hxxp://discord[.]com

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
48s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://discord.com
Sample260730-e2tv8acp7z

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	discord.com
8	discord.com
13	discord.com
20	discord.com
26	discord.com
70	discord.com
196	discord.com
12	discord.com
36	discord.com
100	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298592111018909"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{77206359-EC5D-484C-8BEB-32BF06CCA2E8}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{8ECD4D9F-5564-4FEE-B4E1-43BDE557AA91}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 2628	4204	msedge.exe	86
PID 4204 wrote to memory of 5040	4204	msedge.exe	87
PID 4204 wrote to memory of 1924	4204	msedge.exe	88
PID 4204 wrote to memory of 1924	4204	msedge.exe	88
PID 4204 wrote to memory of 1924	4204	msedge.exe	88
PID 4204 wrote to memory of 1972	4204	msedge.exe	89
PID 4204 wrote to memory of 1972	4204	msedge.exe	89
PID 4204 wrote to memory of 2060	4204	msedge.exe	91
PID 4204 wrote to memory of 1392	4204	msedge.exe	92
PID 4204 wrote to memory of 2060	4204	msedge.exe	91
PID 4204 wrote to memory of 2060	4204	msedge.exe	91
PID 4204 wrote to memory of 1392	4204	msedge.exe	92
PID 4204 wrote to memory of 1392	4204	msedge.exe	92
PID 4204 wrote to memory of 536	4204	msedge.exe	93
PID 4204 wrote to memory of 536	4204	msedge.exe	93
PID 4204 wrote to memory of 640	4204	msedge.exe	94
PID 4204 wrote to memory of 536	4204	msedge.exe	93
PID 4204 wrote to memory of 640	4204	msedge.exe	94
PID 4204 wrote to memory of 640	4204	msedge.exe	94
PID 4204 wrote to memory of 2064	4204	msedge.exe	97
PID 4204 wrote to memory of 2064	4204	msedge.exe	97
PID 4204 wrote to memory of 2064	4204	msedge.exe	97
PID 4204 wrote to memory of 4492	4204	msedge.exe	99
PID 4204 wrote to memory of 2440	4204	msedge.exe	100
PID 4204 wrote to memory of 4492	4204	msedge.exe	99
PID 4204 wrote to memory of 2440	4204	msedge.exe	100
PID 4204 wrote to memory of 4296	4204	msedge.exe	102
PID 4204 wrote to memory of 3448	4204	msedge.exe	105
PID 4204 wrote to memory of 3448	4204	msedge.exe	105
PID 4204 wrote to memory of 5416	4204	msedge.exe	113
PID 4204 wrote to memory of 5364	4204	msedge.exe	122
PID 4204 wrote to memory of 5364	4204	msedge.exe	122
PID 4204 wrote to memory of 5364	4204	msedge.exe	122
PID 4204 wrote to memory of 5688	4204	msedge.exe	124
PID 4204 wrote to memory of 5676	4204	msedge.exe	125
PID 4204 wrote to memory of 5704	4204	msedge.exe	126
PID 4204 wrote to memory of 3608	4204	msedge.exe	128
PID 4204 wrote to memory of 3608	4204	msedge.exe	128
PID 4204 wrote to memory of 3608	4204	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://discord.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb8e8cc188,0x7ffb8e8cc194,0x7ffb8e8cc1a0
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,16170984054011692437,6985964029662465988,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,13003972280948958175,15209186743240201019,262144 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,8666245673378890187,9120717204890925737,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17212623739215740289,9393761997094605644,2097152 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,9135449502894979110,2180452744523125574,2097152 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,2170814034278263230,8252972521572216981,2097152 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,17345582332477247082,16065984783196032851,2097152 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,16249676693344118489,6965998167908089296,2097152 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,1800755107500215185,406868263780375250,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,1540822252369725920,9450894384421142189,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,9043546376908780807,15989680479717047931,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,9043546376908780807,15989680479717047931,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,17645201521051566666,505357007780412300,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,7165381354630755682,139361406090758394,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6828,i,5681251799466265219,16375779718429102960,2097152 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,17295440571179616031,13896190584748466067,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,1627944647290692593,14608567979659067342,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,9097983340270248349,7917281473621815901,524288 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5200,i,12934907752464898913,4099412056324254488,2097152 --field-trial-handle=2232,i,18051532666916351421,11582963938794589419,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8ecbc360c0b23c486adf324f7f8b8ca1d46f0f4605fe6a2b3d2404a62b7eeae2
MD5 7e77384e0175d1ff6757eed665b72fa5
SHA1 e7e9206823bc1eb3e59f809d3587252418e8d0c3
SHA512 37bdaa29299469814fe3ea3d1288419b4d49bb964937bae66e8bc5ee0f7e39ccfc2d34b814283dc06ace1eacd5d31577ace6432cc455fdaef211c08dddc7163e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7/:fwUQC5VwBIiElEd2K57P7/
TLSH
T1EFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f3333fda559c4c40333d247fd30f0aca386e41d8dab70f89193cf11a898ef4b9
MD5 d4fa869d85a1c4803c8778ee55818879
SHA1 f45eaee8cd68fe8cf837571efe01cebf6302c7d0
SHA512 41b859950453bf306f7ccbc3893ccdd1ffb612bfc93d70be76da8fa61dd831a809c72880c35e393e8ac6d690aec264f375ae5283a509a3063ea65fc27ed7daac
SSDEEP 192:sxZMR5yM/jK1Ml8MkQ/fGswIN9IdpEcHW6+WNz+l/YC+ow75IgrJ:sxZM9MQ/fGs5N+xHbU/gh9
TLSH
T1E152E816AB345977CCDBD209FA557F53D6F80472E2941E48AAFC8A1C04E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 16b9498b6486dde8b336a80d0d5272a77ed8c9bf15d0ced23b470d5bd6b90528
MD5 e2b225f69ca5cb713c240989d03cf172
SHA1 a9dbed39e2ac4082f233d57877bd1e2709650eaa
SHA512 3cd1c8340d0410354007a3bbe477187a09e0ca0d6c6b3a4dc51a0e98c3940ae4ff91d0df6986221dd409b201e7ff236f6891a8a19716624764a154117e584097
SSDEEP 192:sxZMR5yM/jK1Ml8MkQ/fGs0IN9IdpEcHW6+WNzJJXYCh+w75Ig5tJ:sxZM/MQ/fGstN+xHbjXHhB
TLSH
T1A652D7166B345977CCDBD209FA417F53D6F90472E2945E48AAFC8A1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a903733f7533e8370aea8ef9a0766d803d8c5b55dc91c483569c895f96b096c2
MD5 3a62490704f1f26f10a71f695acc4b99
SHA1 d9b7213c5b90c59848411a31e566468d06d73a3b
SHA512 fb2c7efe1a03952678f4445141b4815c4cfd0d36763cc99254f7b6b961ea38c0fa92818f364079b2c9a0d20931ed1ea0cbdc56183115669e44bc5cae9e3cda98
SSDEEP 192:sxZJR5yM/jK1Ml8MkQ/fGs0I89IdpEcHW6+WNzd9ZYCG+w75Ig5HJ:sxZJ/MQ/fGst8+xHbPZchn
TLSH
T1D352D7166A345977CCDFD209FA41BF53D6F50472D2945E48AAFCCA1C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0fc5c2866feb22d029bdea96f83624567db552443be7aea505ef095fd16981d2
MD5 b8dda5a986e4cf6d263520c679d59cb5
SHA1 982cae3b089c22c3f73c6e172051a0ca74607260
SHA512 ea6e9300f57d161747e54d0bb77522101cca4498c0d34cd6e686df59734c613e7d9430fb3d494b17692eab93d9e3937e9f7f25cd477f21f0b6130e39be6bee3a
SSDEEP 768:vU8bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVgroze:vU8bqn+WvSC36u1jaCZLbWVrS
TLSH
T1DDE20A3B280CCB7E4F845E5DDD26AF962DD801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 52f1621af7c02e14778eac4a8910b2a3895ce1c10ac65172a78d36890b332bce
MD5 09deda4a345ac1f37ace997d212d8f98
SHA1 31c461b72ef16cb206411da65a9bf5c1cba77e83
SHA512 42b908b0132f7f0c23ebde6eee0a8fb89b38bc91b074d63548a4a972cb453cdc4616060c28bb8f22cd77c06d62b3f230bef39b5c28bdcf7b1e0d37eff3d66f43
TLSH
T1DDD0976BF12209C0FBEB4A810162019B43223CC820A690CCB513BC3C8C74A87E291F82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 c4cd4ed05afc2f0a03afcb7459c8a220b2cb0b7cfc6d33616a6e43083e54fba0
MD5 ce261d2503ceca821e5fcec8fe378261
SHA1 65f5028a6eaae1dc8b904f572cd194eeb77b8e32
SHA512 dcbccc84c23fd261ab5395a8006ba785b4425d01b9c5bb0a2450f64c36021c232816edeb22fc0990f11ecfafa3d684b7e40f34310442d37f398a0917297f9a55
TLSH
T182D0A76BB1664AC1FBEF8F81155241AB43113CC864AA90CD75138C3DDC44A97E192F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5870e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5870e5.TMP
Size 138B
SHA256 099c51dc5323483c48deca9d01b0228d4ca6e20ca88d40f582d9be7720ea0b43
MD5 b1ada494d7ed9ad955f049fd57a2b2ec
SHA1 2762dd1c2ea4b6c1a9be01ee8826c1adcd1ef865
SHA512 cd9194b2e25386b2635d164ef17257bdfa25b708a96bec85fc5e088c1f80c426213aac9bb58b7ee33f8e2898b2e4df888c8ac3d912e1ee0cbd95b57396e3e395
TLSH
T170C08CA7A2450950EAA442810222818C83013CCCA886808D61233C182470E53A242F96
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e426f67d22de9b0d0bf63854e8198c680adcc9ad6c2d9d54cf3799a0e4f5bff
MD5 f7d9484124493cec48de0d32ebb41ffc
SHA1 b9f7199567986e4eb4a347497a03165b6e462972
SHA512 9819abd5d0d5518e8c686f6d03bb20a8d8ec8af9fa4383c565c0a153626c965b6381bd5b09713347e4013dd59aa5f513837ff8a21fbafaaa53c40a000d8bc746
SSDEEP 48:KeDQ3jVNNeD9KFI0DeKNrF5ehbOiyJz/yNlI5KOs0byVdIVKWYws:KskQKhSSulmKOsi+d+KWYf
TLSH
T14F915701307F028238BE381C96A686368E45FA57382869FF7BB940655F66E125CFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 bc6279c3ba7368018b12c305ddc7b5b98e502c0768d9c5bbb889daff50c9bccb
MD5 da9660293a2dd928fec46c89dfd7f255
SHA1 79d6bd8fb48a62db1f175f75f02d0a2d12f60af8
SHA512 12201f3a985274fdff0133398d6ba01119d4a10460fdb5129bbc2fd95ab74a42cd0a0d8255a8667ef7d210ee169005ba2b9c1dde440ee1d4b83158d38a9fac0f
TLSH
T1C3C080777085C5917F7514FB114775C8C9373FCC4CC8954C4425314D7230D171500930
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58ba91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58ba91.TMP
Size 178B
SHA256 35c7de1fb49aa45ddf394e74f372bc28b43d9724b6381999005a7204f3824584
MD5 bb83903d0b7f2c347ae4719bec238bac
SHA1 8a68be484588d01261af6c96877a8279fc447640
SHA512 dc9e46d876474d33e15906ef939cc7170fc555d7376526682d048954d9fe3e76d37bd73a800b65ca4a8850932651b17d90ce66153efac544987ea261ca0e2d3b
TLSH
T1A9C012B79041A5922B2864EB921A33D9C57E3FC89C84964C4811314872308661001E20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0d556ad457bc4d2a05c8670cc0e55374beff4a22752622b36f9493a92429d585
MD5 a6f1572b98c293625063380f06a0b18d
SHA1 baa17559d214623194fb989bdf923be8dbdf380d
SHA512 c0795aa523463de786a248e5fac058fb460a9db951e83ef38f5e4a9cbcef20bd26f791c28cfa0ed11f98d623a0832be755c033ad89c7b70c8b253680de944bad
SSDEEP 384:xZcIhsNDySJlRjhEa+HIOnJa4DCc3Ua5tIsjml91YZUP:ZhwNKagIOJa4DCcksiEZUP
TLSH
T1FC928C325C785C7A5DEAA148F88732178FF89067D6CD6E90D5DD5B0C00EB9AC134F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 58fc654f62f195fdcfcaa003c15285f687be595eb3ce8464f0327cd34220794f
MD5 758799658fbb2303e80ed81dcfddb9c8
SHA1 b386538ecf84f31ce439ee5ea5c55cdee7a14a3f
SHA512 3aeddf8cc9fd293c49bdcbee7020c22859c341b51fdca351daaa66b473cec4d59c9ae865a978ff1e9e04cb762af89d35924b83ba50bd94589794dd11de737708
SSDEEP 192:vON56Db6QmiUyCiHBa+jLIOmYtmpRgyoU6:vON56uyHBa+HIOnFDU6
TLSH
T19F02E73569786CB79EA2AE49F88B27275FA4106BD9566F84DAD81F0C00D764C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b0662eacf33b6a58390587e3c9799bc75d64b1ec00e65d2138d5af1bf61e93e1
MD5 1be89576be68f41b3d2cfbea27c78e0a
SHA1 876d6333106e45749408e6cb2127fc6b6fe52fcf
SHA512 78e355baa59c08a8538b13cd99a8f40c82dc92566a3063e6730ca20d0f57a52283d7c4f2181866f19d35e5d5f8140a173b3dc3e3b16d05bb6fb0e097b645eb53
SSDEEP 384:9ZcIhsNDXSJlRjhEa+HIOnJa4DCc3Ua5tIsjml91YZUP:lhJNKagIOJa4DCcksiEZUP
TLSH
T1C3927C325C785C7A5DEAA148F88732178FF89067D6CD6E90D5DD5B0C00EB9AC134F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e0963374b7abd14e2a1daef8c296a00c8fe23dc9f9b7a58a6273d9de70294d1
MD5 1df63aba4a213b4d7a78fd34bfa33716
SHA1 9c18becd4261ce70cc179d0300eb7af6a2885cb5
SHA512 1a49a0074dcf11875def5c2f19d956035e936fff5c214d56a00f9c1eff6b8a89ec2b986151d737bd094f8fd0a691ddc18d76cbd6c0201e02902701dd53373323
SSDEEP 192:rON26DbgQmiUyCiTBa+jLIOmYtmsa0e458Nz+q+cU6:rON26IUTBa+HIOnJa48CcU6
TLSH
T12912193669785C7B5EE2A994F88736139EE84127DA8E7F80D5DC2F1C00DB69C134F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62a70d98-2921-4999-9bcc-0f1fe4b1c24a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62a70d98-2921-4999-9bcc-0f1fe4b1c24a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0916d6871a409e885acd4de8209bb2bf92ca71726ddde9d86e4b2862eb6cd80c
MD5 99921d104b784cbeb31cf2e24bbf4fb7
SHA1 5337aa7c23f5eac406d76c644ca0a1f73fceb029
SHA512 c2a9ce894b4b1a3c783e6eb04d2878bad9f78786e78af9898914b0cd956e4ffacb33898147ee57a82a8c000e0ca630edb80c462db175c6079b25c2434d7f0d80
TLSH
T1D3410958BAFA1548F3B77E5AABF6643E447F79772E06D49D10110E4E4A22A40C861B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads