hxxps://discord[.]com/oauth2/authorize?client_id=1413254761032974496&redirect_uri=hxxps://vaultcord[.]win/auth&response_type=code&scope=identify%20guilds[.]join&state=58458&prompt=none

Analysis

user interaction
yes
max time kernel
40s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/oauth2/authorize?client_id=1413254761032974496&redirect_uri=https://vaultcord.win/auth&response_type=code&scope=identify%20guilds.join&state=58458&prompt=none
Sample260804-qdn6lsfl5x

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	discord.com
17	discord.com
28	discord.com
36	discord.com
42	discord.com
72	discord.com
7	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303225640011873"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{247F826C-0A8C-4EF3-A1D0-428FFEDE99CA}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{DB6DF439-2DDD-401F-BCD5-B1787BCFE3B5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2176	svchost.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4012	3512	msedge.exe	85
PID 3512 wrote to memory of 2976	3512	msedge.exe	86
PID 3512 wrote to memory of 888	3512	msedge.exe	87
PID 3512 wrote to memory of 888	3512	msedge.exe	87
PID 3512 wrote to memory of 888	3512	msedge.exe	87
PID 3512 wrote to memory of 4872	3512	msedge.exe	89
PID 3512 wrote to memory of 4872	3512	msedge.exe	89
PID 3512 wrote to memory of 2204	3512	msedge.exe	90
PID 3512 wrote to memory of 2204	3512	msedge.exe	90
PID 3512 wrote to memory of 2204	3512	msedge.exe	90
PID 3512 wrote to memory of 2780	3512	msedge.exe	91
PID 3512 wrote to memory of 2780	3512	msedge.exe	91
PID 3512 wrote to memory of 2780	3512	msedge.exe	91
PID 3512 wrote to memory of 3468	3512	msedge.exe	92
PID 3512 wrote to memory of 3468	3512	msedge.exe	92
PID 3512 wrote to memory of 3468	3512	msedge.exe	92
PID 3512 wrote to memory of 1524	3512	msedge.exe	93
PID 3512 wrote to memory of 1524	3512	msedge.exe	93
PID 3512 wrote to memory of 1524	3512	msedge.exe	93
PID 3512 wrote to memory of 1568	3512	msedge.exe	97
PID 3512 wrote to memory of 3748	3512	msedge.exe	98
PID 3512 wrote to memory of 1568	3512	msedge.exe	97
PID 3512 wrote to memory of 3748	3512	msedge.exe	98
PID 3512 wrote to memory of 864	3512	msedge.exe	99
PID 3512 wrote to memory of 4472	3512	msedge.exe	100
PID 3512 wrote to memory of 4472	3512	msedge.exe	100
PID 3512 wrote to memory of 1888	3512	msedge.exe	102
PID 3512 wrote to memory of 5588	3512	msedge.exe	110
PID 3512 wrote to memory of 5596	3512	msedge.exe	111
PID 3512 wrote to memory of 5604	3512	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/oauth2/authorize?client_id=1413254761032974496&redirect_uri=https://vaultcord.win/auth&response_type=code&scope=identify%20guilds.join&state=58458&prompt=none
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffad6fac188,0x7ffad6fac194,0x7ffad6fac1a0
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,15034873480379933420,7650916684827788778,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,6254328513788484935,3102833752503958801,262144 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,17974783952942301327,15156719577963217368,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5402928199903976578,7574020307399327241,2097152 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,4538226219785975934,1045567892045869945,2097152 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,1049289714027422754,12277710627882540569,2097152 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,10193583119602500193,3073640414681045121,2097152 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,15645149113164986980,3282434809143251134,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12293136978031401366,15585485835624166131,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,10413549946718088239,4271432765299858583,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Modifies registry class
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,14487456360713080035,732975692316297361,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,3757020781471812691,16531255340570811299,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,3757020781471812691,16531255340570811299,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,12039807196280336386,14168636179796978427,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,6160597264372841635,2720615868164200128,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,1479790177550458295,4897031711194914602,524288 --field-trial-handle=2204,i,17426209561042015426,12757788181619705730,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f21c2484e331c61ddff52b46cbf8498513b5234757c8746e10ae54e51e27f41
MD5 b0a46b7af0b38c25b50c8b3be8ddaba6
SHA1 116fda3e5dd4e6fbb38a6a806bd87ff4bae65ce9
SHA512 c5e35f661bd702679ca4d61b25d042ff3db55d8ecc7c6e4f7b71e1704afc680d61f84cf54b549c0d5de96ec173c72d7d2d837476990bf80dc57bc33a891f9f21
TLSH
T1EBD023707969F5D0C61C017451105E4037364571319B974BE1965C1D9DF00C0D3EFFD5
MD5 SHA1 SHA512 TLSH

Submit Download

93e38965-59f3-4e2c-ad02-322b1c5fb50f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93e38965-59f3-4e2c-ad02-322b1c5fb50f.tmp
Size 30KB
SHA256 2bc21cf95004c4c2ad9f3be0a97dfa5f24a0d2b09e467c2bd3e482f740bd8dd6
MD5 68723cbb31fa6e00396c233a03b24802
SHA1 653aad9ba8515fdbba6c48a4dd223ef5c948e22e
SHA512 882aceedad186015fdbb9bfd943791883fc06ee16bc3634c61d448fffa44989a267faa36d1d5c01d29969a3072654a80d77719353d5fed57515e6262548ba24c
SSDEEP 768:0Ks6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNTroPF:0Ks6pD1WvxzUju1jahILIsNgPF
TLSH
T185E2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB54899447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 ea4bcbc0f2a61e86aa05e98ee695ed8ec62784963b45aba472eda1a2ec252b96
MD5 df0fab23d6a74792512fd27c1c7fb860
SHA1 16295e7a9fc5f652eb312cc8916cb480a92f44b4
SHA512 0a5fffc6d6b7baf073a5c6d59bca3c0397d9223aee71830c201576a931d132122757e7f6624ff1533040dc9b027aa3033afbf9d60f7ae583ff952a039cd846b6
SSDEEP 192:mnL/UtI3RlCBVsISTP12HoFHCgCYqte1HUbvESfFZeQMYFSDwbeYLbo9CtPa7y6P:mnLUtIBlCVs5P12qHC1Yqte10bvESF81
TLSH
T1670219D2CDA30A49EBD15237D4C14E20F57E01CA3B871FC66758A37EAE1F762D01A688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 36d69c4631a74ee1f1eaf9e63ca9a10658831e599c307859f7fd61c4c6aca15d
MD5 08aced2ced45b1a341a4a545136f3041
SHA1 8fd542293e78b3a0426200243f692ed4f5d48acb
SHA512 82a0f6766754b3c9a671654fe5235b1e85650711dc21541e081f79bfbe073114a56d133ddbba5d6ee9040e360714a04b47d0eee7ed92a9a1f90972b656173cc9
SSDEEP 3:MsEllllkEthXllkl2zEklcCHK/l:/M/xT02zncCq/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6a48f050ab6803a7cd4aa30b2b6d78f21d6c19a2f1398b68e40cf40ea2a4a025
MD5 e89496f412f0070f76d79e6d8e60fef9
SHA1 fe60fded4930f6d3985cd40613487eac354e200d
SHA512 fbe26239db9762ece39f7e8010c53354f09905047711a286d0708f3e4b3d37d682b0f2ebace04d033821e3c3e1f3f2084c140d98c631496ab2611299909013d2
TLSH
T1953146B3C7E5866ECA1156F05A14AE2ECE2C0A15431C7C6AC5D4AF1B93E2562F101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4970b6aeaa272bb7e249b62570b2c8d242a76339ed1f504c5ac2709845fd8bd8
MD5 71a29279afa0016545beb31f74d7fea7
SHA1 86b40b820a053426a9bec6d89ebffd864d7f359d
SHA512 be742db8cdb49962f4286a4f957fb42290cf891840cc1650ff2d11cbb700b38909c0d74db77c3b7669508b6f9c0fef5d9de037230d5a8230e2c733ad4e0e2ace
SSDEEP 192:sxZURcyM/jK1Ml8MkD/fqsTd3IdpEwHW6+WNzFi/YL4NQa9IgrJ:sxZUGMD/fqsTdYRHbU/T59
TLSH
T1414208116A34697BCCDBD209FA45BF53D6F91472A2940E44A9FCDA1C00E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 267eb9af28d8a851d4fe4839f3ea4ba6a6e2e03f6e0fe706ca19174a7d254647
MD5 38e031b43f966550221440cd9aa537d2
SHA1 c67a9c78353f364591b9a6f212ff30bf74ef89fd
SHA512 0487a4ce946fa074118a131e22f7b97b80342f13792d26d196cdcf74a33736ee1491ee32c97a14bb9a086a9ef140327731ba1b01bb3259c0a2d0176217f0378c
SSDEEP 192:sxZURcyM/jK1Ml8GkD/fqsxWpVWv3IdpEwHW6+WNRjkzZYLaNOH3IgbMJ:sxZUGgD/fqsxWvWvYRHbCZnUE
TLSH
T1C962F8116A345D7BCCDBD20DFA55BF53D6F91472A2910E54AAFC9A1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 288aca8bd46b2d7c482706a86f6d107074fa0b1e0a861fb2b3b7055e5af8b79e
MD5 bf2e9d884315abccac769465df47e44b
SHA1 59e52dbcccb88b7c71a292048ad093ed89b1ec44
SHA512 67add3e4060cbc6dea23cba85c3d3414280559050248e738019fd34eafd98426a82c2d5b0944cdc8fe33a75b7df6cefa51995e88f101b4af7b3453f852bf855a
TLSH
T15AD0A797B05A5592DA7F8F8006619C7B56243DC454D9508DA1834938D958E537502EE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 17c94b05872c920ffcfb3835c521eebacc74d6a2869b4c6d638e944f17cd267d
MD5 1ac20faef3b9a4502668b46b078bc3c7
SHA1 4a0d8b0a0bb32e2ae8cf0165f11f8128097cca34
SHA512 9760146c58558448fdfee2217c8c8af2fe46d11dc835d6c4d1fd98cd76f52522f9f48fee1098d0e5313eef0ef378329b0cfbd40a6d1953f5bb7272100d75db78
TLSH
T19DD09797B0170482DB3B8E8006319C6B56282DC458C4908C9183383C9438E83B601EE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe582a95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe582a95.TMP
Size 138B
SHA256 260a2e0462bde213e15c7b3f34f96dd8084a69b6e52774b6ba072bf3f99a792f
MD5 5a8c5c5223ca2562dbf574cfd13d0d00
SHA1 94ba504341c6a0ec136d63f9e603f4054398ea28
SHA512 bab02d60d7c532b1e6a6bb91bcfdbe8c51fdecb588907f283371fb2d93ddd832e516d8cca55c96d4080d5993a8e295b339f5bc77a37cc45b18cd8c8cef84b17b
TLSH
T184C02BE3B00A4122CB3A0F8002329C6E43003CCCDDC5908D611338383238F233501EE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 c22d18668eaa6c5bb8128a1466dec5b6e1ff23e0dec9966d03e6cdf387f2b959
MD5 d4910cc90992e98646e4c1ea80593da4
SHA1 461c769ecf06392552e3c7e6e3ccf9a84d23c7f3
SHA512 814d2e41e9bbc442a0e0ed458ce3131a414990becccfd640c344dffbce397c9b15c220ddb9d10f5dbc0cc7091da0a909de45caf52080791078fd637feca4b306
SSDEEP 96:KUAAKtePOP+KsMCq+oKjy4ogKta6qMQKlOyjuKAUig:iiJtPovbIVg
TLSH
T102F1210273BB12433C7E288CA355872B4786B1633014B56B7BE814761EA6E385DFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f08f01cd7459e83053d9921e6902da46e5ed7abe6b41092fcd66f910fdf056ee
MD5 fdba35cb3dd79d58bbc5d9f0c60887a0
SHA1 baf2de5d500f5e0145ed8d9656d8dcdff13a6603
SHA512 5d1d3362bc4317a6a3753e4c56a73aae7dfd814c6a850b031d45fcfe97df252dbe1fadf78b48969845c25c5162d5181f79fd1337a76ad3f842f9607650a9c25d
SSDEEP 384:GZcIasNx67lUejja9uOUtWzJrnp+2BeRs9JKgqijUKB:UaBG8OY+hnE2TjKgqmUKB
TLSH
T19B928D315878AD77A9F6A580F98627178FF58037E6D52F90D1ECAF0D01DB598230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b942f0c89f2dc52b9b50dec58502444f0f214b1906b830cace978ae6d26e771c
MD5 d4bda100db6ccac02cb7416b48c97385
SHA1 51a9aed64c20202d1c405624c566b005f482cc1a
SHA512 0510016d3d8824ca64c194134b2a0a28129bc7d14a802433c30f8c94ac2dff51f85d1706d19dba9fd216c1af16c3cf95c1a6903c6e5a6d28b45e61e74cb9b951
SSDEEP 384:uZcIasNxOxlU1ijja9uOUtWzJrnpw2BeRs9JKgqijUKB:MayUG8OY+hny2TjKgqmUKB
TLSH
T1BA928D315878AD77A9F6A581F98626178FF58037E6C52FD0D1ECAF0D01DB5A8230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be5d4d916fd5ce58e8c5e30b2a1e67dfb7fa088f3b855c6e5b5957c80c0b840f
MD5 c7e67979bbc6e60de34b6709a579d500
SHA1 faba76f179b0bb22e55654136ed0152628148c60
SHA512 b74763c12f2df5072ed5beb8e4bd5a40d80b4e5e7bb34571b26ef4365eae05fd5a8ea21eabc0725dcb21c9eafdd3c56c64afd0f2598e36edaa2e9c255fcfd4b2
SSDEEP 192:qONx6O7+3hQmiUy0K2Gttb0XO2PxgGcy0VU6:qONx61xGt9uOURP0VU6
TLSH
T16102E7356D6C6CB79EF2AE45FA8727139FA5103BE9962F80D6E81E0C00D765C2343C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 90c4e2efc661b2baf0fccf615af44eba00df734379bbe38d4ef1948365fa364c
MD5 05c50876b5781d5f51fade5b9e665566
SHA1 c1a770c31180d64f33548198b061fc64fd69a3c1
SHA512 f159028b8bca5f1671f7e77349643b7ce195054ff0a783cdb4f6f83932510e41bd250b4820b8bd60746ad13b48179a7abdc65209389629dc44dc791ac0b66e89
SSDEEP 192:WONc6O7+3eQmiUyDK2xttb0XO2PtaF0SJrnpXcNLqzlU6:WONc6Qgxt9uOUtWzJrnpE2U6
TLSH
T1B512093568689C7B5DE2A580F98736179EA50177EA8B2F80D1DC2E0C01EF66C234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d1ba3f36c41215a22d521217b6f77b2a552f307283be21f6d7776c47901132cc
MD5 3f6eb43d222def71842bb93eef51382e
SHA1 3f56725e1f64740684a85fe24084d209193909e0
SHA512 9efffbda203efe55d6ccc075951fa240079d5960e7c6aefa21ae86a155ff57a5857c351ce7554cfb4716cbd4d32edd9057604e0f39f4383e2da45e6196a90750
SSDEEP 768:haJtG8OY+hnyzStBcKBb437ZTjKgqmUKB:haJi1CKBMrZigRUG
TLSH
T12CC26CB0D4E99DF740E5E4C8EA82E6176DF40033D5995E4CE2F8BA3D309F9B82716816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7919f1c5f6e3b2951d3c0eba7e06e29a72c78be7620c70f078a1f4a0bfdb3dd3
MD5 c81b508f76e9c2530a2d358b6e30308c
SHA1 aa4a5bc19e43c3a6fa8bb289558330cda6b4565f
SHA512 02d6c1befaacbbbd76f6660299520009d0452ff8a75bc4015d2fd9e775de4e452fbad0e177b3ee9f1f0c561514e78dc2215076bb211027b1cc0a7abfb9031351
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe586d5b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe586d5b.TMP
Size 392B
SHA256 1be0a8dfddb3704604506b50e8e41f95d77a170855937e518ec773a9ef9795a9
MD5 3eb3b08523ff911c19f0b2c35776f42c
SHA1 087fe3442ab68bcd5210436898e335a86c2357b3
SHA512 8de4b7c0d88854378b543f31fdf503c4f781a6075dd0fc35c8f1ec080482311a9a51b7e8a54b0d772617a4c9b926db9ad0b35a946ece11f2cafddc2877e31de9
MD5 SHA1 SHA512

Submit Download

73d2a961-4d68-444d-92e5-dad0db3f0929.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\73d2a961-4d68-444d-92e5-dad0db3f0929.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 07cbb12aba81c4f14dba5655676badb814c43c09ca8ae17c4647d524186b8b30
MD5 4444392dc4fcd8ca8012564ba4f06215
SHA1 66bec2410a3ae48ede40d7be232de2a2bbaace3c
SHA512 eccd0e426c31c6ed9fe409ca971aeabbf132457026d0fe06087c9d94783bdd975f1e3addd78a05a340a10184999f4b3bc70526504b192489768f80e8fae0019a
TLSH
T17D412B59BAF91148B3B77E566BF6746D48BE79771E07D5AD00110E4F0A22A00C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2176-522-0x00000289FFE70000-0x00000289FFE71000-memory.dmp

Download

memory/2176-523-0x00000289FFF80000-0x00000289FFF81000-memory.dmp

Download

memory/2176-521-0x00000289FFE70000-0x00000289FFE71000-memory.dmp

Download

memory/2176-519-0x00000289FFE40000-0x00000289FFE41000-memory.dmp

Download

memory/2176-503-0x00000289FFB40000-0x00000289FFB50000-memory.dmp

Download

memory/2176-487-0x00000289FFA40000-0x00000289FFA50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads