hxxps://discord[.]com/channels/1503721682936926230/1531754288223617135/1531754288223617135

Analysis

user interaction
yes
max time kernel
40s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/channels/1503721682936926230/1531754288223617135/1531754288223617135
Sample260805-2q7z2aed54

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	discord.com
33	discord.com
42	discord.com
52	discord.com
7	discord.com
8	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304437083385003"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{92026931-C984-4B9D-8876-55BCBF2D52FD}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{D5B2F61B-E624-4002-B095-0936E39C9E51}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2508	4640	msedge.exe	85
PID 4640 wrote to memory of 2020	4640	msedge.exe	86
PID 4640 wrote to memory of 1980	4640	msedge.exe	87
PID 4640 wrote to memory of 1980	4640	msedge.exe	87
PID 4640 wrote to memory of 1980	4640	msedge.exe	87
PID 4640 wrote to memory of 736	4640	msedge.exe	89
PID 4640 wrote to memory of 736	4640	msedge.exe	89
PID 4640 wrote to memory of 3712	4640	msedge.exe	91
PID 4640 wrote to memory of 4256	4640	msedge.exe	90
PID 4640 wrote to memory of 3712	4640	msedge.exe	91
PID 4640 wrote to memory of 3712	4640	msedge.exe	91
PID 4640 wrote to memory of 4256	4640	msedge.exe	90
PID 4640 wrote to memory of 4256	4640	msedge.exe	90
PID 4640 wrote to memory of 1060	4640	msedge.exe	92
PID 4640 wrote to memory of 2012	4640	msedge.exe	93
PID 4640 wrote to memory of 1060	4640	msedge.exe	92
PID 4640 wrote to memory of 1060	4640	msedge.exe	92
PID 4640 wrote to memory of 2012	4640	msedge.exe	93
PID 4640 wrote to memory of 2012	4640	msedge.exe	93
PID 4640 wrote to memory of 4848	4640	msedge.exe	96
PID 4640 wrote to memory of 4848	4640	msedge.exe	96
PID 4640 wrote to memory of 4848	4640	msedge.exe	96
PID 4640 wrote to memory of 2512	4640	msedge.exe	98
PID 4640 wrote to memory of 2512	4640	msedge.exe	98
PID 4640 wrote to memory of 3736	4640	msedge.exe	99
PID 4640 wrote to memory of 3736	4640	msedge.exe	99
PID 4640 wrote to memory of 4208	4640	msedge.exe	101
PID 4640 wrote to memory of 4160	4640	msedge.exe	102
PID 4640 wrote to memory of 1860	4640	msedge.exe	103
PID 4640 wrote to memory of 1860	4640	msedge.exe	103
PID 4640 wrote to memory of 5596	4640	msedge.exe	121
PID 4640 wrote to memory of 5596	4640	msedge.exe	121
PID 4640 wrote to memory of 5596	4640	msedge.exe	121
PID 4640 wrote to memory of 3188	4640	msedge.exe	124
PID 4640 wrote to memory of 5828	4640	msedge.exe	125
PID 4640 wrote to memory of 5844	4640	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/channels/1503721682936926230/1531754288223617135/1531754288223617135
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,16122624054595865035,2838911814363695749,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13546149128354589058,8044561444819907744,262144 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,1770106640862332638,2766463199371271126,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,10426058170316901306,4346516666209343686,2097152 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3775882408178000747,2968965015257815885,2097152 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,3336368485651878086,15380697696648743893,2097152 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4120,i,7242387729292756981,71212628686320170,2097152 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,17781599609417001935,14349710812365966330,2097152 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,16537097161338890002,8157820632998343113,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,7219670915008685559,12883048693728665279,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,14314665064320959072,10699405975398487599,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,14314665064320959072,10699405975398487599,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,17190611363501281075,10710443357113059164,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,13001530667592506864,3414572591843911466,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4500,i,1998778629958231163,876949708006343272,2097152 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,9835765703014424116,10424873247685146582,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,4283843707864390525,162614027591579335,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,3863407048140377774,15187086633998431511,524288 --field-trial-handle=2892,i,7967588883149399113,15371404283452437207,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0e477a5f501898f5d9666a45ff0030298aeb4070def90c3af522bd0acc21c406
MD5 9e7ad8797e5bb2984ef3002319716aab
SHA1 a769fe2c27c4bc6e3db9710c182434e7450c4256
SHA512 8c68edd4cb362078dc7dbef5fbb0fe9986be60a8dbf6341d0c9b7c1f94ba09ac74695994792b6c30034a3e0d4696b57c97c3cae4e271c0e04dd2410fd54f77be
SSDEEP 192:sxZaRkyM/jK1Ml8Mkbj/f3snFfNIdpEjHW6+WNzyK/Y9Ia/bmIgrJ:sxZaWMX/f3snFmCHb//H9
TLSH
T11C42F712AA346977CCDBD309BA55BB53D6F8057292940E54AAFCDA0C00F6BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 129003fe96bb206cb2333a352f004f54ce283529d67bb0805068de67dbab7d1c
MD5 5196ef0ee35ff5985bcf7bb1b0ec6604
SHA1 f563395e67ac8c4e9ff2427ea41904186942c2e1
SHA512 8d34492d69de67426d0544e0b28f646f399af22ac9a793fa1b7641bd7ffaa55b0707862662ea32235c059ce2f66ab8422128aebb1178dcff1b9dbb85d5e49582
SSDEEP 768:aXcv21wWvu+z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNproMg27h:aXcv21wWvu+z+u1jaeFLeRNCMp
TLSH
T1A8E20B2B280CCB7E4F845E9CDD2A6F8A6ED801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 bfa919de54a757a00f7b388aa768d2f83118748caf82a291d34a1488d1398cd5
MD5 12b5eefb9a49941f02c07771b8bd77dd
SHA1 3f6dfdfdb555537e898e646a4a2a973085476005
SHA512 024a883699224e87d755767d7c6b0f5247f35cf3fd927864e7ba67bb22e4398909e69d339cb29cb4db06a14749de771e075db6323f3464dadcd647cd0bb4c49d
TLSH
T105D097ABE4320480FBBE0B411A22108A82292C8C188D804CF027361C0838F8FE212ED6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 8ea433b232eca4c1d8ce47db33454aa3a18082037d51aa103d8865e6e470a4bd
MD5 e1e85da90bea321fe00d06887fab3a0d
SHA1 49bc7904c2b3460c52c25aa2d7a53b1472884c2e
SHA512 cf1d3448104473f5792751815e81ed11d29f40cbc3dc5a40233a671b8ee35730de54643f941842c492743a85a37b6181ecb0a07b2607a217637b27c34aff0944
TLSH
T1B6D097ABE0200480FABE8B401A22105A82292C8C188D804CF022151C4828F9BE102ED6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587c8e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe587c8e.TMP
Size 138B
SHA256 252a9910d21bf90b12f94fb737085ef478e219b2ef862087cc61d86a994a7cca
MD5 8e42ec3d781fa4565e7f81f0068ae2fc
SHA1 13f4c2fe9f1c5a38c6412192c4fb94bfa7568b48
SHA512 0dafb618c3bcabf7716c8672efb3f335bce1199a3ecf4c64f355d0a3be0a6d65dfde948d50c7ce388eb15cd16cbb682c97b322c5132ff0625bb6ee309c7f62b6
TLSH
T1FCC02B67E4500456F72907400332800C43092CCC4CCEC08DB073345C1030F2BF102EE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ccdebb030931bb54aa5cff15274246fb28c04976ba5925371bcd6e638f240c54
MD5 9c2ad1da251c8d0c2b202ef4338cc51c
SHA1 13a178277fefba8aeb7bc11ac9520586484d2579
SHA512 ba9b24da3ad59a5ab7614a0a755e2b92d87423d6e81b1135ed336d25dad3c5fff566aefd6c32ad2441b4e8f45e0342e88fd5e398827786e24a3045aee9229c83
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDW6a8KjyC+vuKUM1:mT0PhI
TLSH
T1BE91650AB1BF46413C3E6D1C9F5585254E4633A3340CB4ABBBA841A64F6BE215CFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d5ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58d5ba.TMP
Size 178B
SHA256 88aee3aa94cd98441217d0c512455dde4ce46966425b3c2240c25a8fb1fd4d54
MD5 9ed50dcb83b932b58fa8040f39ccb550
SHA1 b0a25fa6e5bcb202c3c6eaf080b6ab213c34bf56
SHA512 3d09095ba683f2d95651b3c6e3b813346a747453d8a0a0e8d138621d0b0a126cf78dd684a6239237dc19053f99388513939b849ecba085eaf188d413ecd65835
TLSH
T1BFC0807B1081D9B13F3524E7675775CEC5767FCC4CC1954C546230192230C5B1101970
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 36f4198246fb44c0eec658775dd4f717237923f35c7568601170e5a0ec205594
MD5 c5fe01b0aa70c4e5fece55b58c830ca7
SHA1 e73821267c8e3e1c30424f6dd4109b6dba843d45
SHA512 4b17212c19cb62e32b71683350de26453d985fd8501070e88b2faf13e93ceeeffb7fb454b7033168b7660adbd07ad286e4a3e92806c610697f6970a58e7ad4fc
SSDEEP 384:bZcIhsNboulRziVfxe+CBd0esHzBeRs9JKgqijUYBO:DhClxEoJxsHzTjKgqmUcO
TLSH
T1C2928D3198342C7B9AF6F581F58736135FF89027EBC53F94A4ECAF1D01AB5A8130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c8ebb78fea71ac4f72537831bd066b8e5df6eb3fc81ed01c77132f06051abc8b
MD5 5f4421d7af164217ac5f0532ca2bb47b
SHA1 ac47694eb69a0df692d709fffa72bca9d23efa06
SHA512 97ae4767a6e22118e136187665a783b8c19c9f578e9da9f4f6554eb1eada005f5e5dae82f573f6db302b5d118d861a3513d3221e65d8376d7cad85547769d1fe
SSDEEP 384:NZcIhsNblulRziVfxe+CBd0esHzBeRs9JKgqijUYBO:VhPlxEoJxsHzTjKgqmUcO
TLSH
T1BB929D3198342C7B9AF6F581F58636135FF89027EBC52F94A5FCAF0D01AB5A8130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b89f6d7699f285dea4eba62ff2e6d54010a916adc87556581741deb8bae481d3
MD5 afe7b960f029e14ff01a16fa658af367
SHA1 509ea7704b05e2d72e62179f89ff9835c6de1094
SHA512 6225269030f5a7442b965a94f3a77bbcf40a5a0a0cc3deff79e656fb6555ba14abb1fbc6b0aaa6598fe3972c3210e6dee455a0dd15b09efb98870f29dda81e31
SSDEEP 192:JONa6v+YLNQmiUy7GZh+CGD+FdeP9ospuso2AU6:JONa6vz/LZh+CBd0esJhAU6
TLSH
T16302EA35BC381C6B9FF2AE45F4873A175FA82177E9952F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 95ad3744e7f753e1ab5f7013221cd02927be6b5a2b4c458d4117ead2da2abdb6
MD5 afdb4bae641fc680726c502718699262
SHA1 910fa4ea0ac756cbaf3ff57b1e2a513e84b17f08
SHA512 7c2e9dd92ee9cc409d8cf1734af0fe0e46360df9af58d098d0a6d3dd995fd1e67359f47b9e605b4f96e88974779fbe2492932ed96d652d37786e2b09299a59c0
SSDEEP 192:2ONu6v+YLWQmiUysGDh+CGD+FdeP9osNOeBdCH5qGU6:2ONu6vzGeDh+CBd0esUzU6
TLSH
T146120935A8782C6B5FE2A545F48735135FA45137EE8A3F90E9EC2F1C01EF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 08ee33c840947b3699ce2b8836771dde457119f0a6760794859142405f9dd8bd
MD5 7da06fcc9643eb19defffb2ae3fe56be
SHA1 262ea28a8be72b4dc986a8e3395d0ef18fe8b001
SHA512 2b55b766fadc41074c22462218d13a7ce428b3c8a3a00cb8c07144d8cfa99e0ea0ae6a6cbca26689b835ab205db7e523b6e4a9d032ea6bcc63976165db3e2f57
SSDEEP 384:HZcIhsNblulRziVfxe+CBd0esHzBeRs9JKgqijUYBO:vhPlxEoJxsHzTjKgqmUcO
TLSH
T17A928D3198342C7B9AF6F581F58636135FF89027EBC52F94A5FCAF0D01AB5A8130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 23ce36bcd89ef5e0ea2bff113a6a41f0412de6cb32800a50062c199392ba2fab
MD5 c85ca14f1413f869b5cbaa8dc445a302
SHA1 7874cc0bc7a651234d5efd271a7880bb5afff28d
SHA512 b2497fbed3dee2af42e6cbb2cc21d1290f05c753816d998f630f2dcbe2762e5e9fcde96da5f442597b02d8f71b11a5d3a4144a85deacbcbc053ec82bcba3a940
TLSH
T19E410B6DBAFA1119B3B36F46AFF6A86E447EB9372F06945E00110D4F0663A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads