discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1561594377350946916/1561595188848107540/Desktop[.]exe?ex=6ad6ec5a&is=6ad59ada&hm=cddc05f31488de886f093a324ea3732fa4de53e6a94b35e28a14c8aa36c46f65&

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1561594377350946916/1561595188848107540/Desktop.exe?ex=6ad6ec5a&is=6ad59ada&hm=cddc05f31488de886f093a324ea3732fa4de53e6a94b35e28a14c8aa36c46f65&
Sample261019-e6qpcseb26

Score

10^/10

discovery discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTU2MTUzNjkyOTQ4NzY1NDk5Mw.GPTmdC.0o7zCCIgu47SOZ71MEuZfli4S1NZ_jNHq4cpFE
server_id
1001226336838373496

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	2480	msedge.exe

Executes dropped EXE 26 IoCs

pid	Process
2864	Desktop.exe
1448	Desktop.exe
2452	Desktop.exe
3152	Desktop.exe
4120	Desktop.exe
5000	Desktop.exe
1668	Desktop.exe
1904	Desktop.exe
1596	Desktop.exe
1072	Desktop.exe
3600	Desktop.exe
2288	Desktop.exe
2508	Desktop.exe
2088	Desktop.exe
1428	Desktop.exe
2660	Desktop.exe
4248	Desktop.exe
1232	Desktop.exe
5092	Desktop.exe
1676	Desktop.exe
3740	Desktop.exe
3860	Desktop.exe
3732	Desktop.exe
3784	Desktop.exe
3244	Desktop.exe
3556	Desktop.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2480	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{63FE1D95-46F9-438B-8155-0AF15BAB866B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5744	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5744	taskmgr.exe
Token: SeSystemProfilePrivilege	5744	taskmgr.exe
Token: SeCreateGlobalPrivilege	5744	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe
5744	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2648	4368	msedge.exe	85
PID 4368 wrote to memory of 2480	4368	msedge.exe	86
PID 4368 wrote to memory of 64	4368	msedge.exe	87
PID 4368 wrote to memory of 64	4368	msedge.exe	87
PID 4368 wrote to memory of 64	4368	msedge.exe	87
PID 4368 wrote to memory of 4628	4368	msedge.exe	88
PID 4368 wrote to memory of 4628	4368	msedge.exe	88
PID 4368 wrote to memory of 4432	4368	msedge.exe	89
PID 4368 wrote to memory of 4432	4368	msedge.exe	89
PID 4368 wrote to memory of 4432	4368	msedge.exe	89
PID 4368 wrote to memory of 3940	4368	msedge.exe	90
PID 4368 wrote to memory of 3940	4368	msedge.exe	90
PID 4368 wrote to memory of 3940	4368	msedge.exe	90
PID 4368 wrote to memory of 4960	4368	msedge.exe	92
PID 4368 wrote to memory of 2132	4368	msedge.exe	91
PID 4368 wrote to memory of 4960	4368	msedge.exe	92
PID 4368 wrote to memory of 4960	4368	msedge.exe	92
PID 4368 wrote to memory of 2132	4368	msedge.exe	91
PID 4368 wrote to memory of 2132	4368	msedge.exe	91
PID 4368 wrote to memory of 3700	4368	msedge.exe	95
PID 4368 wrote to memory of 3700	4368	msedge.exe	95
PID 4368 wrote to memory of 3252	4368	msedge.exe	96
PID 4368 wrote to memory of 3252	4368	msedge.exe	96
PID 4368 wrote to memory of 4412	4368	msedge.exe	99
PID 4368 wrote to memory of 4412	4368	msedge.exe	99
PID 4368 wrote to memory of 4412	4368	msedge.exe	99
PID 4368 wrote to memory of 5080	4368	msedge.exe	98
PID 4368 wrote to memory of 5080	4368	msedge.exe	98
PID 4368 wrote to memory of 4912	4368	msedge.exe	100
PID 4368 wrote to memory of 4524	4368	msedge.exe	101
PID 4368 wrote to memory of 4524	4368	msedge.exe	101
PID 4368 wrote to memory of 2864	4368	msedge.exe	104
PID 4368 wrote to memory of 1448	4368	msedge.exe	106
PID 4368 wrote to memory of 2452	4368	msedge.exe	107
PID 4368 wrote to memory of 3152	4368	msedge.exe	108
PID 4368 wrote to memory of 4120	4368	msedge.exe	109
PID 4368 wrote to memory of 5000	4368	msedge.exe	110
PID 4368 wrote to memory of 1668	4368	msedge.exe	111
PID 4368 wrote to memory of 1904	4368	msedge.exe	113
PID 4368 wrote to memory of 1596	4368	msedge.exe	114
PID 4368 wrote to memory of 1072	4368	msedge.exe	115
PID 4368 wrote to memory of 3600	4368	msedge.exe	116
PID 4368 wrote to memory of 2508	4368	msedge.exe	118
PID 4368 wrote to memory of 2288	4368	msedge.exe	117
PID 4368 wrote to memory of 2088	4368	msedge.exe	119
PID 4368 wrote to memory of 1428	4368	msedge.exe	120
PID 4368 wrote to memory of 2660	4368	msedge.exe	121
PID 4368 wrote to memory of 4248	4368	msedge.exe	122
PID 4368 wrote to memory of 1232	4368	msedge.exe	123
PID 4368 wrote to memory of 5092	4368	msedge.exe	124
PID 4368 wrote to memory of 1676	4368	msedge.exe	125
PID 4368 wrote to memory of 3740	4368	msedge.exe	126
PID 4368 wrote to memory of 3860	4368	msedge.exe	127
PID 4368 wrote to memory of 3732	4368	msedge.exe	128
PID 4368 wrote to memory of 3784	4368	msedge.exe	129
PID 4368 wrote to memory of 3244	4368	msedge.exe	130
PID 4368 wrote to memory of 3556	4368	msedge.exe	131
PID 4368 wrote to memory of 5264	4368	msedge.exe	134
PID 4368 wrote to memory of 5312	4368	msedge.exe	144
PID 4368 wrote to memory of 5320	4368	msedge.exe	145
PID 4368 wrote to memory of 1080	4368	msedge.exe	146
PID 4368 wrote to memory of 5880	4368	msedge.exe	148
PID 4368 wrote to memory of 5880	4368	msedge.exe	148
PID 4368 wrote to memory of 900	4368	msedge.exe	149

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1561594377350946916/1561595188848107540/Desktop.exe?ex=6ad6ec5a&is=6ad59ada&hm=cddc05f31488de886f093a324ea3732fa4de53e6a94b35e28a14c8aa36c46f65&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90580c188,0x7ff90580c194,0x7ff90580c1a0
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,12734514838215642043,18167699289826646487,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7994006252057112513,14336368825276915542,262144 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,10195510099483019514,13200780725171045171,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,12237537608215166303,16928688431772548752,2097152 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,1274649222597059223,2974733667949952225,2097152 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,16098192393856605225,1751044580070415815,2097152 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,11954514466802994223,9415765110391554085,2097152 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,10051603693561544890,1910327484798417139,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,9497018869740694718,17930984472244626076,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,17159417673846271839,12034027005010137123,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5668,i,3840195266014257096,5719942009729687599,2097152 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,5407321921669492985,13875118420029801473,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,5537554858062873456,2268526381107572216,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4524
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Users\Admin\Downloads\Desktop.exe
  "C:\Users\Admin\Downloads\Desktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,9192614782672679549,6501398806010297821,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,9192614782672679549,6501398806010297821,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,6887084386431202189,4199051705761481338,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,13793833244399372361,14893397135429181455,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,11561383749326634358,13796010697905603779,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,10500727896338206170,15288135428255419360,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=276,i,7938160578491366141,17796295664916574218,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,1432397082589367690,11552480498203149008,524288 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5876,i,15536630503330790001,14953121531484582494,262144 --field-trial-handle=2240,i,8997666747861592580,14064873440999565176,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1668

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

29f14a1d-73cb-4ca3-a8c8-8c2f3dd1a056.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29f14a1d-73cb-4ca3-a8c8-8c2f3dd1a056.tmp
Size 12KB
SHA256 a3024c9678678e59c6d51b83375432a917811528c9c751497a1bd6903f1168e3
MD5 6ea1ad775f1dc7bcbd324fa3edb0e9d1
SHA1 f2f0b550e8825faf6fbf97e44505de65857fa20b
SHA512 bde1b8a754e7764108de1479d6cd1560f1f67a5c73ee6188f88403b0425dfe242f12c6c038cd6783a014916ac48d180f2fcaa3d2434eae2010a916be8eb603fb
SSDEEP 192:uc2sNg0Qz9tE1zfQmiU1usunL4zIGmUkOA+PW697iYq7U8E:CsNg0As1tknnUzIGmUkOA+PWyi55E
TLSH
T1BF425A316C78BC775DA7A544F94B3A239DB8516BE6842FD0E5EC2B1C01DF3A8130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66af4f0f-c2e4-4d53-a5c9-baa1559d625f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\66af4f0f-c2e4-4d53-a5c9-baa1559d625f.tmp
Size 8KB
SHA256 d3d20c40a177c02d0e2f95bcf66f4ce279cfa92c42a62a3e721a1cd86d6e024d
MD5 9bdc1826cc1c9569128f97786ee3703c
SHA1 f40bdbe6ec78cd5eb795a351ce0e54cae87b629d
SHA512 477d6a1bc374c10dc80198fcd350e22cce05f7b22e3a5609ee3a649008b4d0534ecc9b72219daa6beaa30fba88e1b3408f973549f626f693e86d0a3d9208e713
SSDEEP 192:aONx6IE7QmiUyuNu2TPuIGmUkOA+kC7s25U6:aONx6Dtd0UPuIGmUkOA+RsuU6
TLSH
T18002F835AC78BCBB8EB36E49F4873B239EA5112BE5856F84D9D81B1D00DB34C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78dc692d-af07-45cc-b724-5f068bee67ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\78dc692d-af07-45cc-b724-5f068bee67ae.tmp
Size 18KB
SHA256 c3cd49cbce36d7881070efaba88e6e1e62151466fc0323f2b25a998a750435ff
MD5 fae06756b0bfe01916abd40d4679371a
SHA1 8aa7a3847a4e19bca4c3ed030a8b543249fdf7db
SHA512 543d71e0f7777fb716835597ba384bd054ba6c61c5790c845bdccc5ca21da6de9cdec3b6ad60af88ffc0ac8080e9c6858cff00cbab33488fbf530a534282557a
SSDEEP 384:jQkUSvlsNgoAs1tknpUzIGmUkOA+PW1i5i4/uANEbEeUgIIly:Nl9sqOLkOAEW1i5LJCbETgLM
TLSH
T1FA827B726CB9BC6B4DA3A540F54A35279EB8902BE6841FD0E5DCAB1C00CE39C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

2c231059-37ca-4dc4-aacb-1c95117841f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c231059-37ca-4dc4-aacb-1c95117841f8.tmp
Size 9KB
SHA256 ce32eff3b2035d561a0820ce921833080fd5d05d3d6a0d772108aec2f1687729
MD5 ab84eed51eaaa5e2b0389a78f1f312cf
SHA1 baadd1e47643cc523384505c8bfd010bde020fa4
SHA512 05cd9b2e3ec237bde2c3224f2bf172181066401de03c3497895e5ffae1feec7176ff1c5ef44a14aa60728a36f0075ac036030d222d83247a5c4452d298cdb64b
SSDEEP 192:sxZwRAnf/f4s+k/EdpJHW6+WNGYapU1QIgrJ:sxZwIf/f4s+tJHbG39
TLSH
T1AC12B6526E38A93B8CCBE21DBA657F13D6F95032A1D51E58F6FC961C04E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

308d87af-3aee-4a9d-b6c8-e2e865f4e285.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\308d87af-3aee-4a9d-b6c8-e2e865f4e285.tmp
Size 10KB
SHA256 6f2e124b56961861a261cc1971b18fbb4ddeb5f369fd9e9c74f45246b1f237c1
MD5 c6ec1cba328462c290ddae6e0732065c
SHA1 436ea4f7945594a27c3da48374fec70aff787d79
SHA512 2332ccf1782b242d1306a10133d8e140a9cd974ab95164a1e3c4a94e7e39b3169cd7ae384f4cd6f3e4e320c0b3fc5a441fcf727f9836ab62043e668b4436ee45
SSDEEP 192:sxZwRAnf/f4sDk/IdpJHW6+WNGYapwv1QIg5mJ:sxZwIf/f4sDDJHbGRA
TLSH
T10222B752AE38A97B8CC7E20DBA657F53E6F9503261911E48F6FC961C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d704e6f-6f5c-4484-80fd-62011a87afd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d704e6f-6f5c-4484-80fd-62011a87afd6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

948f20a8-a22b-4e27-9794-6e4b36e17ded.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\948f20a8-a22b-4e27-9794-6e4b36e17ded.tmp
Size 9KB
SHA256 6c175d77918607d3ee71518a56f5044e83593901017f522f87326a06d89a688b
MD5 1f3b4690707c8ccf599b7e9350d4a469
SHA1 d95c43a9add4ca1adf556f095ecbf501f0d17ea0
SHA512 38c598e011cb49811b802b43d0e82ff358bdda3d1c92b59977b1f331515c971ecbe18b763fea55203f7febbe346f5c1791efc66a19b34a5952560ef3f7262135
SSDEEP 192:sxZwRAnf/f4sKk/IdpJHW6+WNGYapJ51QIg5EJ:sxZwIf/f4sKDJHbGcC
TLSH
T11522B752AE38A97B8CC7D20DBA65BF53D6F9503261D11E88F6FC961C04E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 145B
SHA256 6d5d0b3613b7baa08a63b37c378c89ecd762b6c33e386860ab6c3835feadb9e6
MD5 e74a830708182e11685c77afbc730d70
SHA1 5b251e9e85b3cb87ba66767cdba63e09828021d9
SHA512 ad8651aa55bb93f1c40e444f4e2a7c4f9e08c3789dea5494656b1396092700a662026163aa2a6e18f963e8ca570c1f5058fdc2a4e9e5cbf48f7eb86b8d0a17a0
TLSH
T1A6C02B480CC5C21BA328E94F4264970C87803F4FCBC0E58F0740CE4CB086584E3D69A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3fcab9c71cb6eff7186601cbbe1bb27e1d9231023969e14530626268ebd34dc1
MD5 2ace689d87c5660466ffeae5f86581df
SHA1 e0f95bc58e9bce0a0a8cee49f6fce7df1381abd7
SHA512 c3c416a9d6c03dbcf89e1591a2668ca228159e583a7e6422196f174982def42e80b99817e7d1b48338cd09a9fd5c817063fbdee6278ea640b91f04368a1badd2
TLSH
T125E020886BC5C21F57346797026CD34CA3C12B9AD3C0ED4D5744C54C704A15062C15D4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 85137263b2c19666a51174a36328702249c0e786b74080c75b820c95f22aaec0
MD5 86dc24886992808bf3f1b23c0e1d3709
SHA1 5a3b777c768edc1d070a8e03b48bbe39e05a7df1
SHA512 e6959f9e19d502b2de03aa81a263884b4ab31a48f6f4b7941ebc513ccdee33f877a11fc93ad5cc82693166cc764343f900d55cc85804320fd507df88dbe3378e
TLSH
T17C613FBA21B28C96FF994570DDC9124BB9BC948015DF5FD65FA6D0385C0233B5ADC04C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 52e1985fe87e8638294d5c60fb4b8a0c95c576419f72250a783f648efd7ab052
MD5 be6564403f07b80493eb4e3a75003d55
SHA1 1bbf5bbb840e0938b82235efad9d3f877286baaa
SHA512 bc950ecc891adbdf2d1968213e4cb2314ee37e148ed9712a29a6e0f95eefd1ae56855bf8b4c797feed96144ef4b50c89c3bc633711e109ea3c97eedbb467ddf4
TLSH
T18D613FBA21729C96FF994570DDC9124BB9BC948015DF5FD65FA6C0385C0233B5ADC04C
MD5 SHA1 SHA512 TLSH

Submit Download

23907505-c6f0-436d-9319-fd14433c9831.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\23907505-c6f0-436d-9319-fd14433c9831.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

30ca21d8-a67e-43ba-9fc3-b0380d90cf50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\30ca21d8-a67e-43ba-9fc3-b0380d90cf50.tmp
Size 1KB
SHA256 a5b755894ef89211bba5dcd68a8ab890c026e3f99669c0e93d27c50892b4c650
MD5 508c6aaa9959b3754f742515dd5d51ac
SHA1 410cd19e9fe2d1288f01bc60ffd019186ce53661
SHA512 e1d9f1e533b741e052daad53c4a7213b965c2a52d8da61dfcfb2fb9fd5540742f642e92b765cbc34e2283d9cd855d4303aadda18528c929aabe6beb32e696899
TLSH
T17D219AB3C3D48A6EC91116F46B146E1BCE2D090983183C1AC9D4EF6BD7E34A6E00184F
MD5 SHA1 SHA512 TLSH

Submit Download

690a4f60-571d-488b-9b9b-ea0df5108ae3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\690a4f60-571d-488b-9b9b-ea0df5108ae3.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a57866a7-515c-4415-afc8-5eb32b3e1977.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a57866a7-515c-4415-afc8-5eb32b3e1977.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ccfe5e83-f2d7-42c7-8d6f-e15c14549b4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ccfe5e83-f2d7-42c7-8d6f-e15c14549b4b.tmp
Size 27KB
SHA256 802061c6daaa43b0a6a6391b50b542da41a5fe01b103b4c52b7e499539fca439
MD5 7efa6853738ca4c381bd734723c3e3e3
SHA1 ffadbbd17ac43c0aae50aac24fba86250dae28e1
SHA512 36437e4f1ebc4a10d4b5619d5297c5b5f55bbf8ea86ad62d4e1d3ebfd4049ee5f37fe66861b88a3f6136f0551342b887c7628ab64f1272e33d5dcd78c836d37f
SSDEEP 768:6+WPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7wro4ofePmRi:6+WPcLKWvKeEeu1jaClLiF7b4oWPmRi
TLSH
T1A2C2FB3B640CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e699a8c5-d968-44ab-80f1-3f3aa9d1f913.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e699a8c5-d968-44ab-80f1-3f3aa9d1f913.tmp
Size 10KB
SHA256 44208d3163ac3b77fc66c608c01124eae8b41fe9798846df28c21bb49bf4355c
MD5 4f878e684149fa441243c368b5c49162
SHA1 f678692a3259ba456eb282271de8b0249de719a1
SHA512 3dc3eb451925e4dcb884a558fa639cb3f2c93d59f67f1a04feef52dd8f73ec695d9e90536ab3eaa4c16b68efed280d16028bec9bf8e4b1c128bb3990b0efc5f9
SSDEEP 192:sxZwRAnf/f4sDk/IdpLHW6+WNGYapUQ1QIg5mJ:sxZwIf/f4sDDLHbGqA
TLSH
T1F922B752AE38A97B8CC7E21DBA657F53E6F9503261901E48F6FC961C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 163475e5918da83bbbbee4df7f7fb12157146f95bf0d55f220b63f941c714607
MD5 8ef14f399febf64e83d11583a6aa6541
SHA1 ab44d9577a731b7bebf640d08e7fddc772b523d3
SHA512 362c42d25f1fefbe117eb6dd1793dea93cfb30558febe50f0cb75da200de2351645fcf5dd8c1bed4fdffbf4a3bd66273a435475a0c0301d51236c908d958d8ef
TLSH
T1892135C092CD50696ECA6655810FE41354B22F6A120FD8B633DD81F41F5CC954B3EEB1
MD5 SHA1 SHA512 TLSH

Submit Download

ec2f16c8-ece5-4582-8b9f-c66f1c4fbadf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ec2f16c8-ece5-4582-8b9f-c66f1c4fbadf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a28f28bb-2099-4af1-b67f-15a4a18714da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a28f28bb-2099-4af1-b67f-15a4a18714da.tmp
Size 18KB
SHA256 6c6905b351c2c74d4c230e24d665c5f67e2469c4c984e2a4efacf9f450a4b4c2
MD5 a9703dec37035c2aa26db01c99da5f15
SHA1 fe2a8744129c973a9d3b5f26e23d03fbca53df39
SHA512 33349f4cc4405f8294d352e23b1493f431e39f2e8c58054c1f5f15aa953b625efe701a70cc2971eeb78075975b6bc8761a75911499c58621b2d976b75a682b1e
SSDEEP 384:8QkUSvlsNghAs1tknpUzIGmUkOA+PW1i5i4/uANEbEeUgIIly:8lOsqOLkOAEW1i5LJCbETgLM
TLSH
T13F827C726CB9BC6B4EA36541F54B3527DEB8906BE6845BD0E5DC6B1C00CE39C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b833619a-4490-403c-ae42-7676664516a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b833619a-4490-403c-ae42-7676664516a9.tmp
Size 8KB
SHA256 3e9a184656e077b368d15967a39a0a9abc8fa7b70ea35f916cd95c9ec17e6983
MD5 8be553db2298592bd064f837c5cd79cc
SHA1 6930d953d57e5d7910775c8e95ccf3c10c73238f
SHA512 080464872601385adf764341bcf120b72f02fa1b6b86d4fcd3321b32c46aa7e9730fc9a951a8b96710ec16e6ec149ab012ad5a63cc25ec92d8a484831f845b7d
SSDEEP 192:WONB6IEDQmiUyu3u2T0uIGmUkOA+PWe27HYq7U6:WONB6D1deU0uIGmUkOA+PWnH5U6
TLSH
T1ED123A32AD78FC7B5EA36944F48739239DB54227E6886F90E5DC2A1C01EF35C230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc1aaeac-869d-441a-bbf4-88fda10e3a2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc1aaeac-869d-441a-bbf4-88fda10e3a2c.tmp
Size 21KB
SHA256 0e52bd97227ed4db13694b48592d8c28559b3bbdf6dd64dd88b941e5a9d91d44
MD5 e65b5704660a53af0286de92d88151d4
SHA1 0207954561ff5f5dfef76d6adfc5d06178a67fd1
SHA512 7cb57d7792fd66762ea5e3a99f687e6726464676481b4b8e72ac43555901bcf4600d444296a53c9a7f264c4b03062ab9a26933e22f86916df868563581288991
SSDEEP 384:YiFSQkUSvAesNg8TUNTUlIloAs1tknpUzIGmUkOA+PWKti5i4/uANEbEeUgIIly:jFKNFwgfsqOLkOAEWKti5LJCbETgLM
TLSH
T1A3A25C736CB4EC6B9EB75A40F54A3527DEB85167D980ABE0F6DC6A1C00CB29C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a534c940-1864-48a2-9111-70358415e036.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a534c940-1864-48a2-9111-70358415e036.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ec9b78d57127822c7824e4594721828157fb1a4d7ae7584f7aa1596d6be2f16f
MD5 6b86ed3dcf0001fb34ef2085b20fe302
SHA1 ef1fc324ad9ecc86e190efb69cd1c217b5921d06
SHA512 77804a385715d5be98a29af47d6a66553b441abbb604c9df4a46b56a810612d8922ab4f586bdde231252615b77fdbac86326cdea9380f7c3f4fc054e1ebdf599
TLSH
T1AD411448B6FD1148B3B37F569BFAA86E487F78672E07959D10110D4F0A72A40CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0475401f939ed81558147c7d58daa3ecbc3db13b267ed629855c28fa3e926e5
MD5 d23e136d489fbbbffdb2d7d034e5f5c3
SHA1 be5f743645e6f6372ca75fca7f278d0cccf9cf71
SHA512 8b6c92b085cfd796d06cd8f178e784d87497933e2dd17d6e22a36760322dbd832c2c78b0dc15c889d1d6519d7250533c187bb8ebb3fc719ac9cb33627cba6542
TLSH
T161412958A6FA1148B3B7AF56A7F6A56E887F7C762E06945E10110D4F0A22F00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

Client-built.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\Client-built.exe
Size 78KB
SHA256 0cf1a6c903efbd8662d7868babe88875d6055ea5478a0d7adb826bd0ac769ead
MD5 36ef341234ca44d57de307c4051d9e01
SHA1 da0303a8a07ef204b1dc52df47396f96fbc57cd1
SHA512 c3eeeb5b8aaeed2eb8d7ec53b94338151732c5b006047f1e7e1bad3bc99c1c98092081f7aae6f2a258921bd711db1283f6d40f2f60be53c62604f4b164d91bd8
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC
TLSH
T12773B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

click-me-11551060976clva7bqv6z.ico

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\click-me-11551060976clva7bqv6z.ico
Size 4KB
SHA256 68849910f57f26a618565b0718ce869f4798166ae239987069a8e2c4c0254ef9
MD5 7cde8b0ecb64087856225038b59b67c0
SHA1 0ab77b19c9ee04af5e55bfcddd2237349312f094
SHA512 b4ce760301d5148ac39f2f4f8680397a931251b72525be0e472ba1c7accbd4357e4577f5d7e27e194c508b6bd3c182adfd830cf12e365170f7c6188484f3eb83
SSDEEP 48:KK89PKj0UYhjazRZabl8KQ/gSXTJRj/SZmyB1Fe1FO6r6jg4nvAQM5a5DnIQpH+:KK8wj0j2ZaR8KQ5TJReZm81sK+w0QZ
TLSH
T186817490ACCCFDCBDA7B4EF610F6B515B429E527DA774C77B0A6228C102548B352389E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Desktop.exe

Path C:\Users\Admin\Downloads\Desktop.exe
Size 469KB
SHA256 375cb965da1e215c86b1a829402bc85d3a53898645084c7a10407c0a6a85894d
MD5 556b5cc4d636e293d35a6966e80e79e0
SHA1 b8d7c975faad0db63c39ee9c62761d90409c4ea8
SHA512 d1a5967c08499a26cd386393458cd6d8a44404631166e4002b6745b6f8b54296fbb31659a243aa9272b5b68c4aa691b8715289dbd1a8378c271b109b30af3fbc
SSDEEP 12288:ibkHM86prjN2Q69jxxIV4sMy9TK98SDIYfJxTsl:iQnwjQQAj4pMy9TKxIYBxwl
TLSH
T1F4A49F19E7E404FDE0B7E578CD934906E776B84A0771E6CF03A499A51F232909E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e175924d-f7c6-4989-9c89-8988620b02d3.tmp

Path C:\Users\Admin\Downloads\e175924d-f7c6-4989-9c89-8988620b02d3.tmp
Size 13KB
SHA256 58ae47270d67f0f2f65ff23f53a034f3b5718e7d0bb375cb10222794301c453b
MD5 d2b4c66e3963579992241dafac389089
SHA1 d16e1bb3ab8088b6e7c6db5f17f381a178923f6e
SHA512 7b83431a9fd075c1da6b7edcf71d0ca6714e5f33f8fe340ce4b10b3028e9cf10b2ea25fb6d780cf78ca1100fee0289830c1671a93aae23753467b25e9ee62c7e
SSDEEP 384:RjVetTMKmg1qqnBpnUXeRWZKqob83n+wgF1qmT9F:BQtTh1xBparowX+vnDj
TLSH
T1D352391ED72855BCC0BBB1F5CA82584BE3B2780D2370BE8F4364A7A65E37620945E353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5744-239-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-237-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-238-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-233-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-228-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-229-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-227-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-236-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-235-0x0000015340640000-0x0000015340641000-memory.dmp

Download

memory/5744-234-0x0000015340640000-0x0000015340641000-memory.dmp

Download