5b86a6e8f279d431a7a72722273771303903ce0640d7e302e465f09f63569c3a

Analysis

user interaction
yes
max time kernel
898s
max time network
416s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
discord username checker v2/discordv2.exe
Size 16.0MB
Sample260808-bvdc4sfl9v
SHA256 5b86a6e8f279d431a7a72722273771303903ce0640d7e302e465f09f63569c3a
MD5 885df0691b3bd227546b97d5b66cdf39
SHA1 0f55f4dae206725b35dccf945ddf75a901a2469a
SHA512 b606a2bb2aa875230212848afec9db09288eedde3e29bf3b644db2d4dae37aa6706f1cf9a2f648ee459ed5ec080e2b24f0086864d1adaf04b3f4539098533287
SSDEEP 98304:vSiFMqxsyUXdmE6bkmEJB859/5ut6JG4GReR545U4E6i:vX9SyUXPu5tGfzUx6
TLSH
T1130739A3E89216D4C4EA8274D672417BB7617C491B3833E30690B7205F37BE4DEBAB45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	discord.com
25	discord.com
26	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2636	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4568	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2636	5004	discordv2.exe	83
PID 2636 wrote to memory of 3988	2636	cmd.exe	84
PID 3988 wrote to memory of 4080	3988	msedge.exe	86
PID 4080 wrote to memory of 3852	4080	msedge.exe	87
PID 4080 wrote to memory of 4568	4080	msedge.exe	88
PID 4080 wrote to memory of 4196	4080	msedge.exe	89
PID 4080 wrote to memory of 4196	4080	msedge.exe	89
PID 4080 wrote to memory of 4196	4080	msedge.exe	89
PID 4080 wrote to memory of 1844	4080	msedge.exe	90
PID 4080 wrote to memory of 1844	4080	msedge.exe	90
PID 4080 wrote to memory of 1136	4080	msedge.exe	91
PID 4080 wrote to memory of 1136	4080	msedge.exe	91
PID 4080 wrote to memory of 1136	4080	msedge.exe	91
PID 4080 wrote to memory of 1368	4080	msedge.exe	92
PID 4080 wrote to memory of 1368	4080	msedge.exe	92
PID 4080 wrote to memory of 1368	4080	msedge.exe	92
PID 4080 wrote to memory of 3672	4080	msedge.exe	94
PID 4080 wrote to memory of 3672	4080	msedge.exe	94
PID 4080 wrote to memory of 3672	4080	msedge.exe	94
PID 4080 wrote to memory of 4124	4080	msedge.exe	95
PID 4080 wrote to memory of 4124	4080	msedge.exe	95
PID 4080 wrote to memory of 4124	4080	msedge.exe	95
PID 4080 wrote to memory of 632	4080	msedge.exe	97
PID 4080 wrote to memory of 632	4080	msedge.exe	97
PID 4080 wrote to memory of 2428	4080	msedge.exe	99
PID 4080 wrote to memory of 2428	4080	msedge.exe	99
PID 4080 wrote to memory of 4804	4080	msedge.exe	100
PID 4080 wrote to memory of 4804	4080	msedge.exe	100
PID 4080 wrote to memory of 4804	4080	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\discord username checker v2\discordv2.exe
"C:\Users\Admin\AppData\Local\Temp\discord username checker v2\discordv2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\system32\cmd.exe
  cmd /c start https://discord.gg/RTpEpdS6WC
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/RTpEpdS6WC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/RTpEpdS6WC
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffae102c188,0x7ffae102c194,0x7ffae102c1a0
        5⤵
        
        PID:3852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,11909051841887899697,14604436771131057109,524288 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,17938101799598796423,5956947866509066704,262144 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:2
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,4193111154742535910,7371140579475642635,524288 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
        5⤵
        
        PID:1844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,3731293282725355473,11321314046665418192,2097152 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        
        PID:1136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,17062295877196209160,13797715990683862654,2097152 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
        5⤵
        
        PID:1368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13903551844191722844,15435620438663893211,2097152 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
        5⤵
        
        PID:3672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,4064653490549332972,18373902595652854539,2097152 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
        5⤵
        
        PID:4124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3178443598777651889,10064057359039023253,524288 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
        5⤵
        
        PID:632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,10229323151634338626,1923379132014678985,524288 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
        5⤵
        
        PID:2428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5456,i,1819029055132289727,4838013215375777052,2097152 --field-trial-handle=3012,i,16748952282825232166,2652078209770726086,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a531d1df9cdae01b650e532ebd4a8c9a4289931e89fb896753dce715d03331d
MD5 e993dcf44300205328a008fa868eaab8
SHA1 005ea0762927bd4df122a5932c9a47e268573e57
SHA512 021dc142847ba30397366fece985ced0649c66fc9ddfa58b99261463107dce9ca4fc43a79aa0b2985989883dd5a6644c2fe5b1c87d24a8455123f7d724943ff2
TLSH
T1D6D012232A9DB411FB695274A812CB00173655A024868711E211C49C86741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b3178e8311c1224bd5263b82833e7c8699a98f41d45776e848151afac5abb36
MD5 1fac945bc89680f07a15e92caaef80f7
SHA1 99229fa92d8dd9904617715cf7e0973fcf13d02f
SHA512 173d53253ca2ea3355e730566ca758de046be86edd2f2d9e216bfc24d1f8ee6296af697837270c38c689474249a311926198240e82513fe87a1fb4ec6d62e944
TLSH
T1B5D0A723696D7491F77D1278A912CB00173955B225468301F200C89CCA740D962D6EC7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1866317262d5e57b05dde7e200f94d3eb430822987788e6f0b1316b694dab3d1
MD5 dce8ae9a9199cfb9f12a7346ee7de601
SHA1 35730f3de701c848186f46c039cf070645d190b9
SHA512 285640a540f35157bcb685160ddeb7d21376b0c0c2c646ce000f9a06b1454f3f1a762482eca13f618e6168b286d8b851a778ecdd9ff45c1e0c712dfc2811b42d
TLSH
T1E971B3640A1140E2FBB0F2B0F4CE52147A7182FE58DBAECE84507F307BD47F191608A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe57e4a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e4a3.TMP
Size 3KB
SHA256 b31be90900de2d3a746558f3b2033fc0f407747004db5c1ea6c7ec0868468ad8
MD5 54fa3aed41d111b6b5774ee374bb160f
SHA1 302a466d1bd3923cbf58e5099390296a42b1883f
SHA512 06a9969943aac375b12e49c6f8189399c34c912e2963b54111d22ea74ff3e9e477784234546576b138d090051bb32fc5f43d6efa6ec9a7293b71e5f71d8411d0
TLSH
T13E71A3640A1144E2FBB0F1B0F4DE52147A7182FE59DBAECE94507F307BD87F191648A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9b0762f571b254334465bda464618ba8836f9cc3e6afa19b65ec97a3773f38dc
MD5 7c0d30fb5a5c7ba1fdacf8bab7601d17
SHA1 312a0c41c7a7d30709d8e8c3eaa6528143e50221
SHA512 4c0249a70fbea77453120138740ef11d253d90f451f083284e79c5041120ef82789bcfb7d1b440ec16c9cff333f226bf97558555d446966b00aba4063fc23ad4
TLSH
T1D3218CF7C3E8993D8A0146F4AB156E2BCE2D0954431C3C2AC4E4AE1F97E35B2E14055F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4ff18f190a9fd4c8d532683b42a520702b0cfbe3803a226e389f08172f73fdb0
MD5 621984ec634461aa9a74aa2969e9e14b
SHA1 a0bf59d600d59533f96214f1011079bad3709e1f
SHA512 9145e9c240a6d2d1eca0a316c2f2209902bfda1cfe90aae13faed73369b8f6e925cee0b39ff120c44f8ab008da3902d419153cd651c59e1aee94180ff48538a3
SSDEEP 192:sxZRRZ1yM/jK1Ml86ju/f/swWpVQUMLEdpnjHW6+WNgGUy/YEDXlfIgEJ:sxZR3PXu/f/swWvQU5jHb3/TI
TLSH
T11152F912AA34697BCCDBD20DFA557F53D6F9146396900E54AAFCDA1C04E6AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e931a08256f63ea8084fff7dfeac59778ffc58025cfd40fc59e81a9b235338e7
MD5 f0c593c0002d180985cd9155faf04343
SHA1 12ecbcb4868bed6a1060aed3369e9da5a2fd6c07
SHA512 11224443c67665b4630662d6fbf2283473546521427d9b4bdcfaa17cc01473231bced0e3f9184850295d2c4214b3e86a2f3a1735f53b21da22971a50dce0e615
SSDEEP 768:zO4Rk2UWvssLg8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4TLlLBERorodX5aocfuS:zO4Rk2UWvssLgu1jaXTLBWRTjP/S
TLSH
T191E20B2B284CCB7E4F845E9CEC2AAF966ED802CB97644D5447FA844C03C76EA51178DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 86e8472e096113c8cc685230544f2f591602f8dfeb72554a5a3d5edf2d3482cf
MD5 f64ac37bf800301b74de5eaa6c39c3d8
SHA1 bdca310517ab6c1f231a7706d9e43d907749c356
SHA512 82b379077e55efd884b9c01774ec3abdd7834747279fc51079f9fd6ce51c8a5e499ca72e7c93261448a07e95b7f4e1f2a50b58a150a05d5df0e58b49566ea5dd
SSDEEP 384:zMsNN36sFt15dQ4sw24n+SK53iR++daexcx/Si9mkgi8l:g/i1n3nZK5oxdaeW/x9oi8l
TLSH
T1F682F63D9C342C7F85AFBB09624E2A279DB4123BD6B45968E7D40B0CC17B58CF346925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc71038f099253e49abb707b082103cf636398a544253cd706006d23a936ce8b
MD5 814e182cf655772c6819e2da05650ce1
SHA1 70868358972a69a53629ac2af9e919931a99a0c3
SHA512 3b47898ea16a2ed7e1a1aeba73c4fb4065fd91c3b2725fb180a60a7b8d85d3057ce78ebeed889af2b95300ad2d414bbb342244790d39093ef185f2879d989ab3
SSDEEP 192:4ONg6JpmQmiUy6jGocQ4sw28Dn+SKdb3iR++dLshsGqCbU6:4ONg6q3CocQ4sw24n+SK53iR++dL7uU6
TLSH
T1B5120835A8786C7B5EE3A841F5873A179EF44227EB84BF54D6DC1A0C40EF65C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9109727592e3b4aed86e7c55c39efe355ffac9157c5490b0dea3c8036521c627
MD5 ada0ad8350786bc2e151d8d5adc4d97c
SHA1 daa05d6aae92074914ee724533d7647f6e0af389
SHA512 2088dbff06148d996ffb69a6c95078f89950cef3a4ccc1c01768c1e7e6842c4c5dbb9392ebf513f59072ee6ef20684a8ee7c729b9646c83613e55da86594c02f
SSDEEP 192:lONd6JpdQmiUygGgcQ4sw28Dn+SKdmsFHz+U6:lONd6jMgcQ4sw24n+SKYkiU6
TLSH
T1C802C835AC787C7B4EF3AE45B5872B27AFE4117BA6906F44DAE81B0C40DB64C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

3bde3d6d-4486-433a-b6e7-f5f67ea7dd1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3bde3d6d-4486-433a-b6e7-f5f67ea7dd1a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads