hxxps://discord[.]com/invite/jJxxTVAvZC

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/invite/jJxxTVAvZC
Sample260804-xf5ppsfd25

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
66	discord.com
7	discord.com
8	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303429374496750"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{44CC89B1-0B4E-47F9-9C53-8B786B457896}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{3DF311AE-6BE3-4473-8B13-2B0AB53F74F0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4860	1468	msedge.exe	85
PID 1468 wrote to memory of 1704	1468	msedge.exe	86
PID 1468 wrote to memory of 2600	1468	msedge.exe	87
PID 1468 wrote to memory of 2600	1468	msedge.exe	87
PID 1468 wrote to memory of 2600	1468	msedge.exe	87
PID 1468 wrote to memory of 1224	1468	msedge.exe	88
PID 1468 wrote to memory of 1224	1468	msedge.exe	88
PID 1468 wrote to memory of 2656	1468	msedge.exe	90
PID 1468 wrote to memory of 2656	1468	msedge.exe	90
PID 1468 wrote to memory of 2656	1468	msedge.exe	90
PID 1468 wrote to memory of 3272	1468	msedge.exe	91
PID 1468 wrote to memory of 3272	1468	msedge.exe	91
PID 1468 wrote to memory of 3272	1468	msedge.exe	91
PID 1468 wrote to memory of 4580	1468	msedge.exe	92
PID 1468 wrote to memory of 4580	1468	msedge.exe	92
PID 1468 wrote to memory of 4580	1468	msedge.exe	92
PID 1468 wrote to memory of 2984	1468	msedge.exe	93
PID 1468 wrote to memory of 2984	1468	msedge.exe	93
PID 1468 wrote to memory of 2984	1468	msedge.exe	93
PID 1468 wrote to memory of 3892	1468	msedge.exe	97
PID 1468 wrote to memory of 3892	1468	msedge.exe	97
PID 1468 wrote to memory of 1500	1468	msedge.exe	98
PID 1468 wrote to memory of 1500	1468	msedge.exe	98
PID 1468 wrote to memory of 3100	1468	msedge.exe	100
PID 1468 wrote to memory of 964	1468	msedge.exe	110
PID 1468 wrote to memory of 3016	1468	msedge.exe	111
PID 1468 wrote to memory of 3768	1468	msedge.exe	112
PID 1468 wrote to memory of 2384	1468	msedge.exe	113
PID 1468 wrote to memory of 2384	1468	msedge.exe	113
PID 1468 wrote to memory of 2384	1468	msedge.exe	113
PID 1468 wrote to memory of 1316	1468	msedge.exe	114
PID 1468 wrote to memory of 2016	1468	msedge.exe	115
PID 1468 wrote to memory of 2016	1468	msedge.exe	115
PID 1468 wrote to memory of 5632	1468	msedge.exe	116
PID 1468 wrote to memory of 5632	1468	msedge.exe	116
PID 1468 wrote to memory of 5488	1468	msedge.exe	119
PID 1468 wrote to memory of 5488	1468	msedge.exe	119
PID 1468 wrote to memory of 5324	1468	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/invite/jJxxTVAvZC
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd3431c188,0x7ffd3431c194,0x7ffd3431c1a0
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1100363582280227523,5476182962924068521,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,9423212492750836510,1073778967920161882,262144 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,13823391582233269829,13304826331033917312,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10869513555597559812,12813796566254331189,2097152 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5403021028104360024,11354740701063165951,2097152 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,6279830329605598126,2367730134084888638,2097152 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,7627455036258116425,11583710747819633333,2097152 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,6313207270937220242,13455145915619552283,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,1079799344996975562,6474893046159400078,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17444180641450737861,3713413005948506330,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17444180641450737861,3713413005948506330,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,1174477049103168148,17742005038801995092,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,15726978473995741249,10647789492213836537,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,18026008444750032715,3829372741967944024,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4480,i,11889120560538457823,16865761387900039450,2097152 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,1953883336409822615,1526174083198698610,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,10525664279580278913,328160114339992641,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,790933544129438358,3985796044881220157,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16045459029698298304,6108396241578712072,524288 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5336,i,5614744148110943723,8626645170914337657,262144 --field-trial-handle=2272,i,2143265902164100437,5294511361284229421,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 58beb28baf790c7a7b2e8a5e6249044e5e0c449bfac90e42c82ad9b1ecc7b5ec
MD5 a7cc9bc5b88764e2cd742c3ed60c552b
SHA1 e4d696aec29ab5cc61fb9806bc223a5be0397f18
SHA512 3ee35ddbfaf27fcb46164fa1e68615229198bd8706c3974285baf0fceea3b9b0125e128f298cdc3628f9f58e210e77995a45163bd231044ce951def0ed9091f7
TLSH
T17561C4386E1784A0D393E1B3759246E034658AFBF556DAB6C12C5860261772FDF1703D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 c863582d30750e1573ebf73b3ad723f05540f84c11089c1062c98a6b8155931d
MD5 d550a6c4774498d551175c24627acfc9
SHA1 e2bb6c7de7cc247ce64350687203fee44c8c04f6
SHA512 b7081fa34c5e99e7c79d9671e63c53746fad967f02af1dae4f11bdfa87597d8f1971264c368e4f14a831dc68a90f952808d444e065b239fa7a894ec3abdcc581
SSDEEP 96:e/h8wVORHoIUUKOn/G/ETkn1NHsepe/tethzC9Vl/AEvAbT2FaYGxQnMC:A8wVORpUX6/G86DMGViGzTxe
TLSH
T16FF184705D528C9CDB53A1B36AD544A070F648EFF8079EE6807D4078B32635AAFDB228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 15fe117db0ee029db5917812032d8e7ced198f27f08fcd7523e1a2971728bfd7
MD5 b625de7ac9916f6c81d68152fcc92b4d
SHA1 37e3a14d43b74211a9c75c32a1aca46c4617fc97
SHA512 583915a082e719dfe9ac41e6f1d67a0e8872654ea17f73b14d5d972304314ccb41323bebb8b577d125c4628ea3e28110f884a312d6c8e10b1b8617ee4fd24867
TLSH
T14F3138F3C7E9862DCA1512F45A182E1BCE2D0964431C3D3AC5D4AE6BA7E2571F14198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4bcd1629921dd8b51b070f5d488beaf1439e09fc515076944c227623b00b5337
MD5 2aab48f2e96b756982100838c6ffe6fe
SHA1 e777cced67e10c1e3fb2bef39b3b61b5863b7e61
SHA512 8382d1c4dfbd1a2b7863f41f9a2b7c24ae0149a883022967dab9fa8c78fdc741dbd1c66e42aa41626d20511aea987ad117e587f4bd0b7fa247537bbd15a7b5a3
SSDEEP 192:sxZB/yM/jK1Ml8Mk4/fSspPSAIdpJHW6+WNGYCI1WjAIgrJ:sxZB5M4/fSspPSBJHbGNY9
TLSH
T1A142F8116A34A977CCCBD20DFA41BF53D6F91472A2940D48A9FCDA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b8a18523d37011bfd81c56f4d80b52e3beaf89c6dcfe0d37bed3b078f300e904
MD5 73e4bc3907bb928a1d7957e97d66e31b
SHA1 7b2e83850fad9203fc2bf5489e0912dce4aad4db
SHA512 a2607be9711a6a921b55d1b0fd8ca9b0278016d868b2ab62cefce09286ab10c0b4225e8eaac4b1fd54b5a15c024afbe3d22d403c20ccd55efa4328f2fb444f09
SSDEEP 192:sxZB/yM/jK1Ml8UQFk4/fSsDPkdIdp+5HW6+WNzcL/YCJeOjAIg5NJ:sxZB7qO4/fSsDPke+Hbs/1YF
TLSH
T1BE52F8126A38A977CCDBD20DFA41BF53E6F5147291950E54AAFCDA1C00E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1b0b20aa9fdc6e3bcbabdd73ea962c55d6e3f3ee3923500481ff091f6cca9637
MD5 3673b72204878bb94fa5273194cc1791
SHA1 654edc2254cf0ab6a5ec027517a4440149f41c15
SHA512 41fdc2c6c101d3318836612e70f0040ba899880d3ed57de148a4080ddabc013daf1c0c2c0ca05800de2716047ce085230b58d1054fc547b4f13aaf483ae3cbdf
SSDEEP 192:sxZB/yM/jK1Ml8Mk4/fSsDPkdIdpE5HW6+WNzcL/YCLlWjAIg5NJ:sxZB7M4/fSsDPkeMHbs/sYF
TLSH
T15452E8116A346977CCDBD209FA41BF53E6F5147292950E54AAFCDB1C00E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6f484eea2391a660ea3e67d237544b8b7870754ab46707db4e7c5114c77947c8
MD5 220ba40def83a7eb6438e5082cfb1c7d
SHA1 28d0e12fc743ab8d37a699a4f4371964c5527b50
SHA512 a93e12ef544e280f501d93048f602742d3843487bca0ca5d09e1b05b7c164795159ad124a059adfb2f9a92475b6a1d579df14837b622ecd2696ddc8ddc237ba0
SSDEEP 768:HY8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVYroH:HY8bqn+WvSCt6u1jaCZLbWVjH
TLSH
T194D20A3B280CCB7E4F845E5DEC26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 35603db5ab5be797bd143756ec92edc6a2d27cabb8c28842f15d3682955ed23e
MD5 1d3b58583f88710d27d14e2deec42a3e
SHA1 03903bd1e84eb6162fe28405e09a24d11522aa3d
SHA512 9f3f5e886a7a4dbe6c1c26ccd1ae069636515c05bdeaa46f98f361d860077067c785e1c71ca8563141407a0a2208aef8b4c066dec5f5fdc6be7c19ab4c85c497
TLSH
T13ED09713F0390882DAFB5FA00E33202B02503C8844AA8088A80202148DD2B87D323F97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 e1266b16c903446c4f0783ce0fbc1140f876114a034a7dc5991c5879414dff67
MD5 bd1b5c563b45cb037c81f29550c98409
SHA1 27328c625e9a6a60734c2a4d69e5536fe1fc60e6
SHA512 77d418fc376520f41ddcddc1a57e13647162c06b69bd890ab0802c1ea1c6fca2600137bc14a5e426ec315ec1b2615b677966b6047036ed9fda6e17cc7112b450
TLSH
T1CCD09713F13A0882DBF35FA10E33201B02A02CC848968088980222184DB2B87D332E97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58cc54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58cc54.TMP
Size 138B
SHA256 1eeffec41bc4d37e84e7087566ef0836f87a7a9538ef0ecba15736211c6d2c9d
MD5 9c053f2edc64c15fa98c0f20a558c4fb
SHA1 fe923a6086778ce686f020906ce6ef45747e7234
SHA512 16e7cca2c39c0f57458e34779259e0be6efd5a2c61391c144f466d2a302d659bedbcd4598fa64345702b1042ac0400a18859068683ba77f2ce4bf7393ccaa47e
TLSH
T167C08CA3F1500105CB6266910622610B43052CC88886808CA02335142471B1BA202EE5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ee839bbd5f8eafbc7ea0206dd5e250299bfbe012e127144c9f25a10af24e89c9
MD5 1e40a368f64dc0523c391dad906615f8
SHA1 867ed12e98c1aa25354053631aad9e92c4065b45
SHA512 7a6f0e67cb19dc3348af7648ff43a2e04881dc68816d0ba2f33db2702780cfcdba0bde5207ecefadca2c67bf7e80c8cbca0afb04a2bde7f8d71bd3d04717f292
SSDEEP 96:K4/6KkocOh2KaIND2KEAmuT2K8ow5qDXhHA:0/1zVNZ
TLSH
T170C12306F03B320239FE65089396A6368E5271637819A46F3FB841661E77E111EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59096c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59096c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fc3bc94b1949815fbcf408130149113ce306bbdd8d25ac27e91692260e00aec2
MD5 48d0556ef80371b64e724e66147ded0a
SHA1 0c578c0b568c9e415dc0ef25781c517618974ba4
SHA512 49d324c4798021618bc86817766d986315e5f39174fce7beab9e6edbfc1e315d96167d8bb7e134f72c27a2381c6daef6af029e19b548d18c7569dff06cdc769c
SSDEEP 192:uSLsNTaQcilbiM9QmiU10N04Ea+jBOmBRZWMVamoqtU8:RsNTazmWLEa+1OA3zU8
TLSH
T1CE321A366D789C774EE6A144F44732139FE4506BCA8A2FA4D6DC5F0C00DF69C230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3af5087fd6056225426db6f163aa0ee28224a93efd1f3c963fc876d2ae8e8ac4
MD5 fb932d1dcbe2f16d05d0e68d6b6988b7
SHA1 c3dd7b0bacdb26ba3d3b0764a5157f82be12babb
SHA512 89a3a6659a6b4080460e2a1b0279777c43267313ee3e633acdf706c94acd78f9a3a643f632ab251501daed0c3c2527810c2183f0a8f00a3e79d35e4d3c6b3be2
SSDEEP 192:uQLsNTMQcilbiM9QmiU10N04Ea+jBOmBRZWMVamoqtU8:TsNTMzmWLEa+1OA3zU8
TLSH
T115322A326D789C764EE6A184F54732139FE4506BDACA6FA4D6DC5F0C00DF69C230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 ea0f3cb1de732f721d0bb114322361c324c081b15d43b267f800d402059efa50
MD5 ff42b97bbba264e17a0d030ce05651d8
SHA1 43c5999ad6431aaeb436f07138ab67731b310600
SHA512 c6d7a11fe16eba18eb1a1bd70fc61476c9fae27383f7bc854704a822a8d1b1cf77822ae2a2ee7476c2644f8667eae6474672f8fb7d6b719ebf847b6f11274e36
SSDEEP 384:3iFwzsNt8TUNTUlIlazmkLEa+1OAYzBeRs9JKgqijUohOGr:yFsswg4wasOAYzTjKgqmUohOGr
TLSH
T1D9B2E7F244D78976D9AE5783E77E2E034EBCC057F5856AA0B3885A0CCC861BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a2ad3dc663eba6fbaca625108787ddfaecb23fbd557259a3cd3b66576adb006a
MD5 3bf3d859f4868dfa42779124b85254f9
SHA1 4c467228ce824035bdf848ebf94d5874fc48be73
SHA512 aeced1dad1dd5f22af7fa6a9a9b3b227c063e5963e59ab62008adc6e55ec43f7f03a5fe787086254ced5278cd2308278fa7c769a64cdcc00fd4d1cd8d1663655
SSDEEP 192:uQLsNT/QcilbiM9QmiU10N04Ea+jBOmBRZWMVamoqtz8r+:TsNT/zmWLEa+1OA3zwy
TLSH
T157423B366C785C635EE6A145F54736139EF8506BC6CA2FA4D6DC6F0C01CF29C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a212beb3db9c630726e7188d6a6127df209bd4e672cc64eb7d38aca17b2f4946
MD5 95bf6d07c699a94117bdc7c85be08212
SHA1 db5a14ae82709520865b51f54eb40f185a8bf245
SHA512 149a331dbd594f578aef9da6f6efb14b7cbc76e5dd864c102e54b51105cb74a079cacede230e80391de07919b51cd8f7815280f31be8eb7d69935f67144ecaf1
SSDEEP 96:EqONkeQsjpf1bxX5ih/cIPURHl8h4otop5onD7BfPgvE5BzatIRdy+ZhOmGsR1oC:vONa6Db6QmiUyUFHBa+jBOmBRGRgyaU6
TLSH
T1F202F935697C6CB79EA26E48F88737279FD4203BDA966B90D6D81F0C00D765C230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 578ecb925a147acc175912eeee7609be63406b0aa883d24a0eee17fb4b64bcdf
MD5 220e1b7f801b49bf73fd86d3055fbc5f
SHA1 4ae528f6457081a975d494f5b880ef077e0662d9
SHA512 4c8e3c095931c5f4e0cbf6e3f2a2b937cfe8269d48550ca68a30e9cffe2882f78d73eaea3acabd20222af77e087bce7cfd4f73d18cc1165a9e538c094309e8db
SSDEEP 192:2ONW6DbqQmiUyLFJBa+jBOmBRZWMgNzoqtU6:2ONW6OaJBa+1OAAzU6
TLSH
T17C121936B97C9C775EE26584F88732139EE5516BDA8A7F90D5DC2F0C00DF65C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4614540d55b76bd5e6fd5043e964fd805d51647aea2cea2d89177f5e522b464d
MD5 135c5ccf1a296d1b3b1808913239e7eb
SHA1 fa7aa4fcf1b6553527c16ac78170f414bdd8bba9
SHA512 87b4520e80bd3b379f8ab06e52e717d229540cfc25fb5e00fa3c02379d0dca6976397a1771c57ca2bd46c222378818da610328dbcd6ca0d8072fad90e0bf1827
SSDEEP 384:3iFiZcI8zsNq8TUNTUlIlXzmkLEa+1OARzBeRs9JKgqijUohOG+:yFQA1wg7wasOARzTjKgqmUohOG+
TLSH
T1C9D218F244D78976D9AE9743E77D2E034EFCC067B5856AA0B3985A0CCC860BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

661de5df-324d-421d-a8ea-11a54770dd61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\661de5df-324d-421d-a8ea-11a54770dd61.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f287b9edfbe5310114dc2f4cd156bbfb56bfd145813d959f17e5061663ad3989
MD5 ba333d9b5058fb23bf97cdc353e438b5
SHA1 cc6fb79c022da126a9bec4bc37b064027944ebe3
SHA512 8a30d285310d9783f86e6eff0272f12d4702876cab1551b5780bd8116af47b8fb9ddceafdd247d8c5eb3a5c3782fe561363aa02e008b13a03734385651c64b6b
TLSH
T18041255CBAE91004B3B36E4AABF6A46D487BBD632E0A959D00110D4F0A32A40DC61B37
MD5 SHA1 SHA512 TLSH

Submit Download