hxxps://discord[.]com/channels/1374108923782631490/1374110655954817135/1468472487070404845

Analysis

user interaction
yes
max time kernel
12s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/channels/1374108923782631490/1374110655954817135/1468472487070404845
Sample260719-e476mabx5n

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	discord.com
10	discord.com
22	discord.com
34	discord.com
38	discord.com
44	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3844	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289090579234381"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{0A0EF41A-F184-4B43-99D3-9EE2DC1B22F7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4BCE72B4-87AC-4CCC-A007-EF7E94AFAF9B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3552	4220	msedge.exe	84
PID 4220 wrote to memory of 3844	4220	msedge.exe	85
PID 4220 wrote to memory of 5012	4220	msedge.exe	86
PID 4220 wrote to memory of 5012	4220	msedge.exe	86
PID 4220 wrote to memory of 5012	4220	msedge.exe	86
PID 4220 wrote to memory of 2148	4220	msedge.exe	87
PID 4220 wrote to memory of 2148	4220	msedge.exe	87
PID 4220 wrote to memory of 3116	4220	msedge.exe	88
PID 4220 wrote to memory of 2296	4220	msedge.exe	89
PID 4220 wrote to memory of 3116	4220	msedge.exe	88
PID 4220 wrote to memory of 3116	4220	msedge.exe	88
PID 4220 wrote to memory of 2296	4220	msedge.exe	89
PID 4220 wrote to memory of 2296	4220	msedge.exe	89
PID 4220 wrote to memory of 1160	4220	msedge.exe	91
PID 4220 wrote to memory of 1160	4220	msedge.exe	91
PID 4220 wrote to memory of 1160	4220	msedge.exe	91
PID 4220 wrote to memory of 2836	4220	msedge.exe	92
PID 4220 wrote to memory of 2836	4220	msedge.exe	92
PID 4220 wrote to memory of 2836	4220	msedge.exe	92
PID 4220 wrote to memory of 3976	4220	msedge.exe	95
PID 4220 wrote to memory of 3976	4220	msedge.exe	95
PID 4220 wrote to memory of 3976	4220	msedge.exe	95
PID 4220 wrote to memory of 4836	4220	msedge.exe	98
PID 4220 wrote to memory of 4836	4220	msedge.exe	98
PID 4220 wrote to memory of 5108	4220	msedge.exe	99
PID 4220 wrote to memory of 5108	4220	msedge.exe	99
PID 4220 wrote to memory of 4816	4220	msedge.exe	100
PID 4220 wrote to memory of 4264	4220	msedge.exe	101
PID 4220 wrote to memory of 4816	4220	msedge.exe	100
PID 4220 wrote to memory of 1688	4220	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/channels/1374108923782631490/1374110655954817135/1468472487070404845
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffc5d49c188,0x7ffc5d49c194,0x7ffc5d49c1a0
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,14868379342174773130,10115211842713921748,524288 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,11867874942259522022,6399722866854424597,262144 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,7801942167813548913,14133220308123883143,524288 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,16475638508457066216,10472762001104456696,2097152 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,2201175575543367816,1444700805317963114,2097152 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,8808328519574305318,3986355803919217814,2097152 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,7649584838912668308,11967493929121308018,2097152 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3688,i,865072661683523102,17192705938723828462,2097152 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,3158588523083644419,5139649734436775105,524288 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,3132783834600224166,13042532505697456478,524288 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,10408087600985292524,10182658072238470276,524288 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,16728799614283933064,4648846332535779104,524288 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,15515472880773296879,8549329535565083071,524288 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,15515472880773296879,8549329535565083071,524288 --field-trial-handle=2348,i,5261003651719299442,1105858625135874299,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 467bfd13cbd08aeac75b0cd8abcf824ab83751f1dd245ccd1da220cd9fba4f13
MD5 0b5cc1f44f03097a956255d6c99e5d8c
SHA1 3349ebc49ee5cebbe047de9d929630cd93e30756
SHA512 9429290850802768e1e55e6ae084a4fc2abd38d089eb40e6bb1716ca871c81e611a1fbda6f8ab7c5d5f1587e4e3f9e7a40c09aac50e06c5be2c76907ecaa69d6
SSDEEP 192:sxZVR3yM/jK1Ml8Mkv/fns9fUBV5IdpEwHW6+WNzTL/YvqfjJMIgrJ:sxZV1Mv/fns9fUeBHbr/T+9
TLSH
T1F542E8126A34597BCCCBD20DFA51BF53D6F55562A3900E449AFCDA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f754f6a2b5925dd1c7ce3b796a84d29cb238092aeb8330f800f734b43799e359
MD5 4638e7178293046032b64a3d320e2b25
SHA1 b376bae6ee23bf98f714e2bfe011fcf0b6125700
SHA512 6a2493c94c2ac910ecb6663274369780332cec84e2bd794000fc5ca8db331cba2c08c539b38445d6e925ac993876df0c825111b674c020b00f7799f563adb371
SSDEEP 768:SIRHseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppRAroHiWX:SIRHseJ3xWvhfwnu1jaVcL88pRLp
TLSH
T117E20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 5b94b18402774dd32a0102ed535611a1035718ac65e191fc008c00da5959037c
MD5 db28136bd577f1dd610d77f6bcc4d738
SHA1 b6f9c636c1fb99e6d95b8d7cfc626913d65479b9
SHA512 f17da5d01030c09055dcf171ebf20026cd66b5f43b560ab6dd27c5671fd2c3b20aaf15ba3601d7cb1029661c4f996d25042e8b9ee4608b15deb7f0b2f719cb1f
TLSH
T1F7D0A75BF4764451E7BFD792173119AA8B213C8899D1948C9417382818B4797D212EE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5838af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5838af.TMP
Size 138B
SHA256 df708cf9607fb3d876d062c2d141042920968ea96ac51801157a0655d5cc0a41
MD5 b846bd31a1162d040eccefe9187b427d
SHA1 a66f8522dccef94de1df2c59f3633f24dcfc9404
SHA512 24e120bae6864f99129ef83c61582a7b681cb7b48f633b2e9e3a9a8d764bece294fcfcfb95ca9790ffca630e9187f1b982245d500a5f0ad2f2f567a2d11d418e
TLSH
T194C02B67F0220811FBB7A3410332057D57003CCC9EC1C08CA06738242470E276106FF2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e84306a656b4d876e89da398c92355b3e71c15f8d412ab26e94771b1dac75e53
MD5 aeac61ac5680703739df626f45d026f4
SHA1 24eee83dac3f981b28e1a5c2f8059f27e930eb69
SHA512 7d1d0fd0cb5f6743f8cfcd28bdafa9d4249294b4f172a00a3ffeebfd3afefc7917ee86f5a8a5a1e1b4355775c71307fd41c222e7a1f16f49525bb3274d976ae3
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Ed:KYHIhKggkXyVDIdKYMAPyJiI/KXq037
TLSH
T14C915806743A02063C3D2888B2E6D6364F4575637459A4EFBFB844958E67E220EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 991eeeefaaabc2b9ba916b07e3ec5fc29d9594628197ebd33906bc1e4c6b49eb
MD5 f90b98b8a2f570183bbe3a81a6314ec3
SHA1 0b52f323b130deea8fc2ea4322d369a101a69552
SHA512 1d922a38a631a62bb5a5d32ab574f8895d944c6932aa8d015cceaa951432a421da356a0825166db19b898ee3172a30deca17505f38e68a3ef6d3c252dac79d1e
SSDEEP 192:uxTSNWMsnMcPPQLz3XX9VofsNVNQb4jM7SLTQmiU1KgG94MTH7+FdLJxtQ+2p8zc:4tNn/s3n9SfsNVNU7cFcS9d9xW+2O1NK
TLSH
T173624A326C749C3BADA2A985F04B36174FF8926B96C52FA4E5EC6F0C05CA66C130AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4962e819db9ee063f5a67a3cf4766e51e35ad5612de516c5635ae439241a3448
MD5 23bb0347929c0bc2aa2fa0e351d619ab
SHA1 ff8c948f29b928954cfefba0c0ad1301a897b8b4
SHA512 7863594d3434d859f1d739ab0908e5d47449d1fc4f365af7a61043a3ed8227b38041faf48b661123183b9b7bc93dd1e607b769953f0a3595a5b162a31f40b041
SSDEEP 192:PON46vMZPQmiUylg4OhTH7+FdLJxtQ+2/80ImqDVU/u:PON46UZRWOmd9xW+2w1U/u
TLSH
T19A120A76A8649C2BADA3B546F08B36170FF5926BDAC56B50F6DC2F0C01DE65C130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f585a65d-81d1-40d0-9cf3-b7b6d0b2cc95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f585a65d-81d1-40d0-9cf3-b7b6d0b2cc95.tmp
Size 8KB
SHA256 49a636efc4f03073c71e35b17af17c2fb49ecd89f827ffe7cb95ad9e3f2393db
MD5 4f8786a29ed822e7cab1eece0b1910d4
SHA1 fb26c90daf9d42a52317d805312db80e5a950875
SHA512 9d2fdb13dd226c3df283ce94ab5e018335d53bafd199c4d8f2cef43ff7d7d96a664c4c9e318ba9ce654b378149d17b07a5a2096b2d123b117917a16140b5612a
SSDEEP 192:lONP6vMtPQmiUyjg4ThTH7+FdLJxf8479LU/u:lONP6UtRqTmd9xHJU/u
TLSH
T135020935AC786C7BEAB3BD4AF48A37171FE4516FA9905B54EAE82F0C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c617af64aeccf37dcbbd09d7c100d43ab56bb1e693f3c85aacf717770bc29d71
MD5 b0a6196c133c83782790b5954acecd2f
SHA1 bf7b9c129ac52bb2906c84630f62917d44f83efb
SHA512 8c8a3bb31179eb6c55d4cf64b54071f4d02af63726f6a49c658c505372b391717eb4a9c203f93daa6cba4f257a87e872861032cd6c2f071bab3232cbd9a72040
TLSH
T164412D59B6EA1144B3B76F5AABF2A86E487BBD372E06D45D00110D4E4623B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads