e75b1fdfac8039bf1fd29aa3724af2536a9e35
TLSH
T1C851BBF383E4866DCA1156F0AA187E2FCE6C0914432C3C6A88E4EE1B93E2571E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3538574f12b7992f0d3ec55e5c2fbe195805250a9f3e5757df0c6ca76b4fc26e
MD5 881386563e5d2ec98669e48469a19056
SHA1 3212bd62551e542f158b4bd91026a6b560fc6e7f
SHA512 b8dfc97e7e27bf74a25f744b28af773ba7108c55a32e331d7c6f9ae51a47d70889af838694be238028555d6179d78b062807660541b01a140ebb7377b96e5a75
TLSH
T1C7418DF383E4C66ECA1156F0AA18AE2FCE6D0554432C3D6AC4E4AF1B93E2571E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8f8182d101256934acb332d703d7d6239afe91b0a1af70e35465fc778a5f11e3
MD5 9bf674e791ac3eba3566fe92182d7850
SHA1 bfaae6b7729c8cba7584265aec1134c057d0e3e4
SHA512 b18341694399e36954b79998f2c4dd9708907aa72eea1428498881c58bb546751f72b9d78c13d4ebf82ffdb40e4d9549cbb50e31df484109104ff91b22e8459e
TLSH
T1A451DEF383E4826DDA1196F0AA187E2FCE6C0514432C3C6E89E0AF5B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f6d979bb9e69f0f5f7a0ddf3dd15a25ef465d62ebe638f72ba4b2da779fbb67
MD5 a39ff13a6769bb09ed3eeedb17bb6e8c
SHA1 85f8be2670ea9dffba283fc27ee19a43de5738e8
SHA512 a7d28ce4a9b751e625f100e17cf3f5778bd8a5c619b111511f08c71518f3d979c1f62253bf10f88575ab2879a9714fb43375ea5bc2a087a8480d7d19b83ffe82
TLSH
T195519CF383E8C66DC91156F0AA186E2FCE6C0954432C3D6AC8D4EF5B93E2571E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 852B
SHA256 69870f6815c427c0ad266598189d8f44345c247c31c30ee6a8946d90c529f156
MD5 fd1f51bc01214b9e04a517fba3185cf0
SHA1 8e22c5a60628d0cbe6c7fb2bf4c1b24a413b1b0f
SHA512 ad893e9a830974250103e7e4cab2a6cb6156e7512823b0bfc85fbb33d041676cdfc1131f6257dd40dd92467e5d5c54cc862753494f6e87ba309bd52cb04570ce
TLSH
T1DB01ABA791FEF46F20280E3F1D58788569BAA879065098F9DBD7C33CA0814B30F0A023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 96248f0ec8cd3d44b6262d340139b74145d927806540b2627fec9fa67e3581cc
MD5 c4bcdd9cddcc35e387f67cf1ee97fec3
SHA1 8fdb1822381146b45e413196e59ea9d9b7cd7b49
SHA512 ebfb630f477a341ec8b6b874f86174e28bf9f964b7526fb6f984e03976ebf7670f4a910d5ef844d6fd5c2655ba2b95480dd6fea303475d447c1bfdfeef169633
SSDEEP 192:sxZeRuyMqZjK1Ml8UQJFs/f/sz+KQ7Pc0Wzodpx+/W6+WNz/D/Y0Z7CzYIg5pJaJ:sxZenqPs/f/sz+V7E0t8/b//5rnJW
TLSH
T13562FA1666385977CCDBD219FA557B93D2F90563A2905E44A9FCCF0C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7fe5e9d233f668bdf8420fedded6936d97fbb8924cc4e50fec0cdf2e31f53195
MD5 87004293fb02b3b66fe4957c1dbc301c
SHA1 309da0b68a51192770e7368125a7a4a13fd4f190
SHA512 338e27902d411cbf4ace5e2253685f2002db9dafd6ab5faeba808ad283bd817b1bc817ee8fb96a9f52d77ecc3aaf3a6c8b008052e6ac50b56ef66ec4f598c338
SSDEEP 192:sxZeRuyMqZjK1Ml8MFs/f/sXyKQ7Pc0Wzodpx+/W6+WNz/D/Y0ZVE0YIgjJaJ:sxZends/f/sXyV7E0t8/b//5ujJW
TLSH
T1C862F9166A385D77CCDBD209FA457B93D2F91563A2905E44A9FC8B0C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 8652f2bb7385ec578c6649d0940f80691484a1b69d80c0b2c794c8f774c3b5e3
MD5 d51792b63ed3ba1de7e48851e2ecbcb9
SHA1 441158678a38e65a5837887ae322829c74aa752d
SHA512 468d51f64995a86b8c72048d3fe0014e3cad088e553e92f24ae91a3986ac987584f131594b5bfde63b68ca46b72748b9528957f737e8af7a0fc7e1752d42c053
SSDEEP 768:XwZh38Dv2aFWRm6GQXm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro15:XwZh38Dv2aFWRm6GQXmu1jaK09LplMbH
TLSH
T13AE21B3B280CC77E4F844E9DEC26AF966ED802CB66684D5447FA494C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index
Size 2KB
SHA256 6859a8c33f9cd5bdc4258d0563e501f2bb0fc247e014ed5ddc7e1b2a2791b198
MD5 9056ccbe283e4297b94d91b41d8739d4
SHA1 9e56475523b06c28201135b6c5082ef7f819e484
SHA512 35dbd09d3a5c30c9ad0d48b8542fed9c6233cb29fd85cb47743c04d676a8e2bf6d3c2cf380d63493291cd650e4554e584ccc668415355d18dab7adf007941144
TLSH
T17F41B60D4D558A2FE87844B215B318A437F089EC67589A239CFC2231BD4BB6919173AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d032f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index~RFe5d032f.TMP
Size 2KB
SHA256 b58f0264a6cb11b126cdfe889ea1d73693bd5ad46ae9f410d0cc4769d8ce1e88
MD5 178202d838bfcf73e81ceca9beef37bd
SHA1 ea927a4f746ee70fb716252748b5c20c6c0a5025
SHA512 c7545780feff0444b0e10833f92e1610593eb29acedb847c0772f087109699928e2c7a4266d093978b0b1f6ff9b9cc9072480c7e2c75868410c09cb554c539f6
TLSH
T19A41FC8A4E81863EE89440730EE3B8F43335580047157F5374FC6231AC967ED3E4A1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 eefe2f3a23e3105bea89408f136d28feb4a6d0a84edbfec55986f0f85d0b0a6e
MD5 77572bbd84b4d659ea4d39246e8904c4
SHA1 76932abdfb78c4ddc1f93ba887c81409688bb120
SHA512 324ea3cacdd50ba57350721065268daedf6d7e3df3e8499205517931dd84a637ff7fb828e40ee14ada12dfde2cdd903ae92cd75b30ce939a29f8b76bf8c6c594
TLSH
T147E068FB28D22D04EE6FC7D1103145B4080135698904AC4E001FA2C3A062B752459C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 8471bf8c992f529013dc82239e151c886a067e977375b6c513744794de72a556
MD5 8e31706942fd9f6969a2ab144e007fe1
SHA1 9ddf0a21578be8837d3193fb769a1767a50fb35a
SHA512 6ebf8d6eb3bf8863cac7358a6d0001409f3a14b2502b223496620138ac8a0f27f2476bd690cafbae3bb4688842045e3a6662e356e8e16c6c19f3ae34a233d0f6
TLSH
T1FFD0973BE0210A80E2A79BE02762686E4B103CC880898498D402752D283EB42D305F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 9debc0a0751427ad3ee8465172fc96e1baf79736bd405417710aeeb9b268372d
MD5 223e35e61c72b41a748db6f4e651b8aa
SHA1 5b02fb40a38b5a48a9137c940e0fcf90f67caacf
SHA512 e32ca00e0c92aa40ecc677b7e503ca3da0e6941f0dc926891571c4b9ee8423361d52d06667fcf87db23a25070161da567e52c9798b34c5fd17e60fe53fc36c68
TLSH
T1A5D0973BE0540A80A1ABDFE02752283E4B003CC880898488A402062A1C1FB429202F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587819.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe587819.TMP
Size 138B
SHA256 7ec845281eef28d78a83c410f1472cbea02113ef3fabefc6d89473605b1e203c
MD5 4f9dd1920b89ed7fcfb5627c7867d2f3
SHA1 5e837dfef417026f88718766e155dcd3c9f3e8a4
SHA512 3cf7bf82862ac8e2e06aaa05817a8fecfdfa869d99f1d6a40b1ebe69f0902c96e3672059f38fc968ff2d16a6fd52a11b6e3214098476c6f8c88833d54727d3cc
TLSH
T123C02BBBA1240B00975197901333344D47023CCC088E808DF1233428283CF236201FD1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 b72202d96c6c54ca906e232275b6b1ec4f6f49458646fc60ba5cb5f9740b2968
MD5 6baae6c9ecc6b4791884f0b59bef1db4
SHA1 475c36821eaddf2d8db4186f2e7d1b750b532f83
SHA512 c8b4e7c90a8ac42392f4b8c4aa026e52c6bba9499ef963caf81a716f966df4f371284c63374eda6f1b67f873990f9011a98f8cb96f59ba48130a3f3a1916f7cb
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlNnK9B/xdOtoxJHaML8K:ctGj+BCNC5qFVpKx/lrg
TLSH
T13EB29A1632BA03023C3D791D87959B371A82B1A33018E97B7BE814B64E67E215DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9d0ee5bf2ee9ab1c0b7ddf9dcffc7c079a022eda69963a5739d8f52f8fcaaa6c
MD5 1ca8f3151a3d0fbcf22be5b5184d997c
SHA1 47141b353c01caf36a77bd1f4040ffaaaf16ac35
SHA512 f80619990c237fcf20e902d727edbd397bf58054471402ae12c649ab3316b4cd81630dd2c073b57a471102266681a378c11fa3fc989706a07a2c58f2f5b75ab3
SSDEEP 384:nmiFqtNn/s3n9Sh38NC8TUNTUlIRgrk6mWK1zCfbHovaDTepXm9S56ITGT0IYtyD:NFqj+9e3VwgRcYqovITeByS56i+0Dvk
TLSH
T144F2C3F298D78977E89E4B97A73D2D1689FCC153B5885A84F7C80D4CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8c17b729429ff6b5af1315ffc6280940638ae561eb5cfa7430ab5588696ac19e
MD5 a96bd0eab7cd0dab8ef8e0d3a499c390
SHA1 1d976655741209d82cbc44c2522c45717900d040
SHA512 c1737b40305aec4247809d3f6a269e0064385b2d65242ec6a0143ec0c23e9e35388038fba54dd4f94fab8a891f1cbffc7cf5b3aac7923e14ffa280bba812ec13
SSDEEP 384:n+iFqtNn/s3n9Sc38NC8TUNTUlIRgrk6m7K1zCfbHovaDTepXmLy56ITGT0IYtyD:VFqj+9V3VwgRFYqovITeBqy56i+0Dvk
TLSH
T180D24A32D859DAABACD74EDAB74A36179EF00163D5CC6AD8D5DC1E4C008B2ED134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b521e8c2d119e12a064e31e0038a66df7c4dd082bbe46514423ea71df9234a69
MD5 02f9fa2ca54af25874953ad38168ae52
SHA1 28c7bd472255a3e902c49f8791ca9b19faa88d7e
SHA512 71125d621d417bd49c8591a9f06653dbfeeded0889547b329b96fbd8a05af246231401b8ad2d7eb0ef0466e13fec1980725f1e773aa80d8599abb911b006d7a8
SSDEEP 384:ngiF9CcmyWCs38NG8TUNTUlIxBrk6/EEsL1zCfbHovaDTepXmLR56e4KV8p0S5ti:7Fccps3lwg4NEsdqovITeBqR56I8p0X
TLSH
T1B2C25B32EC98CABBECD64FA9E74E7506CDE05223C68C9AD4DADC1E0D009B1DD574B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 edb6649ba1b257abdf3a720e03b53fbd4513de7869ad160c61f3a0f93ac2ddaa
MD5 075b2c6d986c3d22eeb779f4eba2a9dd
SHA1 e98f2c664b24bea21147a07dafc7ea294b20f185
SHA512 9978b808d6818d52091d7321e04c5ff9dd64e3f53bdfcf6cb417653e3e4306bbde5e74f00a3c7263755e90f0207d1d2a5c0a3f32c30e3638dd885f364b49a2de
SSDEEP 384:nHiF1tNn/s3n9ST38NC8TUNTUlIR0rk6c7K1zCfbHovaDTepXmLy56ITGT0IYtyD:CF1j+9q3VwgRbYqovITeBqy56i+0Dvk
TLSH
T1D8D24A32D855DAABACD74EDAB74A36179EE00263C5CC6AD8D5DC1E4C008B2ED134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a30671663d2bdc7e198b3a8876e65980f3cbae17ea6e3fc6f8fc92378ccb9445
MD5 f73beab1493063c6295146af33e9296f
SHA1 76c474f47b9d2b207e35bf1fdbaaeee27e0e2c4c
SHA512 189441ef1060940e7cd84bf9df68a52cbc9e643ce3086d62c7a77265baa8bc7834e855c02653591d3af719f8dd90104ce6de08f52891f7b0f0be116252b9bd2d
SSDEEP 384:nHiF9CcmyWCs38N/8TUNTUlIxBrk6oZGsF1zCfbHovaDTeNSAe4KV8p0S5ty/7I0:CFccps3kwg4tGszqovITeNSAI8p0X
TLSH
T133C25B36EC58CEBBECDB4F99E74E6506CEE0226385989AD4DAD84D0D00871DD174B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7a2d78ddec4f6fca9abccf2e9e136eb38b7ff8fe897f14413be6514d12c8aabd
MD5 e7c7cca2f65b949b832be3ae73a4e67e
SHA1 1722a7846b1d61d22c8ceb8210eb673df71cecce
SHA512 76a1bb3fb9b2d1b395026b33040d4a48111c3b9c6dc6b84a6e6836d0628191f2786f5e44aa0e3227875aa8b0c7ad90c884543ff317cc17e505a0789e6856d682
SSDEEP 384:nHiFqtNn/s3n9Sc38NC8TUNTUlIRgrk6m7K1zCfbHovaDTepXmLy56ITGT0IYtyD:CFqj+9V3VwgRFYqovITeBqy56i+0Dvk
TLSH
T134D25A32D855DAABACD74EDAB74A36179EF00163D5CC6AD8D5DC1E4C008B2DD134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download