hxxps://discord[.]com/app

Analysis

geolocation tags

eueuropefrfrance
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/app
Sample260717-ce2ansc13z

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	discord.com
10	discord.com
16	discord.com
24	discord.com
33	discord.com
38	discord.com
40	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287272408251330"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0783A76C-70A4-48B5-8313-BA8A195145B4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0812E534-2897-4162-99F7-0DED2AA5B34E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3564	4760	msedge.exe	86
PID 4760 wrote to memory of 1080	4760	msedge.exe	87
PID 4760 wrote to memory of 5068	4760	msedge.exe	88
PID 4760 wrote to memory of 1080	4760	msedge.exe	87
PID 4760 wrote to memory of 1080	4760	msedge.exe	87
PID 4760 wrote to memory of 1512	4760	msedge.exe	89
PID 4760 wrote to memory of 1512	4760	msedge.exe	89
PID 4760 wrote to memory of 1444	4760	msedge.exe	92
PID 4760 wrote to memory of 4912	4760	msedge.exe	91
PID 4760 wrote to memory of 1444	4760	msedge.exe	92
PID 4760 wrote to memory of 1444	4760	msedge.exe	92
PID 4760 wrote to memory of 4912	4760	msedge.exe	91
PID 4760 wrote to memory of 4912	4760	msedge.exe	91
PID 4760 wrote to memory of 2492	4760	msedge.exe	95
PID 4760 wrote to memory of 2492	4760	msedge.exe	95
PID 4760 wrote to memory of 2492	4760	msedge.exe	95
PID 4760 wrote to memory of 1484	4760	msedge.exe	98
PID 4760 wrote to memory of 2100	4760	msedge.exe	99
PID 4760 wrote to memory of 1484	4760	msedge.exe	98
PID 4760 wrote to memory of 5256	4760	msedge.exe	104
PID 4760 wrote to memory of 5256	4760	msedge.exe	104
PID 4760 wrote to memory of 1280	4760	msedge.exe	105
PID 4760 wrote to memory of 1280	4760	msedge.exe	105
PID 4760 wrote to memory of 5156	4760	msedge.exe	107
PID 4760 wrote to memory of 4504	4760	msedge.exe	123
PID 4760 wrote to memory of 1256	4760	msedge.exe	124
PID 4760 wrote to memory of 5464	4760	msedge.exe	125
PID 4760 wrote to memory of 5928	4760	msedge.exe	128
PID 4760 wrote to memory of 5928	4760	msedge.exe	128
PID 4760 wrote to memory of 5692	4760	msedge.exe	130
PID 4760 wrote to memory of 5692	4760	msedge.exe	130
PID 4760 wrote to memory of 4028	4760	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/app
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffcea7ac188,0x7ffcea7ac194,0x7ffcea7ac1a0
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,14446886830224586914,4454715375455506468,262144 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,18268977110362958841,8635966601589483224,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,10952842634108032487,7634769653685551974,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,14412475921616326753,17281099746644152457,2097152 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,1543665341921759301,12838849110755697572,2097152 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,2351974654933817391,4472741667178037153,2097152 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,932290323023338322,17661250530915720089,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4280346263971505266,16439393932010905467,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,16135861886631182962,10549400986923828160,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,10532969629838400657,7611029148592595241,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3368,i,1672432536192438560,16219448994906563869,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3368,i,1672432536192438560,16219448994906563869,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,5685433369485161728,7883057583570617699,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,16439009799315555135,17539783530723069603,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,14400749163258159957,1500543068017980145,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,14311220457692176253,3381200689307642859,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,11055277245395961956,15432110988054237994,524288 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5620,i,15943394963705111065,2465197808791905871,262144 --field-trial-handle=2156,i,11154777832734680676,14672852149383493189,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9df6d7f7-ab4f-4fd3-a0b4-cf982c0cb879.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9df6d7f7-ab4f-4fd3-a0b4-cf982c0cb879.tmp
Size 28KB
SHA256 a0eec30f38ba7c3ee7117be3fd54c1e2f6d95f23be12bdd47349ba7048de76a4
MD5 e543260920e33c3711f762f3e8544b75
SHA1 d9d145efd02b2049094fb2368349d4cafa9fe7c1
SHA512 c5f488948e2000fb9a8d9353a5a781ee4553d1e09407d042c68a2a635e7d797d6cbffedce923dc79435c18f66c61ad6c56a8dac5eba8d9cc6d07b9808481bd84
SSDEEP 768:1F1j+9E3AwglkQMgoGGr7cjGfkSsNVKQ3T:s9E3GDsMa2AQ3T
TLSH
T1B8D23B36E858DAABFDE74BC9B75A36479EF0426389CC5AD8D9C81E4C00CB19D430BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e4711c17de5f1839539d4307e721f01dfd6ad7410abf1feb7380d9582a0edc13
MD5 1bb76c4394459d16269a21518d51c3f3
SHA1 4385326cfefd1d418a8e41652fd1e43c44652eb2
SHA512 b1f2e215d0c4ee3d8ff973f63324b7f89dba6758014bbd0b25b6debbde8bc309168111dea48765f0fe9a9fc1fd7210c005454df0181a23fb962c0adcafbda0e1
TLSH
T141E02B76CC22EC3708FD0729A019865AEB1513176A40894F7B3C820C8FB462A89C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 2e233960ea2f4763e52f431273801fd4ebff203bee1206eab467ea80d174662c
MD5 9fe02ed8384dbd2e814dd47226b84396
SHA1 b10dc9bf7e30687798eecc03b8eaa5f1045fbcd5
SHA512 2ebc4f732ca7210b6df7a4093617dd79d3a165289f9a92274e5c8faa29a49031ec188fb7da1189ee5698b0d2b9147f664090378bfff8710c3a58a6aad5840924
SSDEEP 96:2PHklOov2bfXRdRjU4Yuc67yTDFHruBh0Ve7UFJXY/MDTw6:2MlMbfzRjU4YKyTBHEh0VrZY4TR
TLSH
T1DBF18AF12852C25BDB90C136F2EACA14B1F6E6F9E7938F414522A034DC2DBD0062778D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b783.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b783.TMP
Size 2KB
SHA256 f44780af077f00b90c66b6ad617bcacd7578be7ce6139933db5a9df23d6371f4
MD5 257b1881e40317d4586a2b1bcd44d170
SHA1 dd42fbbe712c9afce97d565d5b437b2ace77233f
SHA512 b8e57c4f237ec13fcb39f9200883384d3dc5b84c5216d11180e51021d8ebf3d711e5ae74905993bb22d8a7276cd30cc9b0cb7631d864a2097bccf6dea8bb8bf0
TLSH
T17C515239395311A7EBE1523657F00F1435728AE8F9E39ECA457824383E3A7198069E9F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ef43d5d98c5c2a00afecc490cfc8efa941c4b650a87692397a78b062ff02705d
MD5 af183495dc948872065b18b5a85448a5
SHA1 763b9dcda1ded984a79c138e91c5284918fcb95b
SHA512 42cecc1d0570f4ec1b6184ddcc74bbf0fc81ef5c7615294e72a38c8f8b93d9b7b5e79fc30592a63f5a3cb2f305a5955580481b63fb3700302a7179147734d0d7
TLSH
T19551A0F383E4866DDA1192F0AA187E1FCE2D0914431C3D6AC9E4AE5B93E2571F141B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 be12e5e61dba04c69428d29d21a62b97e3b8b350932c07b77bb1d8c7a3643888
MD5 663709566c57b8de6ee06cc060db8d15
SHA1 e279579bd3471609e6b44961ae463e25f2abbab2
SHA512 2730db49da0357c0317ac98c8a9c9f3a14cd8063fc721476c5c5807f15dc34a12a0f2e8910198766060c05e1397426470e2aa99d913cdcf3fe488248b8e7b397
TLSH
T16341BEF383F4866DDA1192F0AA187E1FCE2D0510432C7D6A89E4AE1B93E3571F141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f8401730130b7293a84748412fce552cf9913683a349584dc842bc62494a429e
MD5 d320dc78a25307446d3179fe9ff43f65
SHA1 a58ff266751a51ce349d51d9ff16546248507fce
SHA512 8039962b4138ed25411b4b1e38788d235d268a44c4a47e840604d996226927285558e4c37ef10036521a595ac76d30ecd44893e1a5995e0b7110366c97fd6491
TLSH
T16731D1F383E8856ECA1095F0BA18BE2FDE1D0510432C3D9AC5E4AF1B93E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eaf92de4d571a3737e2b2cb7eccc422166bd3c314d12399426bb8a1759e2785d
MD5 62457b5e585e16442ee2dee209154cc2
SHA1 5cb9bc12d51a4155f78fa7eb1104456f94d6c414
SHA512 111769f8e183b3aa45f5f61b327676acbedae5e7d721953adff50f2a6832eaa3db2e5e7d9acbb8cfbbb923831a3727d828c9896d7ef30e84030a3d6ac3ae6ef1
SSDEEP 192:sxZeRPyMqZjK1Ml8UQGkF/fIsWyZdlzodp+mHW6+WNzsb/YvC2xBZIg5+eJ:sxZecqtF/fIsWyzuZHb8/+3Eq
TLSH
T16D62D9166A3899779CD7D219FA45BB93D7F90563D2904E4469FCCA0C04EBBED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a00801880065a51e2929a2b474f5848411d9f960bf0c7f72fe1d7f843fcaa819
MD5 0534a9c57f372d3f6b90e292f45f02e6
SHA1 1e73ac0207f02068753d38712f8e8300de7e346d
SHA512 78cdb2fcafccc47bbc8355e4d71724bda9c9a076c5f043164c3f6932bf58d10c4daedac359103c75e02b3f952aea1e7804cf5a9478f6669369eff72ffcc61842
SSDEEP 192:sxZeRPyMqZjK1Ml8MkF/fIsszCaZdlzodp+mHW6+WNzsb/Yvou2aBZIgjeJ:sxZecMF/fIsszCazuZHb8/o3jq
TLSH
T13D62E9166A3899778DD7D219FA45BB53D7F90563E2904E445AFCCA0C04E7BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 54da6ff61d9878147278ed789452a4333fadfe57a68ada9043072f830764dadf
MD5 1c7fb7aa4a9a39bd8f5a5527a551056c
SHA1 10acf20620aed94db3eb6d264d164fb6ca7d9b82
SHA512 957f3b5fb01467aa5f9319ddf1986fecec79fe3584374bcd96574b6df34a2be32cf6afdc6e0284ea2b3421edb915247a12ec20984f0972aca314a250f732c019
TLSH
T1FCD0A7D7F5A22C50FBAA47812B3191AB4B602C9818D0D48CD403281998B0A539731E77
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 950eddf2f4b74ff5a4c6b703aeccc1883182c8dc1feab4b00b111f6250bc3676
MD5 543eccdff54acb60f261586fcdf2d6f5
SHA1 9003ff16e77d0f94c4f5f38e87336e74381dc689
SHA512 f96017811890c55dc5720e27c48ae9a9cd9d681c22fe7f63fc7d64d757fc249c1f1ed638ff7f6eaed3380f65f7c27a3034926f869777e8a06dcdc3dd1fe19f65
TLSH
T153D0A7D7F5A5AC50FFAA4B812B61957B8B103C9814D5D48CD40308159890A539621E77
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe584997.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe584997.TMP
Size 138B
SHA256 04e1677f20dc47dcce4c92f3505191e266cbdabf7a8627bcda3e79632abc3f80
MD5 9aafbe30b31baa4ba0e4dfcadd87139b
SHA1 cba96e44f9e0c3680bd90a96db2c06564287469f
SHA512 a2a2813de251483dcaf41c8523e56fb260ed0863e4bac00b1c5e5e1c3d8cccedac0e567cf4bc896197fa92566c8c391725a8f9716c048810d9933c07987ec0c2
TLSH
T134C02BE3F0200C118B1802400732821F4B003CCC08C1C4CDE043341438F0E133219EF7
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 84bed555332505a08959f9eddc650834d230008070e6d4368050741c898c51d4
MD5 8887e59c54973772262b8f2d2ddc5528
SHA1 04ba9efca61fde45c5c6d540378bd59bbbd7b920
SHA512 5276f5a56ec480153fef2f1e49a7bd531560fba323764babe1fc8977280157e781dd6d2139b1cc9153d1ab371ce26c6f3a7207a603c1ce7de1b6ae448bf8ea3f
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG1:05ppxnY753RNBvRJJdt7p5J99lHR
TLSH
T13AB28A5A703A0211397E3988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 edcffd3c901d190f2d2aa9d580d932f8368397ec9c56ca7ac05b21ca02a81ec3
MD5 2a13372bb6b04e2da3be4c34c7a848f9
SHA1 40ddd6e6b39060ba57b6eac9c26448ac3506a760
SHA512 f1651272eb4945c416f310d12342f0248b30ce04fc51f7713b7fda8d4b91c3bab155db5122f4ec1fbd84e3dd1e27fe0b413ebb9e11cbfa22ba2c06d5329e49aa
SSDEEP 768:pWFccps3QwgbkUeBoGGr7cjGfkStNVKI8p0IL9:os3i2sMaXAI8p0IL9
TLSH
T138C25C32E858DAB7FCD64B99A74E3543DEE45227868C99E4DADC1E4C00DB1AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d85352561cf8a1dfe0aabc32ff02671d9d9d942b2858840c64bc42b6ca75ec0c
MD5 30aa4d0d2f6cdb348d20e45913339697
SHA1 1f75124ca82494e38206f7a601a59dd0764aa5ca
SHA512 ec8f2abfe3821e485c3c2e395a878a5e36b6f81716b7db2e2d1e15866bab2c396f983117371cb622ce3274e72ce9b4fc85280dfa9bf323533584ef67e6e6e368
SSDEEP 768:qF1j+9h3AwglkQIgoGGr7cjGfkSgNVKQ3T:p9h3GbsMaKAQ3T
TLSH
T1B6E2A2F298D79977E89E4B87A73E2D429ABCC153B5885994B7C80D0CCC8A1BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a9ede6f5bd8f5e7e8e7fed6c7ccb62ee25e64de2f7fde1e744ad78136c923c5d
MD5 6a6df2ed476273a249b6ac90b46ea005
SHA1 bdd7d539f1d1e6b31913c09a174b0badb71713c2
SHA512 f867a41c014f6fa08a14e6ac5da518ca87d2c11862feb6d3848953867e0edc823313443e0dcb347288f7e4dd84ddc1e62ba03b1983602a341aab820913310a53
SSDEEP 768:p5Fccps36wgbkUJkoGGr7cjGffNtI8p0IL9:Ls3sksMattI8p0IL9
TLSH
T13BB26C36EC58DAB7FDE74F89A75E7A03DEE4122785DC59E8DAD81E0C009719D030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9be79b7270f55c058c2cca2944088d2ff42d9de1ca1a5ff0aa876ac5c51886b9
MD5 fda19e3697dd3d772efb83d2823dac4e
SHA1 83f9c54450de593ac72543108525b2e996f5425d
SHA512 1aaa69c98a102676b2c6d45c6aa1bf7694163135280e950b479782ffec5c97e1107048fa236e5d29a66cd814dd794a83064a77f05dd034beda3e3831ec01c864
SSDEEP 768:pnF1j+9E3AwglkEgoGGr7cjGfkSsNVKQ3T:49E3GisMa2AQ3T
TLSH
T14FD23B36E858DAABFDE74BC9B75A36479EF0426389CC5AD4D9C81E4C00CB19D430BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bd5b7ecf41632c3f589bcef8bc5730a46eaaab56bcb10483c006e69a6080a90a
MD5 2a51a7c804d00c8ac320d2300b423feb
SHA1 76d8166116f803259416a89047267655e8309f35
SHA512 9c9be60ecbe71d0dae55de88fdc866dd5dcefd7c392c9363b12ef746154fe930d62bdae4addcda65d91ddd08b181cc474582798185c471ee02c9b1c9a00c5393
TLSH
T1E641D95CAAEE1148B3B7AB569BF6A86D447FBC372E06D45D10110E4F0A62A00D8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5156-814-0x00000217937F0000-0x00000217947F0000-memory.dmp

Download