hxxps://cdn[.]discordapp[.]com/attachments/1537916585199542292/1539568201808216064/afroo[.]exe?ex=6a86ca1f&is=6a85789f&hm=a14af553d9fceb5ce4663c735efc800ea3c7328d04e63f5a6fb0efda3dca057c&

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1537916585199542292/1539568201808216064/afroo.exe?ex=6a86ca1f&is=6a85789f&hm=a14af553d9fceb5ce4663c735efc800ea3c7328d04e63f5a6fb0efda3dca057c&
Sample260819-lkfetsgr9t

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
15	3808	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
4944	afroo.exe
224	afroo.exe
1500	afroo.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316057236181439"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{281AF480-5025-4338-ACE6-795AB9CE25CD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 1636	3976	msedge.exe	86
PID 3976 wrote to memory of 4392	3976	msedge.exe	88
PID 3976 wrote to memory of 3808	3976	msedge.exe	87
PID 3976 wrote to memory of 4392	3976	msedge.exe	88
PID 3976 wrote to memory of 4392	3976	msedge.exe	88
PID 3976 wrote to memory of 2112	3976	msedge.exe	90
PID 3976 wrote to memory of 2112	3976	msedge.exe	90
PID 3976 wrote to memory of 3480	3976	msedge.exe	91
PID 3976 wrote to memory of 3480	3976	msedge.exe	91
PID 3976 wrote to memory of 3480	3976	msedge.exe	91
PID 3976 wrote to memory of 2580	3976	msedge.exe	92
PID 3976 wrote to memory of 2580	3976	msedge.exe	92
PID 3976 wrote to memory of 2580	3976	msedge.exe	92
PID 3976 wrote to memory of 5024	3976	msedge.exe	93
PID 3976 wrote to memory of 5024	3976	msedge.exe	93
PID 3976 wrote to memory of 5024	3976	msedge.exe	93
PID 3976 wrote to memory of 1300	3976	msedge.exe	94
PID 3976 wrote to memory of 1300	3976	msedge.exe	94
PID 3976 wrote to memory of 1300	3976	msedge.exe	94
PID 3976 wrote to memory of 552	3976	msedge.exe	97
PID 3976 wrote to memory of 4720	3976	msedge.exe	98
PID 3976 wrote to memory of 552	3976	msedge.exe	97
PID 3976 wrote to memory of 4720	3976	msedge.exe	98
PID 3976 wrote to memory of 4432	3976	msedge.exe	99
PID 3976 wrote to memory of 4432	3976	msedge.exe	99
PID 3976 wrote to memory of 4972	3976	msedge.exe	100
PID 3976 wrote to memory of 4972	3976	msedge.exe	100
PID 3976 wrote to memory of 4972	3976	msedge.exe	100
PID 3976 wrote to memory of 3644	3976	msedge.exe	101
PID 3976 wrote to memory of 3120	3976	msedge.exe	102
PID 3976 wrote to memory of 3120	3976	msedge.exe	102
PID 3976 wrote to memory of 640	3976	msedge.exe	106
PID 3976 wrote to memory of 4944	3976	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1537916585199542292/1539568201808216064/afroo.exe?ex=6a86ca1f&is=6a85789f&hm=a14af553d9fceb5ce4663c735efc800ea3c7328d04e63f5a6fb0efda3dca057c&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffef897c188,0x7ffef897c194,0x7ffef897c1a0
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,4576712629266798053,2632157152393906830,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,9663235042048039088,12882238993869955616,262144 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,12694465977155814935,15819276601338972736,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,11079715957865867297,8897191130610231599,2097152 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,18240572411855049999,4377333880202094230,2097152 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,13008170876085257816,17402268258200068061,2097152 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,10337547680278344410,8144364426173781169,2097152 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,16372182980158845608,14566757066716352771,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,10784336553846628276,11814087452704591419,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,2513974875937277159,13905925033230372918,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5688,i,3268529512824652556,13666871841493442816,2097152 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,11811900664522676480,12122242318810586272,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1541446788051870476,8090193255244097265,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16244421592725969273,16406623201735670223,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16244421592725969273,16406623201735670223,524288 --field-trial-handle=2204,i,10642536070756876058,2911848219766535827,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:640
- C:\Users\Admin\Downloads\afroo.exe
  "C:\Users\Admin\Downloads\afroo.exe"
  2⤵
  - Executes dropped EXE
  PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:856

C:\Users\Admin\Desktop\afroo.exe
"C:\Users\Admin\Desktop\afroo.exe"
1⤵
- Executes dropped EXE
PID:224

C:\Users\Admin\Desktop\afroo.exe
"C:\Users\Admin\Desktop\afroo.exe"
1⤵
- Executes dropped EXE
PID:1500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

737ccbae-226c-4937-aa24-9b158256fdcd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\737ccbae-226c-4937-aa24-9b158256fdcd.tmp
Size 8KB
SHA256 3941d49c7c723626b24adfd802a92af271068f893a4cd27eca2f36c1d2e4a74c
MD5 a75980dd4c608af837044252102b4022
SHA1 9961aa12e8cad7958e8aabcf268a709780f70583
SHA512 67cb4f15fab8bf930322bbe895a4479474f5612423f2783723aeb55b99407a049e63324391368dda4e6e268e60d3a19c887082f20e00a708911f395bcc11ea3f
SSDEEP 192:MONT64BAQmiUy/1SW5GBPKRV+FdGy5LaDhvPSU6:MONT6eAUYWcd56ZSU6
TLSH
T1470209356C787C6B9EB2AE45F48637175FA8107BE6C05B44EAE85B0C00D764C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 db8427499dbd08b11fb0cf6a3e4620109f1a225b920f9670e3ad6f2c10edeb7e
MD5 219828efd38ffab468bfe22966dc99e0
SHA1 6051891a5bbec5710dbaa520f25c98fb2d982c65
SHA512 085013ff91a5fa48a1d49c5039fb8075851191c86b8c42b69e435c282b9b7ead4f170a60ed73214e877678bd8b28251b614d4f2ad7e7790c2026eb5df03ad662
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7/:fwUQC5VwBIiElEd2K57P7/
TLSH
T128B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9f619a36c60026c4350ebae4b570905969591241ac954d4011f59b97c07e58f8
MD5 38bf6c5a5c27890b527603ea8c11f697
SHA1 633b804a2950dd5b88f1f10dddf773dc18110f80
SHA512 ee93234b03d97f52e302ae265007bbec8b798409ceceb33fbe3b27f226b6b64df2893c09a718382978c34972d28bd06f829f4e609b3d81e6a5b0e572fec26796
TLSH
T10B711839C50E88A5E7E1133291E20157B87D86DBF803FE8552A0BBB757E4713829EC97
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5868a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5868a8.TMP
Size 3KB
SHA256 a417d8afa32652bca074131ee8aed6e8d441efcd5d5a08493d864435c1616946
MD5 e32fcfaec907b0d50595a6891dfae211
SHA1 7fd7b809f713b38c283f0b68ab975506f1180495
SHA512 f05d2fa04d7f9b39d17370a11eb8e9b9510f87abeb92455b8fb20b94cf95916f15fe5085c44608722c9e587ec8e59d40f31628764a8cb3b86029da0929bfda6e
TLSH
T17D713A39C50E48A5E7D1133291E10157B83D82DBF803FE8552A0BBB717E4713868EC87
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c2bd4de4984dd396578c64b69bdc9388e6e1be1f353180d9359c84906a3e2a0c
MD5 c79e778dfa06fa811a128ae0a8e69f79
SHA1 0819d1419eba1ca32ee468b2372fdfcc6d8e961b
SHA512 0ffb8fdb56c9adb32f2630c49a6e22779ca568bb46fe7e410632ca7388a557850aa1317e3db020f6a3c7be78b729e0122273edf1fe1cd17db050c6f8f43f43be
TLSH
T1D02198F3C6D5866EC9491AF06A146E2BCE2D091443283C1AC9D4EF6BE7E30B2E10194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e150e7c7027f961c4f9727c35ea20703550a5b2e4d16772442359f1f1aa631a6
MD5 c1379927f001531fb98a58ccfcc2bb70
SHA1 e346cbf43d7a77d105c137bf9b63c345af3f2065
SHA512 64b4efdad1fa251189c44aa699e60532602eabda16e9fe5c7482a8d7ef62b22f5ee84a38228d6ed81122bd3debebed9ecc21b31f8d00391f18a8cb4249eacfc0
SSDEEP 192:sxZqRKyM/jK1Ml8j9X/fMs5WpV+qFWIdpJHW6+WNGYzm+QQIgFJ:sxZqocX/fMs5Wv+q5JHbGSv
TLSH
T17F52D751AA34A97BCCDBD20DFA557F53D6F90473A2900E44A9FCCA1C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6e31d8389d98a56745a0f0285a87393801163d02f958f9525a17a84b6ac4cf69
MD5 4dbc19830588b3fe015beb81ee3e0cdb
SHA1 9893011fd2140206c4c8d5f844b8a7a06665307f
SHA512 d77e9c9631e1c6d3ba7e35b725646a5b8b9809d35d4f157c2fc65f93a4c4c4b8feb6559ffe50582333262835c8a0fad18786e61d21a44665763215dad222c876
SSDEEP 768:GhW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj7roIvip0Y3:GhW7kf0Wvqidau1jaa5LA3jIpR3
TLSH
T198D20A3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 68545d797ca6bbaebff36cc90bd949ef6069ce97cf7f84b3670b2db88d9ba3cb
MD5 5aac939540137514eb3625e4df0566fb
SHA1 8cb58950b287a4f9602232d274e14734651ec126
SHA512 945f0cc55a08eff84d35154959b588fd714b51176e515cea7ef2540f58ba9b4aaf9df1b04dc6a0b57a89f0344899a8eed5b391e6867fbf4332444fbad7112abc
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTWVce7I1KcEI7y1BItKC4Albo9JTZtrg96aI9xrKJ:KIbCKcWVce7KKcE2WBiKC4t0wKJ
TLSH
T11E91721AB13A1201387E6D58B26F86775F4332A33018E4AF3FB854A60E66E114DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b9ff003b4c14d9c613546a0b09503a4463d8b1b350dec145e709eee43749e702
MD5 e0792fe7f1da0e6ffd19703a046dfc39
SHA1 f9adf69bdc255d24e8e8e729bb67b90bd4fbab08
SHA512 a0cf8bad2909d8b339b433a8080cfed38449f4fec8579004546d612b2f03ef1712ebcd76202a616ab2fa7a529cb55d36bc84a06886c0f4572145ec0bc5b4d851
SSDEEP 384:HZcIXsNxtozbajAxzd5L+2JGhvFA8Bvt1oVOK+Y4MkXivTu6:vXxzu8ZrlJU68mkK+Y4MkXiLu6
TLSH
T1EFB25BB0DCA66CE744A4F4C5AA82E6236DB8103796C95A0CE7F8F739309F5B82717415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 62cef938c285a30a665035a03dcbdb61002479ced12a64fd5eaff1a6be9a3a72
MD5 53b306da12788680ddf1d4c4caa3e502
SHA1 87332245a24a86bc9485e367dc2390cc70fe4c10
SHA512 4a27b8754e9e910c00572335084b70821428d08e3a44103c5d8ef2a9b3db6afc30e032991d25b9b755bf6d18534aa5fecd96b29ae1022a86e4ec25bbe99afe98
SSDEEP 192:7ONU64BMQmiUyTSD5GBPKRV+FdGy5gk+2BWwHq3U6:7ONU6ecZDcd5L+2lIU6
TLSH
T10A121A356CB4AC2B5EA1B581F48737139FA8423BEAC46B50E6EC6B1C01DB69C2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

afroo.exe.crdownload

Path C:\Users\Admin\Downloads\afroo.exe.crdownload
Size 493KB
SHA256 62b8a77fa02106d960f6f98a255cae698c69c1afbfd1c5a9c679a21cf72a8ba1
MD5 1c772fa468aa29c52c15e1f839049482
SHA1 43ea2c8955da94d35e472279b14dcedfee18ce35
SHA512 ff7bb7c8e057bbabbf3a88e73bbb483f32371007428f11419797ce190ae00302c34a0dcf78e206f168bbf1964defc7f9b6f6fff30e60d05227bdbe752ce6e3e8
SSDEEP 12288:XPv4xkweoPmKGMfLjjECpArUEL9asBgLwC7PtNuZK:XX4OweoPmfMfnNpArUYgLwCRUZK
TLSH
T107B44A2DB64403B4E1A7C578CA838413FA7278490375AEF717E1DAB15F266D4AB3FA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads