hxxps://cdn[.]discordapp[.]com/attachments/1529011939529719939/1568770390627721351/Moin[.]exe?ex=6af106c7&is=6aefb547&hm=584a5e67c273320205c43e7d6c06966d84123ee788cd2d42b3a212e144f0a0bd&

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1529011939529719939/1568770390627721351/Moin.exe?ex=6af106c7&is=6aefb547&hm=584a5e67c273320205c43e7d6c06966d84123ee788cd2d42b3a212e144f0a0bd&
Sample261107-3kl12sf191

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	3220	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
3292	Moin.exe
3872	Moin.exe

Loads dropped DLL 6 IoCs

pid	Process
3292	Moin.exe
3292	Moin.exe
3292	Moin.exe
3872	Moin.exe
3872	Moin.exe
3872	Moin.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
80	discord.com
81	discord.com
83	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3220	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{303C2234-BEF7-453D-BD1C-3AC69960E541}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{19872985-D964-4A38-BDA3-851E40A866D7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	Moin.exe
Token: SeDebugPrivilege	3872	Moin.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
3872	Moin.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4808	2004	msedge.exe	85
PID 2004 wrote to memory of 3220	2004	msedge.exe	86
PID 2004 wrote to memory of 2120	2004	msedge.exe	87
PID 2004 wrote to memory of 2748	2004	msedge.exe	88
PID 2004 wrote to memory of 2120	2004	msedge.exe	87
PID 2004 wrote to memory of 2120	2004	msedge.exe	87
PID 2004 wrote to memory of 2748	2004	msedge.exe	88
PID 2004 wrote to memory of 1972	2004	msedge.exe	89
PID 2004 wrote to memory of 3452	2004	msedge.exe	90
PID 2004 wrote to memory of 1972	2004	msedge.exe	89
PID 2004 wrote to memory of 1972	2004	msedge.exe	89
PID 2004 wrote to memory of 3452	2004	msedge.exe	90
PID 2004 wrote to memory of 3452	2004	msedge.exe	90
PID 2004 wrote to memory of 4388	2004	msedge.exe	92
PID 2004 wrote to memory of 4388	2004	msedge.exe	92
PID 2004 wrote to memory of 4388	2004	msedge.exe	92
PID 2004 wrote to memory of 1228	2004	msedge.exe	93
PID 2004 wrote to memory of 1228	2004	msedge.exe	93
PID 2004 wrote to memory of 1228	2004	msedge.exe	93
PID 2004 wrote to memory of 3832	2004	msedge.exe	96
PID 2004 wrote to memory of 3832	2004	msedge.exe	96
PID 2004 wrote to memory of 3788	2004	msedge.exe	97
PID 2004 wrote to memory of 3788	2004	msedge.exe	97
PID 2004 wrote to memory of 4008	2004	msedge.exe	98
PID 2004 wrote to memory of 4008	2004	msedge.exe	98
PID 2004 wrote to memory of 3112	2004	msedge.exe	99
PID 2004 wrote to memory of 3112	2004	msedge.exe	99
PID 2004 wrote to memory of 3112	2004	msedge.exe	99
PID 2004 wrote to memory of 404	2004	msedge.exe	102
PID 2004 wrote to memory of 3936	2004	msedge.exe	103
PID 2004 wrote to memory of 3780	2004	msedge.exe	112
PID 2004 wrote to memory of 2116	2004	msedge.exe	113
PID 2004 wrote to memory of 1968	2004	msedge.exe	114
PID 2004 wrote to memory of 3292	2004	msedge.exe	115
PID 3872 wrote to memory of 2740	3872	Moin.exe	120
PID 2004 wrote to memory of 4188	2004	msedge.exe	121
PID 2004 wrote to memory of 4188	2004	msedge.exe	121
PID 2004 wrote to memory of 4188	2004	msedge.exe	121
PID 2004 wrote to memory of 3536	2004	msedge.exe	122
PID 2004 wrote to memory of 3536	2004	msedge.exe	122
PID 2004 wrote to memory of 3536	2004	msedge.exe	122
PID 2004 wrote to memory of 2936	2004	msedge.exe	123
PID 2004 wrote to memory of 2456	2004	msedge.exe	124
PID 2004 wrote to memory of 2456	2004	msedge.exe	124
PID 2004 wrote to memory of 5464	2004	msedge.exe	125
PID 2004 wrote to memory of 5464	2004	msedge.exe	125
PID 2004 wrote to memory of 5592	2004	msedge.exe	126
PID 2004 wrote to memory of 5592	2004	msedge.exe	126
PID 2004 wrote to memory of 5888	2004	msedge.exe	127
PID 2004 wrote to memory of 5888	2004	msedge.exe	127
PID 2004 wrote to memory of 5968	2004	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1529011939529719939/1568770390627721351/Moin.exe?ex=6af106c7&is=6aefb547&hm=584a5e67c273320205c43e7d6c06966d84123ee788cd2d42b3a212e144f0a0bd&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffd3aeec188,0x7ffd3aeec194,0x7ffd3aeec1a0
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,17952634165994198134,13046536489971051699,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13200515865957933945,8769872318929814208,262144 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,7881627575883985780,15586527463376126729,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,17345169445552673801,13821587919080836462,2097152 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,4477851384945677666,18360381617531293379,2097152 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,8286461436666660970,4961216164129673526,2097152 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,962420609103267753,9692820142758206255,2097152 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,10405718299804089252,4502115618435388980,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,7987731227522788369,4762024795018450320,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,3234857260687027731,16190598210621350848,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,3679422202731885382,10657197685479823932,2097152 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,17425295438955009509,6995974371815391350,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,17425295438955009509,6995974371815391350,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,17019314433579234593,5187685063500764074,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,8390715267284243314,12462279381615908170,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,1414064265285307615,4129295540612034785,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,5546457983413832377,15720578917716265874,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:1968
- C:\Users\Admin\Downloads\Moin.exe
  "C:\Users\Admin\Downloads\Moin.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5648,i,10384356141329121017,310837421856623896,2097152 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4284,i,7981072491396939337,11957515160380871037,2097152 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,7999317737494505185,18274350261151001350,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,14103087852449329152,5281027644561782350,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,4643722623105160346,4564590138726370939,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2809405856017300066,11896389648652341030,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,15031568897665701875,17509284025702574537,524288 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6748,i,16286358619312444408,4178657700491765582,262144 --field-trial-handle=2312,i,18283985957346862288,11987500630889535164,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3984

C:\Users\Admin\Downloads\Moin.exe
"C:\Users\Admin\Downloads\Moin.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/A5RCBkWhnW
  2⤵
  PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2d3910db-bc37-4c2a-b90d-835aaac0f0ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d3910db-bc37-4c2a-b90d-835aaac0f0ca.tmp
Size 8KB
SHA256 ce22ac9a565b9d32a8969cc115abd7b3b298de4450d7c9aac2f1f106d24c33ad
MD5 b99c0e900f42c8a78b136b3a066d1c44
SHA1 eb5266f5801407eba932a720254c79d8d924d7fc
SHA512 dbd37f0754399a46f20c4cd1efa99d41c17c48baf7d4c732e0616da361418c7a78c27a6d5ded0e90c4ec6eaa084fbac03513c43667e50a7376fd0f177562221c
SSDEEP 192:1ONs6wlDgQmiUyNkW4X58gZxjzorQoWDlY/QU6:1ONs6kglW4X58EN8jeVU6
TLSH
T18A02F935B978BC7B9EF2AD49F48A26139FA5102BE6552F40D6FC1A1C00D765C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

845bc903-9c65-4c6c-bb8b-fa7550fc5d98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\845bc903-9c65-4c6c-bb8b-fa7550fc5d98.tmp
Size 18KB
SHA256 bd5f9ccf850f6550c19ddf547fff5ada2a048d24d4b187a7605c4b93a7bdb65e
MD5 5cb8bc122c013eaee1793c3fc412dfb6
SHA1 00eda8af5518f533520f0c51abbc90c88b369b7d
SHA512 84bf8c47342f4541f426185fbf791f7f44c5b729a9c41de6eb53c87df4320fe7079bdcfc0a6f5bccd4dd5c0d67896dc90c6c0392cea6237fac6ab634bd6605c3
SSDEEP 384:EQkUSvPsNQgGhZgiIHX58EN8j2X9LAtH7vBEXIIlX:0Pnxmap2ZAtH75EXLF
TLSH
T1C7827C32A468AD3B5AE3A544F24A3643EFB4C05BDAC91F90D6EC5B1C01CA29C235BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

879f0c24-e69f-4d6e-ba7b-04e61754323f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\879f0c24-e69f-4d6e-ba7b-04e61754323f.tmp
Size 18KB
SHA256 36e9a92573382212b349d6a47cbe1e7c5cc33b834ab23fd2d337714cddace194
MD5 9283925210cfafb4e745a0bdf3e1dcf1
SHA1 bfbafb208a56735c0914e8f33fa7f8c975452350
SHA512 4e2f0f7a8c33976eeb749d85ed69a1874296736433c0537777ac6fe31bf215e7d91b5354b14a0c00205094102c090bf8ff78c3b95656fd584760f7d9feee86ec
SSDEEP 384:xQkUSv0sNQpGhZkiIHX58EN8j2X9LAtH7vBEXIIlX:j0ytmap2ZAtH75EXLF
TLSH
T196827E32A46CAD3B5AF3A544F24E3643EFB4C01BDAC91B90D6EC5B1C01CA19C235BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f36466b-14a4-4e12-8bfa-3a2d32cdc676.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8f36466b-14a4-4e12-8bfa-3a2d32cdc676.tmp
Size 105KB
SHA256 42c3507647b7d5fd8b7eb42a73a5223ac6678df500cdf9a4255fcee2b4fbc3ab
MD5 4efc5ed92763ff88af9bc3b1b0f13ff0
SHA1 477fac9d96670fdc5126c3e6d75ade0b495e86e0
SHA512 d8a10c0af06f07a5ba37a06c3962115433650f3feae6211425afbccb8efe8bd9469cac63f761eeb455be3eacb7d2dbb3c036cf0d9d19c450a50fd67066cbc397
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T171B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

3defcb1e-b451-4c7f-95e3-342943bab2b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3defcb1e-b451-4c7f-95e3-342943bab2b9.tmp
Size 9KB
SHA256 8bf06e5e85661e7d2ce3b4f7406ebc98620b18d4795f76d3456252d2dd5087d8
MD5 f97f5ef5b314fb849db7d09f8a637634
SHA1 4464cac8a4f2e2045ae4d9c690e17ab424ef9f3f
SHA512 0ccd25f4df70db85b28528ecdc57c4f0184d96df3081b0f289ebbde7b57a800e1df7728b8e7f2ebfcda5e882a90fc00781933ee15ab58590504943b9f20f58ec
SSDEEP 192:sxZLeRjnue/fGsj4IdpJHW6+WNGYr1ywJIg5hJ:sxZLeBh/fGsjJJHbGCh
TLSH
T1F022C8526E38B53B9CC7D20DFB19BF53D6F95032A1941E88A6FC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e5cd67c-d091-4689-aedf-d43f78cb3cda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e5cd67c-d091-4689-aedf-d43f78cb3cda.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

958f26fc-42e5-4608-af3d-bba79b9b8d85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\958f26fc-42e5-4608-af3d-bba79b9b8d85.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a5216e6c7d57034a706240fe54198993956806deffc4547d4effb3d8e4b09828
MD5 03f5899b48b0c04eeb0cc2fce583e1e3
SHA1 5eab23c8c0bf1dddd5c4430402a3cb34b7b17ca5
SHA512 21119d0661b6e9f7ac309143e81fb7f3eb21035fd9756ed3874e68c0dbde810f6f727c692c11d906b2d6935d08b57a30c7147e1a17bc7335b79abb3a2cb107cc
TLSH
T185E026D414DEC32EF36A798B12E8870C82E1366FD3D4E94E1748C48976070C4E2E66B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 106a8d89a992bed72d3afe94ebf3760743c10469389f3477073e8bd248915bad
MD5 5da0196523065068fedaf250438efb55
SHA1 812520abf095e477c18812fd14dcb49ea2a33420
SHA512 d9f2b5f80a40b1f49d4b888de20948d9f713e665f00e43f67dfcf6353445b51c354647f8191fff6e76b7b73b3687daed14f3929ff2808f4cb209d1d060ebeb42
TLSH
T10DE020D844DFC33DF15DB8471199534CD2C23A2FA3C4A90F2704C889710348062D5575
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 7b01cdba0b9e9d61addb96c425095dfd0542424f02cf996af6fa587d61ae8150
MD5 2b5d79071bd7130fa6b8d0b794582ca6
SHA1 f63c5617754c122cb7bc0896169bac632f46aa03
SHA512 7be9d856918127c9d41a939562af3104a845143a92a4333b8ee695e903e2590107959429a70963eeaddc323ea7c859f10f6c83ca975cd30525e4ff42828453cd
TLSH
T10351B7F26B60EFECFBD878718FE712833AF849815DC35E5A2990D8BB580A744811C043
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 2c2891016d3feb29f7220e67a884bf1c9892fd0ca6cd72f8ef96592fe36221eb
MD5 54dd9a41aed3a8e26214b598c176d4ad
SHA1 a272399893b6172972b7d2f402d75244e503aa80
SHA512 d509b26f33ae3649bcb30b3485b38ecde09ff50ec26ceb1ded73f361c318d4a3e26f63c2bbf871c28dfe3ff15497da8635625341b9080ce915fc02fb029e79d6
SSDEEP 96:tWrXKOJEJQPi3VZ6Ewb9rT/qTVKKK/NLoAhRgHXAqgBTRtCkWSpY7S4C3xOZfq:9OfqF9wb5+TQKKOwqQTCOYSm5q
TLSH
T1AC125DB2163CAEDCFBA8EBB58EE5354635B88C119AFBCF015540D7BE390674A5F09042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf770071-d02c-4e90-93bb-aaf57a4897bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cf770071-d02c-4e90-93bb-aaf57a4897bb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0ab379b4-7bc7-46f5-8eb9-776c4886e1f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ab379b4-7bc7-46f5-8eb9-776c4886e1f1.tmp
Size 2KB
SHA256 b7999d595f2b3bbf36dca905f9f3787768258189b46a69d9582371e750846758
MD5 33ac9bc651122f82db60630d9de0b0ad
SHA1 6cef5d29100628851266d36be5f0d2080d9ee1f2
SHA512 c20322ad086def1de9c37ce3f721419cec6a6090563437dd8e23c51ec0debc6f7261e0eaa8dbf8169a32f9a74bb0ffe1a1666519cbbca4f64cf440915837208c
TLSH
T1535178F387D9862DC91616F46B147E1ECE2C0918431C3C2EC8D5AE5BA7E3162F181A4B
MD5 SHA1 SHA512 TLSH

Submit Download

5bdf5165-5e71-4f0b-928b-c17694fec73c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5bdf5165-5e71-4f0b-928b-c17694fec73c.tmp
Size 2KB
SHA256 a6fee0b467bfe37877c2d91fec82d43d1b6a12f356b55b906f27f6a8fe8cecf6
MD5 0875e15cd1b332b0ed6fcfa31c8feb17
SHA1 8001dbcb264f4ae0ee26991b778b850597a0c9ec
SHA512 8f1c39f48d0fb89379bf68726e78f6bce5dc6324b7837271cc51df5fdc211dd79f393fcf7105252c68dd123fbfeb1ef2a697bf51f844d801fa311e17bd581221
TLSH
T18F4188F387E58A2EC91516F46B14BE1ECE2C0915431C3C2EC8D5AE5BA7E3162F181A4F
MD5 SHA1 SHA512 TLSH

Submit Download

77e9e600-c7c7-431d-8987-183d8289bbe7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\77e9e600-c7c7-431d-8987-183d8289bbe7.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

79b0a4cc-1e62-41eb-a599-c30379d9816e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\79b0a4cc-1e62-41eb-a599-c30379d9816e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6bd8fb4a41841fc73d0f6ac0791392f97acfeb28705715cfa2c3ebe84c4f456d
MD5 9bd148f0d03afda3da9db35c3593435f
SHA1 4b193f25dae9dc12a00a888b77d718800f9e570e
SHA512 e64d31e540a1161e0972076b0135ae062d534bfd9527a0598b3f728c23d5737f234cec85d0c22204799af25a4ed6a75af6b6ecca5def1e6f56572ac3c788e5f1
SSDEEP 768:q7y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbhroR1r:q7y4J/DWvbtBhu1jajiLm0bavr
TLSH
T157C20A3B644CCA7E4FC00A9DED5E6FD77E9802C79A948D4047FA994C02C77EA91264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 cbbbd3e2cfcd5b2c878eb420203420aeacfaa0f8f24dbaffbd8bb2f5038020bf
MD5 9c1ec207a327862d2248442cd72a8332
SHA1 f4f0bfed8f97602b0fb1a6448f78b8eeda0a92ab
SHA512 821836f64481f5c552f05c6fc7ea3b99e417942ef63ed5b6fa6c006c3b6ca74aece70c6ac8e0ed8a03bb585457dd4aefea62903bcb7d6b5ebd242fab909486a3
TLSH
T143C08C77B0881188D75D0341823250998B402CCC0985908CE11634181038A232203FD1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 7d43b473eb446706135f5ddcf7508b7d71e3e9d2a85714f86592026e202252ff
MD5 8332d57c2df041bd49872d02f85f7a97
SHA1 df2bdf361d9c3c5bcd9d9283366d2eef4ad33356
SHA512 cb28a3ed47d43205fd9059b93cbed4246aee8268515a005eeec220fde5999396d2bd21a6da6def90c60dcc1419b46e2e0a0493a8e13b7aba0596cfcd8a327103
TLSH
T100D0A7FBB49961C4EAEA4B8296A211AA46507C8C1459709CE912051A09586529213F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 ce99850225d2a33805873e402d10c44e91ec11c2650101ae1d0af23b48ee8e7d
MD5 4ea0b35c0dbd7a2ace3eb6f5498f6545
SHA1 bd7b5c5c0d6df07fd1352511a193121e8afd5f26
SHA512 cca5b31f4df62cfeea729496fc7ed502200c2d08d003cd332310fc986bbe9ff84fbed38071ded61730eced76f0a39b37eb91748cbd7abafa0edbd157066621f1
TLSH
T1A1D0A7FBB4AA20C4EFA60782966211EA46607C8C1449709CD913361E0978752D313F96
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 16a06d0caf2cc6cc835806c776a94508150e4f6677b98c31376d27b36d993863
MD5 1e28aa6e0e0c4422fb7952c561ac7606
SHA1 7b823aef88940f0a382533684e132b985ba69a37
SHA512 bf38f4728433105fe3bd1eed59fbbd0375fcd1d19f428de3f85ba7e9f761bd541cbac38bcea8650edfaff2c7c509fa95424f52836ab64904b9ddd19581227da3
SSDEEP 48:KIDI1Ks04jyLCNQ8CgARbcrMISURK9Y1iRxaBYDUAyyLitwciAgxb8LsIS0xK94k:KIDCKs0+mZCKSQq2Z6KiIl
TLSH
T11A91CD5570BF220138BD254891758B1A124636B7716CE62E7FBC80964A6FF086FFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3ba0b6b-7883-481b-b68e-09523ec3292f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3ba0b6b-7883-481b-b68e-09523ec3292f.tmp
Size 10KB
SHA256 484626f5d2215d0023aa3a39b632a1368d845db0ff3e43b4e386452a802da29b
MD5 d0e262d5a127522c9151d5296f202264
SHA1 f758e4bfa06a3bc4645c1cb750f4e3ee54fa3106
SHA512 3fab2f53e592084380d2af8fd49e3763c6e2107dbbaab401296e1d2483a8f5af4caf45fd216a72aa90c91e4f0f10e1108938e0a4be1e353da743370fd502ad9e
SSDEEP 192:sxZLeRjnue/fGsO4IdpJHW6+WNGYrMWwJIg5bJ:sxZLeBh/fGsOJJHbG7H
TLSH
T18F22CA526E38B53B9CC7D20DBB197F53E6F95032A1951E88A6FC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c749219e-d0b7-4495-9c4e-af908a13fbb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c749219e-d0b7-4495-9c4e-af908a13fbb4.tmp
Size 10KB
SHA256 a74b233b8fc41980e667279dff8f90c213284c7e44a4ee09c6c0f2a89ab873ac
MD5 b8ef2650066ef4ac30cb2af784ea48c0
SHA1 0ddeaa51126567a247f24460d5301bda07738173
SHA512 08f8ec46cc1b743112feb814764d15e787d21006d0044aa22b971ce883d09e3ad6fe51f3f4991abd66c43d3cc5e9c4cbf567f1e4c3e18b65e0646a8bd504aa4a
SSDEEP 192:sxZLeRjnue/fGsOhIdp+LHW6+WNzw//YrhNwJIg5bJ:sxZLeBh/fGsOKwHb0/FH
TLSH
T10632B9526E38697B9CC7D20DBB197F13E6F9503291951F84A6FC861C05E6BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe8aa79f-6a9d-473c-8514-c74441509565.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe8aa79f-6a9d-473c-8514-c74441509565.tmp
Size 9KB
SHA256 381c1f3d5dc812963120a42624853ab8c9ca8fadc89af716d08ac19f5be95d94
MD5 00e87e88f068191fa3a73a6066a90c3f
SHA1 183651b7c0264df5d6d6e50ed2e99f5d98c9e70e
SHA512 b93224095d1cd3421792ae3cde1b56e27ae42bd032e2f09db9d8c83aa255d53103739665d27872a2cf7a3ac447565a8d0aef58bf835afeba51c4c81e4911a35b
SSDEEP 192:sxZLeRjnue/fGs84IdpJHW6+WNGYr1ywJIgrJ:sxZLeBh/fGs8JJHbGC9
TLSH
T1E622A8526E38B53B9CC7D20DBB197F53D5F95032A1951E98A6FC861C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f1dee838-2bca-4493-b978-8ca421bf6bf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f1dee838-2bca-4493-b978-8ca421bf6bf3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad8af2ca-5640-4fee-99a7-015deaf14aa9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ad8af2ca-5640-4fee-99a7-015deaf14aa9.tmp
Size 21KB
SHA256 b037e87d4bbf59a7520b6bc46e9ecb61e6fd4db5a1768f4c07d870cbe59ca393
MD5 568496fde6753b7e3ba983485c62f500
SHA1 f61ab46675e3a471af1be74b715d552b770cf9b1
SHA512 c6018d1a3da34d748404b278fa3179ff483cbdfcb3b424096ba30f783340b141dedb02addba392b2f0640ac3a567947485c49cfef042de2821ac1354242060ad
SSDEEP 384:QiFgQkUSvKAsNQ8TUNTUlIlgGhZ3hZ2HX58EN8j2X9LwtH7vBEXIIlX:rFIBxwglLZQap2ZwtH75EXLF
TLSH
T19FA25B3398989D3FAEF39A44F64D3243DEB48067DA996B90E7DC5A1C018B1DC134BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e91f191f-8c79-439f-87b5-00aea1288e2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e91f191f-8c79-439f-87b5-00aea1288e2f.tmp
Size 8KB
SHA256 d3f81f667253c63d7e34074e4b55fdcf71fb2eeb7129f3b15f54ce001f63df8b
MD5 b96d2ee31ba59677732e4bfa9a4912bf
SHA1 6f72bc3a3835f2cfabf2af788df1d74904b5ed87
SHA512 6e38e0bf6c6181cad0a831d34a920ce9122a4783be0a70c1631f93d3b39b94b545e39beaf76d20595d989b7e000b492fecd44c43bc6cc0084ecc7baac62de456
SSDEEP 192:dONZ6wlDjQmiUy/k44X58gZxjzorQo2X/FIEvve8qDU6:dONZ6kVd44X58EN8j2X9LOtU6
TLSH
T15A121832B47CAC3B5DE2A585B58A35039FA5411BEB496F80D6FC2B1C01EF2AC135AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1357cbf9-f491-420d-9145-e6fdc8054592.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1357cbf9-f491-420d-9145-e6fdc8054592.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 863abbc9048d3ef273704d8b5d4e991c7205abcc3d00a3029013e2f54ef0eb32
MD5 9913ab9e0444d76665649b3bb37b83f1
SHA1 4c7525e0126828bf170e312f306d4d0a544d17a6
SHA512 ab3c0821fc6481f1d5a4d6f203642a88267c9099277e7cbb7bb8d5127e0446f1a6d590478c3dc1853371c995add2059625241c970e3ff5fb252e689725cc3a7f
TLSH
T156412958A6FD1148B3B36E56ABF6A86D487BB8372E06D45D00110E4F0A73B40CDA2777
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Moin\o1sNDo4k6Ivtdv_ecY7UjdtO0BsTSp4=\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Moin\o1sNDo4k6Ivtdv_ecY7UjdtO0BsTSp4=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 67629b6aaee39328d02b11e5d85a53b35aa6cea71d4d37a671295a76c02b240e
MD5 38f9831155956106c61b9885d6113444
SHA1 8cbc1aaf60edfd4155bb4f10fdb5257d7c4b84f8
SHA512 e1e3859d83ee49bfdd0ea5b929772426d529e417c7d6d6bbdf251cc3d5ae5a2eaf055d0be62598231a444a5e54a1b0cea5eb60d4140d5e9739210c3b0d667b18
SSDEEP 24576:/hNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa5:/xKcdPHmMLYpX7T35/fPoGPpGFjztQcR
TLSH
T1FC453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Moin\o1sNDo4k6Ivtdv_ecY7UjdtO0BsTSp4=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 1c1c5d5ae7530615585b77a8b15588ed51ea66da9a75fceeea7f772970edc01f
MD5 f344857a45f59103361fd5a5edbdb670
SHA1 34ce32a1182377e612673add6d2644b9bd723d94
SHA512 553baf174e8d0b5e8ef4d837a4c16a974b1b52693c3920baa4edc6177a4fc1a05a27923f78d8c3d84f4b7dcfe86b8f50a4ab942045f8afa6087b122b07e64898
SSDEEP 24576:Dek+C9iX4izlWkFLgcUxwdHaKzhWjl9sIovgbAvJh5A2RwK2Ebie2K9dUghF0+J:4PoKlWkF3CwpaPl1oYbA35A252EbNDxJ
TLSH
T15495494AB6EC40E9C47AD23CDADB461BF63174152761A7CF23A0479D6F27BD00A7A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d22bc2c2-0dbf-447c-a3a0-7246595cc2c9.tmp

Path C:\Users\Admin\Downloads\d22bc2c2-0dbf-447c-a3a0-7246595cc2c9.tmp
Size 18KB
SHA256 6f71b09944ed841460b8669c65453f1ebde05886acc5117b10a7106aa7a5b383
MD5 8a920b414270d3c606a958fdbf27ae3e
SHA1 e4d3a6cc666ad1c07f8d0ac2f5ece1f593f06db0
SHA512 184754107510168ccd60891cc59f9c2fa46a588f10667fd8f5455f50414a1979992cad6a28b2bf0ad618c9c6c182a53b74ec50d52cb4be434e1880d150586c66
SSDEEP 384:uNa1h9Sw8QYQHnd9Z3521XP9dKo5L6mN07JmkHo4e6+MjmzBSh3x/VnlN:NNrHnrZ35gKoB6xFlo8+7zBSzd7
TLSH
T1A482294F53F560E9D8B5D2398722911BD7B0F02C1BA56AE74568A1142F32EF067FD2A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3292-296-0x00000294FE2B0000-0x00000294FE300000-memory.dmp

Download

memory/3292-368-0x0000029500B40000-0x0000029500CA0000-memory.dmp

Download

memory/3292-304-0x00000294FE330000-0x00000294FE360000-memory.dmp

Download

memory/3292-301-0x00000294FEE20000-0x00000294FF5C0000-memory.dmp

Download

memory/3292-320-0x00000294FE4F0000-0x00000294FE510000-memory.dmp

Download

memory/3292-332-0x00000294FF6D0000-0x00000294FF6F0000-memory.dmp

Download

memory/3292-328-0x00000294FF680000-0x00000294FF6D0000-memory.dmp

Download

memory/3292-324-0x00000254662F0000-0x0000025466300000-memory.dmp

Download

memory/3292-317-0x00000294FF5C0000-0x00000294FF680000-memory.dmp

Download

memory/3292-312-0x00000294FE4C0000-0x00000294FE4F0000-memory.dmp

Download

memory/3292-308-0x00000294FE430000-0x00000294FE4C0000-memory.dmp

Download

memory/3292-336-0x00000294FFF60000-0x00000294FFFB0000-memory.dmp

Download

memory/3292-240-0x00000254644A0000-0x00000254644E0000-memory.dmp

Download

memory/3292-348-0x00000295000B0000-0x00000295000C0000-memory.dmp

Download

memory/3292-344-0x00000294FFB60000-0x00000294FFBA0000-memory.dmp

Download

memory/3292-248-0x00000254644E0000-0x0000025464560000-memory.dmp

Download

memory/3292-340-0x0000029500010000-0x0000029500070000-memory.dmp

Download

memory/3292-360-0x00000295006C0000-0x0000029500730000-memory.dmp

Download

memory/3292-364-0x00000254619A0000-0x00000254619B0000-memory.dmp

Download

memory/3292-292-0x00000294FE1A0000-0x00000294FE2B0000-memory.dmp

Download

memory/3292-372-0x0000029500770000-0x0000029500780000-memory.dmp

Download

memory/3292-280-0x0000025466190000-0x00000254661C0000-memory.dmp

Download

memory/3292-284-0x0000025466140000-0x0000025466160000-memory.dmp

Download

memory/3292-256-0x00000254622F0000-0x0000025462300000-memory.dmp

Download

memory/3292-220-0x0000025462FA0000-0x0000025463C30000-memory.dmp

Download

memory/3292-260-0x0000025464580000-0x00000254645A0000-memory.dmp

Download

memory/3292-268-0x00000254648C0000-0x00000254648E0000-memory.dmp

Download

memory/3292-272-0x00000254648E0000-0x0000025464920000-memory.dmp

Download

memory/3292-276-0x0000025464920000-0x0000025464940000-memory.dmp

Download

memory/3292-264-0x0000025464850000-0x0000025464870000-memory.dmp

Download

memory/3292-244-0x00000294FBE50000-0x00000294FC680000-memory.dmp

Download

memory/3292-252-0x0000025461D50000-0x0000025461D70000-memory.dmp

Download

memory/3292-236-0x0000025461B20000-0x0000025461B70000-memory.dmp

Download

memory/3292-232-0x0000025461BA0000-0x0000025461D00000-memory.dmp

Download

memory/3292-228-0x0000025464270000-0x00000254644A0000-memory.dmp

Download

memory/3292-224-0x00000294FAEF0000-0x00000294FBE50000-memory.dmp

Download

memory/3872-554-0x00000253B3040000-0x00000253B3050000-memory.dmp

Download