discordrat | a9bdc7746f596362ff3af8d9c614a875926068820318a3360bbc530e8d0022ab

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rat.exe
Size 78KB
Sample260721-c3asmacx6m
SHA256 a9bdc7746f596362ff3af8d9c614a875926068820318a3360bbc530e8d0022ab
MD5 3e4889b90f7707a74789a51bb5ca8abe
SHA1 4aa46fc8ffb87c96044c6c192ae03f5344a7a884
SHA512 e8071e772c59e34d5dce1da38e2fa02bd8f7aed460cbb6818c441b82f83cbb111f48a1bd5d84a490dd3af337754abb87699ff1b822ad5a7e60ca81e519de6c60
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rPIC:5Zv5PDwbjNrmAE+DIC
TLSH
T1ED73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUyNjkwNzI2NzUxMTc1MDc0OQ.GnUOPf.9iZj7I1Z3UQcqLPquq50IaSxGg7xCKYhSBxmiw
server_id
1528948406054289408

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
6	discord.com
10	discord.com
13	discord.com
14	discord.com
16	discord.com
97	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2992	msedge.exe
1312	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290750693579174"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{644BC8DB-86D5-4697-8BC8-86723D192F0D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{1E3926ED-502E-48D9-87D5-EE80BD79F86C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	rat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3844	2440	rat.exe	90
PID 3844 wrote to memory of 1328	3844	msedge.exe	91
PID 3844 wrote to memory of 2992	3844	msedge.exe	92
PID 3844 wrote to memory of 1788	3844	msedge.exe	93
PID 3844 wrote to memory of 1788	3844	msedge.exe	93
PID 3844 wrote to memory of 1788	3844	msedge.exe	93
PID 3844 wrote to memory of 5160	3844	msedge.exe	94
PID 3844 wrote to memory of 5160	3844	msedge.exe	94
PID 3844 wrote to memory of 4632	3844	msedge.exe	96
PID 3844 wrote to memory of 3224	3844	msedge.exe	97
PID 3844 wrote to memory of 4632	3844	msedge.exe	96
PID 3844 wrote to memory of 4632	3844	msedge.exe	96
PID 3844 wrote to memory of 3224	3844	msedge.exe	97
PID 3844 wrote to memory of 3224	3844	msedge.exe	97
PID 3844 wrote to memory of 3764	3844	msedge.exe	98
PID 3844 wrote to memory of 720	3844	msedge.exe	99
PID 3844 wrote to memory of 3764	3844	msedge.exe	98
PID 3844 wrote to memory of 3764	3844	msedge.exe	98
PID 3844 wrote to memory of 720	3844	msedge.exe	99
PID 3844 wrote to memory of 720	3844	msedge.exe	99
PID 3844 wrote to memory of 3248	3844	msedge.exe	101
PID 3844 wrote to memory of 3248	3844	msedge.exe	101
PID 3844 wrote to memory of 3248	3844	msedge.exe	101
PID 3844 wrote to memory of 856	3844	msedge.exe	102
PID 3844 wrote to memory of 856	3844	msedge.exe	102
PID 3844 wrote to memory of 1848	3844	msedge.exe	103
PID 3844 wrote to memory of 1848	3844	msedge.exe	103
PID 3844 wrote to memory of 3264	3844	msedge.exe	104
PID 3844 wrote to memory of 3264	3844	msedge.exe	104
PID 3844 wrote to memory of 2204	3844	msedge.exe	106
PID 3844 wrote to memory of 3984	3844	msedge.exe	107
PID 3844 wrote to memory of 3984	3844	msedge.exe	107
PID 3844 wrote to memory of 5884	3844	msedge.exe	108
PID 3844 wrote to memory of 5884	3844	msedge.exe	108
PID 2440 wrote to memory of 928	2440	rat.exe	112
PID 3844 wrote to memory of 5660	3844	msedge.exe	113
PID 3844 wrote to memory of 5660	3844	msedge.exe	113
PID 3844 wrote to memory of 5660	3844	msedge.exe	113
PID 3844 wrote to memory of 3216	3844	msedge.exe	114
PID 3844 wrote to memory of 3216	3844	msedge.exe	114
PID 3844 wrote to memory of 3216	3844	msedge.exe	114
PID 3844 wrote to memory of 3656	3844	msedge.exe	115
PID 3844 wrote to memory of 1340	3844	msedge.exe	116
PID 3844 wrote to memory of 3156	3844	msedge.exe	117
PID 3844 wrote to memory of 1768	3844	msedge.exe	118
PID 3844 wrote to memory of 1768	3844	msedge.exe	118
PID 3844 wrote to memory of 1768	3844	msedge.exe	118
PID 3844 wrote to memory of 120	3844	msedge.exe	119
PID 120 wrote to memory of 3988	120	msedge.exe	120
PID 120 wrote to memory of 4412	120	msedge.exe	121
PID 120 wrote to memory of 1312	120	msedge.exe	122
PID 120 wrote to memory of 4412	120	msedge.exe	121
PID 120 wrote to memory of 4412	120	msedge.exe	121
PID 120 wrote to memory of 3212	120	msedge.exe	123
PID 120 wrote to memory of 3212	120	msedge.exe	123
PID 120 wrote to memory of 4568	120	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\rat.exe
"C:\Users\Admin\AppData\Local\Temp\rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.google.com/
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffd03fec188,0x7ffd03fec194,0x7ffd03fec1a0
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,5449498328656038004,15029042201945512467,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,16283586244578355286,13831090700731951234,262144 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,2067362190359084839,526005074184094663,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,9068470882555235393,6566620050262189644,2097152 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,17862509520492986184,16937756789050640860,2097152 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,1850616347724898519,15500063812524847436,2097152 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,2054920839444576112,2658912511536265925,2097152 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5344,i,10725295255271365591,16630757735129276457,2097152 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,17588146456153497890,4164940319621033901,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,9908111633737642935,14882175504309770610,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,9439078677203799223,10235671143956330480,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17246503238777771057,10546474125918914774,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17246503238777771057,10546474125918914774,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,7884389273390476173,239127949505650011,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12120914402612179751,13924577593897161589,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4816,i,10339242890756849583,8001808987200292757,2097152 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6092,i,11611050335422055412,13690371177365196703,2097152 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,2015846844613935204,7577219085188072719,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,4373774804249409771,10644194044555477045,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,8233613641904356643,706780751088342384,524288 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3680,i,17441025274616471500,16159025824098835748,2097152 --field-trial-handle=2204,i,16169560637282845346,15421277076430908046,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x320,0x7ffd03fec188,0x7ffd03fec194,0x7ffd03fec1a0
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,5206183591238177454,11651357621434807049,262144 --field-trial-handle=2204,i,10712709458208686132,5961661535418347030,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,5150506689397217662,6351918492611750073,524288 --field-trial-handle=2204,i,10712709458208686132,5961661535418347030,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,16607339359442380294,1986638008775303392,524288 --field-trial-handle=2204,i,10712709458208686132,5961661535418347030,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,751384024472761756,15686126795564957116,524288 --field-trial-handle=2204,i,10712709458208686132,5961661535418347030,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,751384024472761756,15686126795564957116,524288 --field-trial-handle=2204,i,10712709458208686132,5961661535418347030,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.pornhub.org/
  2⤵
  PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a87a92f025345f8c270583853949b7d8aa150a66f154e562eaefc3bff45e841
MD5 559b66b7eb2596f44f0744ba3ba7dcda
SHA1 d682f4882759ce09b2b35b31924bf940d4689e52
SHA512 11b3a440eb4caf4053f9e7bf14f528499470f75260f04d9d9421ee9f4b7ffe026beadb29af8417073955f76830c84a18934b4a255f832c79fb728727d19d2465
TLSH
T15CD0A7A433B67516E7182575A5114310B25698523A6A9202D150850E5F3F4D246CB191
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72d4580e809de33efd04748d907810b866a390579423ae8e3640de275b38d840
MD5 aebc24173430592c716eb6c6765cfebd
SHA1 361f5fb8f51ebca0f8ebfdc1dff714489f27f00a
SHA512 0dfd878ef5ea5b01eca4ac65e496cb011011c9484f384cc6bf3d571c44526f18808aa6675e99549bbad182bbbfe5f926442527c24d0a23030ab11fd629399de0
TLSH
T123D02364B769F855CA093671D4714311B5515D70355BD15662D1400C6D3F5C3D6CE161
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 165b3811c651394654d97c840304f39a8633b0f09dc5147848373278c204fc6f
MD5 406e6e17689d7000b18485748f942f97
SHA1 3744fa48df4b0b2f2045ae18430e6328285a702d
SHA512 4e809f59f81ec80410ec8e84e30b1cf341858ba67d8a4abb0bcd219c2b921a7d3b4ee35639f34bdcaae52d41209e47597229574493d202fcf53c7621f52da1d0
TLSH
T125E02BAACD23AC2B18FE1B1DA0545B8AFA51136B2740894F3B3D860C8FF16365649C2C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7bfb55e19d24d8657035c462701b5d72ad1d49d4e974907731ac50f46ef48b73
MD5 37c5cb632cb69193b05b6a8ddb92843a
SHA1 1f7d1750d996ae8d870407c57b9ae4ec8c808f9e
SHA512 0c1c93d8ce0af4b3465c1eefd5241bf5324e25ec050b5c577cda43e26dae47c7bf0d8d31c10df7e251125c85abad2e80a32dc3519ae2df8fc2a77f909b0f64da
SSDEEP 384:FTyrrcPlI2ZzVAE+rcsJjwD0UpUswtROrp:C4Pu2Zh5X0UpUHM
TLSH
T11E13E67E3A212E5BC2C7953D43ABCB3A37B0E934D6C25917163970546B12BB38E2F641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 9bf0b59afb57c5aad8d41e36267d8ad7a19539b08fa77c6842f07b5f28ae7cb8
MD5 f4e075c871d83821f4eee2cf08506d41
SHA1 4b9151c1284d738b554c423a1d0f491a5a4afb9e
SHA512 e304d61d8640e2a1b2107b64891f0fa81d7cd47cd5e79e685814042ef4e3993d01980471b4b445f8fd0f5e56d48d3fa70bb933ea53e3a815829a6624ca0182b2
SSDEEP 1536:YTL/YxKL/l4kAC5tBhOpfMRkNjegx4Xw2YZ3L3q/chwG:6L/Y4L/ek6pfZpxa
TLSH
T1A1447FF71940948BCFA842F58287393DDE37448F6ED5ECDDD6788C911820F72A2BAA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 15000c2d67f3f28a07bddb5957142d03428602ae08b74cd407e7b816b1a684c6
MD5 55a0f9b797808aa281e69694b76e5035
SHA1 4c8cc1bbb85578fc5d4561a2b83e911d2f53f30c
SHA512 211256c4d666436609d3eac2ca2aaa4868a6962d457958485ee2e672349fe7d7e46732b2887d20d6ad0db35f8e4351b9c1bd400c7ecdf330901992b888b060ca
SSDEEP 3072:Jv9G+HN42FBiHK1LOLU4jhnOzXil2vz6ybTuS0pDgZNNWgEW0Yu28DrNA1ShSrG1:JQ8u2FBF1L8hnOzX4Gvu980ReVakA
TLSH
T13D255BFE8F242892CEA28F7574E0D8123EB425C3B58AF1C69085C6E935C2FC57AD516D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 7acfcbfeb3cdb094a2bc8c403661ac0c46922b9cf40afcaea787f57eae11a424
MD5 2cfd51b0c5a19c220035e32c474c5374
SHA1 005d9a88b906ef3dc52a1061f1a651fa93187e5c
SHA512 184881dcd3de6d95215cd2a8164beb79ae78a9560f51bd706de2105a539300786e92be70ed6987a0267c03753423c90adf4563c70f6da4a375b6eefea31a11cd
SSDEEP 24576:JHAIZYfNbAoGXPW7lB6KXxHeZnA/vUKJuA/re:JgIyFb1GOD3XxCAHU43e
TLSH
T14016AEFDCA685887CD669930F5F0E9473C7413C3F995C1D38888C98421A7BC5BBAE629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 27f22d97fa7e035bb5d8632c8cf30e8ca98026597e96068ec7911e3813f4b05c
MD5 60660a56d7d67aa62e2b59181f15c3f9
SHA1 997d0cb280210c7ac101444157cd5f1872936727
SHA512 0adb392d9ad1e5ab3743431d0be3ebf99850dd6eaa4118738c5b6c54fc89487346add742ea24d8a25b5367a7933527716f91c24fa30060b5615bb9ec55cdbc41
TLSH
T1265184715B6426FFEB6E80B573C7E89E327284AB37079E62178479F29D023B71211608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b5a5acdf6ec608d6d308a6fdbb7ae28aab5da250dd890bd72f17a892a5b0c3cc
MD5 9fa1784f4fc93b13fead0b338b2d106a
SHA1 d54ad3834ec8db6fd5e1d406f0459d4bbabc5c76
SHA512 26875a4c3d39a3739ab116f1c329d5f8a71809fa9df7a6cfda92f0aca1c7b72324da374881f095e2ae1ec0cb5141abd8c50ce564035cbcb25f22d4a03069fbe7
TLSH
T186415F706F352AFFDBAF95B617D24A9C3271880B33472F5117946EB04A463BB111220D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 40a50e981142faa31631865d1da72ff35f34f62d1235aca6ea009e8356c66d81
MD5 de67e6af921723c52e7824078ffdce78
SHA1 0fd5a860476dd79529e34561b92c3f9d37fac403
SHA512 bb4a5bc8343a99b5efd3d0cc2b41d7190000624b9cc34111ed7c60a7f86493a722677791c78eb632be9c32043fc6d8eb16da657987decc2c5cb90e0d4c2539e8
TLSH
T1F9E0DFD8A5CAC2BEE6207CD682345B1CE6803843E6A9AD03570888E17783001B3A66A6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 4f5dbf65efde8177cf61e5730791c1bb42d5a04dfdd9791cbed3886d3b615a0a
MD5 aa15949d2139df54f27cbb269eab0600
SHA1 bc255ed6a87bc6b7deaa6efbeeb67aeb371f130c
SHA512 147858b1ec0c78aa82f31f5d7b1323a8c76156e19c9bd686e2adcdc6857e79ebd7592bf8d0e29249c8cef4be074593b009c4d41e8fc082439c01e54a8560a98b
TLSH
T1B1E0869814C9C37DE2246CE7C36C670887D13566E6887913570E8C606202645B3AE7B0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 1a899860844a409659855977530ac4e76ab6f81ce324f2e3916b3d1fa6b7b8eb
MD5 a0932c36e29c70fd9462869106b6702e
SHA1 80bdae002e64ad059e5a872e14c34149c7e0d2a0
SHA512 16874337e02f45c664c1f5ed93edae24e6a4817181f477a888f159f2b111ac42a57ab2dc18aec3308e7d0709687c7964341b9afcc9f8f122ab184d23239062df
SSDEEP 192:EaHZyQQRAt5UAlOPA19jq8QlCmGjq8QlCLi:T2uUu8K9O8QlZGO8Qlci
TLSH
T114D23ADFAFB978A7EF8E4CF2313950B6EF37E2A54A8A8C54704458350CF4A95502C7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 9797961531a5cb91d2beed3d115a68fc6514ac2180d6d35e2333b2c1a5f49249
MD5 992cd4aa61d7df56785257707c5d767a
SHA1 3127bfca91feea3c976dff8077559649cf011aa1
SHA512 3b51ad7b6486abbccc05e75c44a7de3850327e15ea5a2d7a87a4a33e22807379ad036fbefad4e06add6fceee7b19faaacf2c989f0a048ddb0fad4eaa1e218e23
SSDEEP 192:TA+VsH+bF+UI3iWGVoWN3qL/R0PVVVV63:+IkUI3ijVoWN3qL/R+A
TLSH
T18124401F5F743611CDBD817528E644A35D6EF03FCB5266CA687218B0CEE2652A06C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 8a3938e23867177e67f07222cd42d1ca7178ee8f27f73b23e0a736342c15ff98
MD5 d4f624c89f735c1e29aa08a2bce0a6c8
SHA1 67ee3ffa2cc83bf94d2fb0423deba89640e1ba38
SHA512 8b94ce73b331d20ebfeaf561e4d7bcb4a0eef42673fbda9a396ad66827026c48699db8929f57c0fb5f0e9609247b56af0471bf56ce16aeb35d19c2f18b6db44d
TLSH
T1E831E46FEFE4C046BB8F80E670A77539C19EA4B97A8CB7EDAD811C0E8E4409D1519970
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 36d84eb8d92b922235e979aaad72ee903111818e2c94b99c592de9645623c47c
MD5 a11d31c9e41d01ce6a78898e7ce2e2a1
SHA1 5d04f571eeb3004e047189f108ea925cab9b255d
SHA512 21ccefd3bc89bc950cfa6b57cf05e26c88368e5123e7d348cb9a5c1d29f3a6296fc52ce5ae793473233718e78a794dd62262edac16e9a1fcf0f0b71c9f356f54
TLSH
T16AE0D8A454CDC3BDD215215B8328BB48D7A03606E6886A455B0DA860F606044A3A15E1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 520cdf3caa5c3fb75f500cd54569f744b6197ec89a8afcf0bbd75fe192b2af11
MD5 74b2c364edbaadab57ee5cd057ba892f
SHA1 eff17cffebac34d7251428bda37a51552a3ad0a7
SHA512 3f4584ed5c363a00b883936e4f5d37972d9105c703d840a8b77ea5a3fd227975597b2c091c77e29a59eb9884ebd5ff482d3460153252257c58681ff2a49a7724
SSDEEP 96:dDeMatha9AAT+jC0O1kmECbYGbwL4yOdRB1y/uzeqi9A6IxNuASn1dEslG1uhzQb:dDLaTatqj1yECbTbLRu/jrC6ILu/3Qb
TLSH
T199D2D72FAF6C28C9CBFF54F251D409262E1F0455530E9C9D90E0CAB44C31692A7F7BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 78a27ad270755527185bab36a1c42d30a4ef2ba27bdbca3ecf3600baea10a8eb
MD5 0e4f7b1e5121a9a6b45bb7ee88f344e9
SHA1 f2a63e1f77950f0e3ece028b15d67727feb1c971
SHA512 f2070acbe5edca544837edf99270b5a759f40151036703319ba868c7aeb2e7a8f8361e7078de65db0c6a0870d835bbc8a09e83cc6add8cf664044d4d1a66f94b
SSDEEP 192:DftFCQ+0kbifGWyxjfaR1NpXsYbufjuG8NUjSYViGGwGVve5Gw2dMGLXXjE:DftFCQ+0kbifGWyxjfaR1NpcYbufjuGB
TLSH
T1D53290F7C3D88A6DD80156F497286E2BCE2D0924572C3C2AC9E5AF4BA3E1571E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 d743073d7e7501e709a539dcc008e14418cf0027dda9baa4d7e6ca80df488ffa
MD5 cf731a8da86edd4518a7eb91887f1ba0
SHA1 09e592df786836468d0e5bfd23122bd1c42fa1e6
SHA512 8e36ce1b18336fef80be98cc5fbcda90d65ba3cfa31a6c0855e09545c64913c4ffd1908c00ca625d577869eb4610ca96ccc5798ee2cbcc62e53f677779df51e0
TLSH
T1FF213D57A1AEB5BB007889AA0E587C46397AA4320951F4F9C95AB26CB0D2CB71F12436
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 737049c1c5c30e9148089818410cbd233629caaddacdca1aa5bfe094046e6052
MD5 3e0e07c5560b3143d31eb0f98bc54b90
SHA1 597b4edb02c1eb5588ca58bbb9fa6f6a235501cd
SHA512 c82d7c2d09e1467811a4dbdf2fccc246dee7236ad4d01eb91118e38154f9a77bcdeee47f15afd5407e844c7071333d43ecc379d53900befa9308fb1dfdc73312
SSDEEP 192:sxRjRFCA/fUs00BMxfygZ38ITpzoA8pjgE/g6+WN988/YoxCY3GcTIgtJ:sxRj+A/fUspMxfy+MIQB/5x/Uar3
TLSH
T10032B6166E28AD3B5CC6D219FA55BF53E6F91032A1D46E48B6FC8A1C04E66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 420a73f6a424807463da5e5f0c1e1a66b734951c618931b238418c302e3d4c81
MD5 b67c1a14fd2ae2bfd328adb468697172
SHA1 0d12b77235760530a2f37d7a7fdf4759c1bdf63b
SHA512 272ff4da8dd2146e5eefc5c1f1f964ded9c5d619ad5f89e318c950032f954280f3a8599e40aa5786a5ad658b047521e049c25eca4fbe44dda7d4fbe5de2f9016
SSDEEP 384:sxRg+A/fUsXMxfV+MIbS/5xv/nJ/VOarX:sU+A/fk7j/55J/Qa7
TLSH
T12652C557A9345D7B4CC6D219FA15BF67E2F90032A1D45E88A7FC8A0C04E7ADE230784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8226d511a9a57e789e2805eb3f347c2aa31d6ba3462848720409e4b1f623ca0b
MD5 4ac8ca8d3353f03592136cee0492afe6
SHA1 3db2819769f42b917b8b0962e9b476f8e655984a
SHA512 fe835333baadb86a6ada53c4da4c4047a6bdbc68ff11c98e9fcbb3cd35d0255ad16fd137ab7292e110eafb9ab158edc4aad657c6f7e37512a35619d1bf04bc40
SSDEEP 192:sxRgRFCA/fUs60BMxfygZ38ITpzoA8pjgE/g6+WN988/YoxCY3GcTIgD7J:sxRg+A/fUsXMxfy+MIQB/5x/Uar5
TLSH
T10742B61A6E289D3B5CC6D219FB55BF53E6FD1032A1D42E48B6FC8A0C04E66DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e824e00084d7e8337bc7e30cd56216d9dc533cb9769237afa05c7b9e6abd0d2b
MD5 f07a85321b32e16e94d96908980dbda2
SHA1 eb2af51063a68efa23a2eaf7c24ec3d395bc6119
SHA512 8c194f4610c05cb8cb9d6cfd03e3a8a44253e96adb3d29e274e280ee5bc5d74a6de43a36848d78d475ef0bea9b0348b060c7bcb3d173bbcc73b333e44aa2e8a2
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV+eBVuwgro9ne0t:j26HRUE7MRWgs2f02u1jaleB4wrK6
TLSH
T118D2EB7B640DCBBF4F800ADDEC297EDE6D6802CB9698CD8447FD841C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 1KB
SHA256 864c3d9d7d9deb26ccf83dea3ca3c1091a85f10b8308323ffdbb5a636a046243
MD5 1280c67fd606ee4405536a95611d3406
SHA1 d2db9dc8800369bdfbcabf800f35ba4e563c2863
SHA512 a6b9ec05675cb086801ef632b2d525b9ace1ddb4e54ff450c8c4fbfaf43133ad182e22c71757e055f06bf3bc9222423abb3b2aeae9328d74964ec65987e2e6e2
TLSH
T11D3120A3875C43BBDE8040F368996319BB83858CCFEE9EE7C1FAA0D545D841A10366C1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 1123be4087bd54795d4187a76e7c9fb40526d2a51f4cfbd7580065c14729cf80
MD5 a37ae7aa522e8578d892a59f3e36a37a
SHA1 eb4b0c466591bde8207f2043dc123b2e59d8d151
SHA512 6c6efb39e6ecf76dd543fbc9ba72da9f44c193d365bcb04f9ae29dc6f9ea8162aa3fc1112fafd626391142865638b07e7b5ba8481e15810b4fa0bdb061b1e9b3
TLSH
T1D2E0269425C8C3BEE039309386388708E2E4B447D2CC3E022F09C8A06646508B3B36E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 a664b140ec13cfdffa1143d573443895c77fffa52ea92a0b5464c7edf1590892
MD5 5a0c503062c2c163fa843bbd2815ae36
SHA1 f7d9087f7e9e2a571fbc0a852a0d0a95915bd19d
SHA512 3368c85046853dedbd8c186a4ae08aed8c615ebc8a65ff1cd67199f0ae592853109a2e6438b2d4debb7673529f96ffd9bfc77c136e02c3c6df84503c1840313d
TLSH
T1B4C09205C80FA842CA280B78BE25A59A22588A78890022668978D499FA39140454260B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c1218.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c1218.TMP
Size 48B
SHA256 d687b0213e34addc0927909f7dbb605d7ec1cbd12bbca3cb24053c53682f5779
MD5 86e6f1b4c1c15159e75755f50ad74311
SHA1 f89fd22ba9b53e400efd565aee7b93ff1cbf58bf
SHA512 e1706ce4517fc1f6b6a5a9ab43c311126e963827f2d58cf046bcac4bbce136a6498e3a9c95e070c8369631b48535ab620d7a0b1dbb6b0b800625ffcb1cac9b88
MD5 SHA1 SHA512

Submit Download

45a71bff10b53e80_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\45a71bff10b53e80_0
Size 194KB
SHA256 0fa81246fea690b6e4a9644fc868c0acb5d6d1651ea79699a4cab9457a7cbb1a
MD5 7bf5a3eef12d742f09a84eeb60ec00a4
SHA1 70fc227c16832adf81a9060a519be7d97cc7687d
SHA512 a0cb457e58f69e8e61bdfa9b5d994465895a742e1e237049e29a71ae2c4add647facec0c755759b54a9d23fc852c770614dfceb797ddda0978ef926de69ac12a
SSDEEP 3072:oegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:oegF1cc9zByRIZa8HlI93h
TLSH
T10B146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9b2da9df933a2d42bf4d319c888a135c6dba83197e215b1b8a65cc302240791e
MD5 7db262854e203c971bdf542147ff6de0
SHA1 60c204da7875f72473d852e32666139dc5f22442
SHA512 887af54ab80521a9279d4d2375aaa64bd496b43d42ed7ca2ef0bd6b3a198c9920a69ca27ab900629d3097e3ed11a92f170f8c8b06ef6eeb98a9add1ab50c5bbc
TLSH
T1A9A0026105D04C21DF028276A88F519832106D943A59DB7360FE1556DDD769A620E543
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 49c1802dd0c2ef56ca82e165ee8a9ca6dc9abcf61d1c216789f0d075ec0c0d90
MD5 5156eb493bd6a8e3d13ea1166e57d634
SHA1 cf9d4ed3520d33009dce5607539bac95039f7ee7
SHA512 f2cf1a7da0b3405509c97a798c27a0c7163a1981b0310a6d4048623c788874112b1645b6d1fe48e913e8bd5f17af079557b739f7c0941d208d67c07793a4f972
SSDEEP 24:TLRRY/9JhPaWMuz62ZeL1b3IeNSllviteteX4TDQeU6Uw9q8KPq8yzRfJhIBMAML:TcZa31b3fEvTFULjqJzxXIBPMZrt0q
TLSH
T15513EC9F2E147041D2A98575E4AA8FBF1E7F310C8F8368D169E016B34CE152C592F17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 03cac83c660ce448dba708ccdfdbfeae697fdf246c5f34c748b3e4f89afea29a
MD5 276a70aaf35a92eb8d0b98800cdd7526
SHA1 f9b0205cbc87e40a0d205f72a50afddfd64a5412
SHA512 39e310374231c81548f806833dcfac2a3c3a295ce64ad675e82bcb43625565f7757c273f60d3897e4f101005d9eef01ca1f5d12e4429812e808ce561c2fa1aa2
TLSH
T1B8C080C037169481F979C2B95BD153942780E4160090C433D40C5F349D435945E626B1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 a70a35f28a6e01c9cb5d955493a2b53bebb502b772f1a4d63153bad39b4410f1
MD5 837dbe176bc73fd431f4638781ef6fd6
SHA1 45c5787aea914b52ec58f258d76b330821f3f1be
SHA512 d8fe54ca445fb771ad17d5a47427f9e63223d1c61d04204b20e675c3668a48803de03a27a086ed241dec3af6c6196617aac1ef27e2cdcf7f507dedbb512b9fa8
TLSH
T112E0D86435C9C37EE1A52487C634E788D1A2B482D6C96D213B0D9490630B1407353560
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 945b7ec82e9404f5160152e3da78fb86ae3f1e798ace6acc13dd67df5dc0b02d
MD5 fd26bb3378fc35d6592890dc1400479c
SHA1 73379632594392aab32833014663956d108a8a94
SHA512 f79493f9eaaf5e501d511c85e5a267a1dabfbc8e57964de5a0295e4e7015a78ed0858ede5809f06a562ece3744994ac5b14e94f3b04bc9bf8b4e185d9ee29b17
TLSH
T16DE026B466C8C37DD03060978364AF4CA2F0BC4693C93A82970C4460A202104F3B79E0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a4d3f69e7ac005c6114577dbbcde4355535e65489ce7c355726f1d2b71d5438b
MD5 d7c63c5168facdba8d1b6b3591eb5913
SHA1 2cb5a4f2f9a2bf08f03860ab17c1e2e11e025fae
SHA512 1d2a3007fc157ee3fa114286688368d7b9a73e5e175d843fde609cd3fa26380793d2f04419d5bf0dca23683419f89ccb094d4f773e854d4366eb84f18b7ae57c
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHm7KmgIIOW4tVgGOK47g0OcOGlkWPHlyLn:C2r6WwYYZo9m22Lgkte2VUGfHm7KmgIh
TLSH
T1BC91F161333713803C7EA94D91B9941FD2C171A23214B52B3BA803665B27E178DFF9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 2be6c78d96cdd17295fea95d8b21dcadf122fc1c73c8cacdccf91f5d2fac0d22
MD5 8f5633219599eaf31a929cdd9c672a6e
SHA1 434fce2992e0fda9a2d74913bb67796be1183ed9
SHA512 420875c56141c01cd1282ba7e2d73388a3504e0772d3abb5020d8721ce18146eacad56ce56168577b8d00ba8c75115eda7a9d80c392cecdcd612ae78fb0f4262
SSDEEP 384:DNrRZyCSDnxTICXuMEhIKyll7svbFKfk7:xFZJSDni4vyI1l7svbF9
TLSH
T1A944740A7B747001EDE6DD721CB080771E3CB16E8F22A6916DA654694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2045f24-9c06-4e33-b612-bb279ab2c5d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2045f24-9c06-4e33-b612-bb279ab2c5d8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d745103a-f797-4767-a45f-cb4cd8253fe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d745103a-f797-4767-a45f-cb4cd8253fe2.tmp
Size 14KB
SHA256 60898727c931a8d47279bcede4147e7597421ddcbc14050c3a611890fac8365f
MD5 406ee335864f2da327bdfbe2f213fdaf
SHA1 80a13f614202e68f3c38fc09f701366317a8b2a9
SHA512 28e588688c96776f3525c2f61fd47060e6c5cef6769dd18a5cefe062ec1d10fc6c04855dd2c0aca1b13d7c7eeaa8cbabc1525332c44551c5e56b8b6589115f42
SSDEEP 384:sxRgkA/fUscWvVMxfV+MIiS/5PZCv/R/Vg2rX:sUkA/fkYe7o/5PZWR/e27
TLSH
T15B62C557A9345D7B4CD6D219FA25BF66D2F91432A1D05E88ABFC8E0C00E7ADD230784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 1a70be0be75fe68792dbd24b8466bd97f726438991ea65e354c18318b9ba0f1c
MD5 54cde2fb7ee11ca855b444fb37841164
SHA1 faff822e495fa14ca08d1226b58918872b0c157e
SHA512 83063de4f8521262eaec78fbadf68c714c131d299ed03bf20b53a766ec21ce15457108b3e261f23148b47e6bc49980e487a071b0e773ebda0bf5416661c48d2c
SSDEEP 3:MsEllllkEthXllkl2zEelpft/:/M/xT02zNpft/
TLSH
T18D44040F7FC4140DC5141030C013C35413F1DC5005115743347154335CC77441C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 eb05c95d967dd57e0277ab4aa2edd258c7624a6f1fa236a454c1768b539b021e
MD5 8655e7444c64ac7df3d6c58c677846b3
SHA1 d935e5b73b715fc8ca1ec2d72f68dcc8a48d45b8
SHA512 64ee54c846f98d2514d69b2dcd2d3a2716853897100fb7f24f3f412f43dcc1b264613004b4e14f20e206a939076a86ee2c61167b6a0837a7d0c3e05ec137e383
SSDEEP 768:jj+9h3HUNM/TBOW773njtBONXyer1IRCzni94TMVcLCO7w/q:m9h3J9SIqnXTHCt/q
TLSH
T18DF2AE35E1969E238CE1A396B20377877FF46077C9C50B50EADA6F4E058BA1D170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8039a160d784ac178c3d01513000a87db7c8c3da14dc0c6732a6830af6334e47
MD5 033eab866da4d26627220f32706cdbd8
SHA1 9fbbbbcf2f6996eb895a0df99a6f0a6a6a159c2d
SHA512 47b5fac0a7cd1aca46fd706005aa3be6fc6a0afc7c287765673ca0ef40d7d7ef42c9be14b143a6decee67595d8d36b0f36e75cca6baa61bf92b83eb07ed0973a
SSDEEP 768:0j+9h3eTrJM/TBOW773njtBONXyer1IRCzni94TMVcLCO7w/q:j9h3X9SIqnXTHCt/q
TLSH
T15AF2AE35E0969E238CE1A3D6B20377877EF46077C9C50B50EADA6F4E058BA1D170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a071c8d729648fc9c991153a55818d30532df67c54f530ccd9a23d3103f81196
MD5 2dab92f3da96b71a2c1588e26878ffd7
SHA1 785416e668ec48bab825b8e03cc0e864138e460c
SHA512 aa93f61cf4d276ac9562f028eacea5f1dcd3aba06e75c77857020ac471da646382effa02be247c8e657bba63fa7e4e5d34a59d0257603c6f2c36ee88c59ffa93
SSDEEP 768:Kj+9h3eOrJM/TBOW773njtBONXyer1IRCzni9UDMbujhrMVcLCO7w/q:p9h389SIqndDeuNrHCt/q
TLSH
T1FB039D3CDC565D3F8CADB785720E6A5A6EA8103BD1B40A54EBD91F0E817791CF30B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 79fecc18e927e5258b1199924e45b35dd064b907077032c76465c0cb1d888ef3
MD5 eeaa579ab7d62d96d6fe43bd14062fe4
SHA1 cc54e8a709860569bfe08981e3c6c9a74a26262d
SHA512 5bcd56917ab1d69f0975b85a71cb74937d8d65a62bf1f8446088d6ac42b3e00be0cdc59439086dd304e9c95d333ad4b5c985f13e6fac2df7e0cf7a64a3b01624
SSDEEP 768:+rv+4UNbdz35UNM/TBOW773njtBONXyer1IRCzni94TMVcLCO7w/g:+bsbV3v9SIqnXTHCt/g
TLSH
T1ED13BF31E0A99E338DE1B396B10776877FB82067C9C50B54EADA2F4D058B95E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 d77540a89c628c642230a609f905b3a5e32b4d6f01ad1b93e4aad4dbda6a0d21
MD5 25a356218e9a145b3a0d8850b8a56a8c
SHA1 ddc65b1d6c2fa7ec64a1fb8429ce94ed038c41c9
SHA512 6c8a3659fec633080e211e7f10984ebb9ea35d1f96f3aee1f859673e4fe598cc02e62d6e0f39157f8193bffddfaa6f261fb89871fc5daad6134097ba1181fe62
SSDEEP 12:TL6KeJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isrKmQQtudkzbdk8:TL6Rj0afDdWec9sJVUOxapXjy
TLSH
T1B892F1227D342033E4DF4BB6F8834DA00EF902AE8DAB7850D9E40D615971BC1AB951FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f41b20c7c422f336b2f1d8a111931a2f3e417d36db15b08bdff74b66abccc708
MD5 ef711e039ffb11c97bbd45f07df8f8dd
SHA1 6506a9e408f028793730b21504036c13d0ffd2ca
SHA512 47ec631a86e279dd5d1ee4d6b22689138a6a9b4d6455a4db82742ad6a9decc0f6a30eec5ed5fc14fc9ae5488fa7944a58ad855c4224367c9a44e51c632957605
TLSH
T1B5E00216D305001EC034433000871B741B94C004026243074120415C3C213506F111E0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5c0cc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c0cc9.TMP
Size 392B
SHA256 f2d908df90a0fd98a1c12f2697bf3224465c84a079870c591810ef2e98e976dd
MD5 9cfddd1c615c28e02256a334b991f9e9
SHA1 592a1698f3aae9f20d6d0bb3979b2c4d9079af8c
SHA512 19a779ab4121936f64e50987cca4507e4227b0a514c139a8c711e7a65d10989ca815c17cee6df5ab43f1385e93dee50f430deac1b46201619f41f9e564730aa6
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 149f769de1566ce01445cd62f1e36d5a22abc8859bc4906e34d11458e0ffc89a
MD5 ca69666b112fe6c3cd591446b5c00a78
SHA1 d3b9e52fcb087c6db15a96ff01c8a006e773394a
SHA512 04faa36d5536eefad09a932c76af1d815715ce962345da6aee66a9bb262e12eab07a06be6d83c34b3f8a0e38875eca106294b57fb298d9476abff3d41d9e76df
SSDEEP 3:MsEllllkEthXllkl2zEel6ZXn/:/M/xT02zN6pn/
TLSH
T160440209AB841409C96510704012C7541360E82105115B43646114129D8F6400C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

c057acde-7122-4736-ae89-02f0ad275a8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c057acde-7122-4736-ae89-02f0ad275a8e.tmp
Size 38KB
SHA256 a038cfaafbebf1b11e882930f75ae59fb2728560ede8604860f352022d024f67
MD5 701a238c37a6aacd7e10760a42688e9a
SHA1 e2c8698dc94d716587d726a7fa36e492c947a2af
SHA512 d9e3818bcc1eefa3c8d5a8376ea35c75332d57df3a1465aede6a04bf27bf8383351f25e68b5fab1eb69c0d97a235e8fb431ff05062db2c7461fee7c17a2cae8e
SSDEEP 768:hrv+4UNbdz31s+/TBOW7734ONXyer1IRCzniB4UeVH1SK7:hbsbV3BmSIqnLUEH1l
TLSH
T1E503BE36A4A89E338CE2A385B14777437FB86057C6840B90E9EE2F4E069B49D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6655c38a-c8a1-4dd0-bd31-6780d1bc96b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6655c38a-c8a1-4dd0-bd31-6780d1bc96b9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1335668497\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2440-8-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-12-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-0-0x000001B727850000-0x000001B727868000-memory.dmp

Download

memory/2440-7-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-13-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-11-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-14-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-9-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-6-0x000001B742750000-0x000001B742C78000-memory.dmp

Download

memory/2440-5-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-4-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-3-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-10-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/2440-1-0x00007FFD08C1F000-0x00007FFD08C20000-memory.dmp

Download

memory/2440-2-0x000001B741F00000-0x000001B7420C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads