b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
898s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (10).bat
Size 44B
Sample260627-rf3mfsa191
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270429621669316"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{C8F09E4F-FE1E-480E-BC0D-752362719371}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4508	4436	cmd.exe	87
PID 4508 wrote to memory of 4228	4508	msedge.exe	89
PID 4228 wrote to memory of 4092	4228	msedge.exe	90
PID 4228 wrote to memory of 1432	4228	msedge.exe	91
PID 4228 wrote to memory of 1976	4228	msedge.exe	92
PID 4228 wrote to memory of 1976	4228	msedge.exe	92
PID 4228 wrote to memory of 1976	4228	msedge.exe	92
PID 4228 wrote to memory of 1148	4228	msedge.exe	93
PID 4228 wrote to memory of 1148	4228	msedge.exe	93
PID 4228 wrote to memory of 3752	4228	msedge.exe	95
PID 4228 wrote to memory of 3752	4228	msedge.exe	95
PID 4228 wrote to memory of 3752	4228	msedge.exe	95
PID 4228 wrote to memory of 4596	4228	msedge.exe	96
PID 4228 wrote to memory of 4596	4228	msedge.exe	96
PID 4228 wrote to memory of 4596	4228	msedge.exe	96
PID 4228 wrote to memory of 2536	4228	msedge.exe	97
PID 4228 wrote to memory of 2536	4228	msedge.exe	97
PID 4228 wrote to memory of 2536	4228	msedge.exe	97
PID 4228 wrote to memory of 2636	4228	msedge.exe	98
PID 4228 wrote to memory of 2636	4228	msedge.exe	98
PID 4228 wrote to memory of 2636	4228	msedge.exe	98
PID 4228 wrote to memory of 672	4228	msedge.exe	99
PID 4228 wrote to memory of 672	4228	msedge.exe	99
PID 4228 wrote to memory of 3100	4228	msedge.exe	100
PID 4228 wrote to memory of 3100	4228	msedge.exe	100
PID 4228 wrote to memory of 4644	4228	msedge.exe	103
PID 4228 wrote to memory of 4644	4228	msedge.exe	103
PID 4228 wrote to memory of 4644	4228	msedge.exe	103
PID 4228 wrote to memory of 1440	4228	msedge.exe	106
PID 4228 wrote to memory of 1440	4228	msedge.exe	106
PID 4228 wrote to memory of 976	4228	msedge.exe	107
PID 4228 wrote to memory of 976	4228	msedge.exe	107
PID 4228 wrote to memory of 3668	4228	msedge.exe	110
PID 4228 wrote to memory of 1664	4228	msedge.exe	111
PID 4228 wrote to memory of 1664	4228	msedge.exe	111
PID 4228 wrote to memory of 4384	4228	msedge.exe	112
PID 4228 wrote to memory of 4384	4228	msedge.exe	112
PID 4228 wrote to memory of 4568	4228	msedge.exe	113
PID 4228 wrote to memory of 4568	4228	msedge.exe	113
PID 4228 wrote to memory of 4608	4228	msedge.exe	114
PID 4228 wrote to memory of 4608	4228	msedge.exe	114
PID 4228 wrote to memory of 4136	4228	msedge.exe	116
PID 4228 wrote to memory of 4136	4228	msedge.exe	116
PID 4228 wrote to memory of 5668	4228	msedge.exe	121
PID 4228 wrote to memory of 5676	4228	msedge.exe	122
PID 4228 wrote to memory of 5684	4228	msedge.exe	123
PID 4228 wrote to memory of 6136	4228	msedge.exe	125
PID 4228 wrote to memory of 6136	4228	msedge.exe	125
PID 4228 wrote to memory of 5632	4228	msedge.exe	128
PID 4228 wrote to memory of 5724	4228	msedge.exe	130
PID 4228 wrote to memory of 5700	4228	msedge.exe	131
PID 4228 wrote to memory of 5724	4228	msedge.exe	130
PID 4228 wrote to memory of 5700	4228	msedge.exe	131
PID 4228 wrote to memory of 4176	4228	msedge.exe	132
PID 4228 wrote to memory of 4176	4228	msedge.exe	132
PID 4228 wrote to memory of 4592	4228	msedge.exe	133
PID 4228 wrote to memory of 4592	4228	msedge.exe	133
PID 4228 wrote to memory of 4980	4228	msedge.exe	134
PID 4228 wrote to memory of 4980	4228	msedge.exe	134
PID 4228 wrote to memory of 2132	4228	msedge.exe	136
PID 4228 wrote to memory of 2132	4228	msedge.exe	136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (10).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x208,0x2ec,0x7ffbfb32c188,0x7ffbfb32c194,0x7ffbfb32c1a0
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,496549409208832129,14345053253803562902,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
      4⤵
      System Time Discovery
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,4583408657097719450,14946317242664522855,262144 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,1464677042483104632,1829811628856188840,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,18162928099727825285,12955468341634101689,2097152 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,7634679610471829017,3015800627116019772,2097152 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,12827352384655548202,1702924071377423463,2097152 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,13305865379840828173,8263865893918081336,2097152 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,16397162282263082069,10608725050193339730,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,9520370580047135134,2713294712102145411,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5352,i,9072515930300882361,4689578364247303169,2097152 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,12787916259541516696,11701855785689506985,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,2116101093280976531,6256551346996848672,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
      4⤵
      PID:976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,7748749086262535033,17930246508796125312,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,7748749086262535033,17930246508796125312,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,190305611128823352,846933181294123848,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,13741292858614813792,12332794620377355100,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,10448793419217326006,4693343411790344576,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=128,i,12974376217460709050,254803703589147549,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,4455869274594452539,9385264565735933625,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=128 /prefetch:8
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4424080010823057563,16977819317572779522,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,8616320343317253314,13211487355004650551,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9210561509613428573,11824446018917577130,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,15280286584396486268,12759354896852245772,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5792,i,18282634667859981325,7211187764710724025,262144 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,5902542746576287152,6348985099027471654,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,3857087936618115402,16687288826215063269,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14253024552477760197,3127113644630609619,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1012,i,8466860494897231453,13049860302021190279,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,6772323412623173735,18409425685222071030,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,14265214390623109864,14373763801051838620,524288 --field-trial-handle=2320,i,13949588133810051302,16455960753148971609,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
      4⤵
      PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

913c3322-f812-4e69-88c2-a89cc25f2f37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\913c3322-f812-4e69-88c2-a89cc25f2f37.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 92a210c974cd99b46cfac769ca873bedb1af9cc87fe76bca97266d74f4003080
MD5 b6b828462aea3f29617a72b4206f2851
SHA1 81e030a4a2a6d6832b4f90c52a5ce1ae3afb35ff
SHA512 e27f41f4077327cb3f965685c560795c40895d3db09efd21d5b0a1942e6995207abfa6893d68dee356aabac592f5439946d5e174254cc4296cf4752c35c36c1a
TLSH
T100E0208546C5F35FF116649F435D670C91B0770ED2CA7A4E671884547103940F2D75D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 5b56961a6c0245de015824e8d8f947d5b6d17fd70489ed59daae1e16cd05ad13
MD5 341e970a87fcb7be927ddc6173bc1c05
SHA1 621ddc23c8ac0ff89e3c844a79fc58677545bd4e
SHA512 3cf9778a69ba5ffadf945727056198a0e16e228bb3c1f6338c7e43a45896f397248a6f54e269b1fc4bb07e2439a40f0fcdac1f0a931b62b68ae1bf06f29b4fdd
TLSH
T113E0D8CAC282F2FA0288D847E29C7258D732F28F959E9A6F3744788C7551200D7D2199
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 958651a7bf5a57b3d8bd18ad868f814af91882189f7a0fb4c201ee79f62d98af
MD5 474de10971c1af5062cfbd91d0c6b441
SHA1 baf22e5383e6526c8b762e3621e12453ff02ba65
SHA512 4ee70a813ba43fec580ce51ca93be8f134102fd82ff01fb1e649388d0c430ed3c1f064e0e078c57dfe3ad45013bf8abcd71f90bccf4a0c7b6db58c96f892b26f
TLSH
T10CE0D8D5C282F2BE4175944782BCE3145B20BACD968A5A5E7344B45C35019847393294
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 70e9e2844d910952fe589a4ece55bca6d9b1b1ac4e1b7e9803fe8fce2b0a1e2a
MD5 ee3c29921e995ccff3b447c4600909f1
SHA1 3d2409caec07c1a21b812b2dc032ab8225662d8a
SHA512 0f62f631e51320ac207b959f622f2cf5fcdd2c984f2ab996dcb06fb741a9039760d0f7cb23511c43a66ca3479232ef3c8fc1761feab15e38f13a0f14ee3d0ece
TLSH
T1FAD0C2FCA9CC684FD3E52EFD4662B0400F6442D29816DE020119F98133655F41F52070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5a125723bb7eb0eba694fd4c186787ab7f0d24892e45ce3192f640520f07c43b
MD5 4fcc0670ab10b08db9ccb9aa93194ec0
SHA1 d0f249f90e7d36369e518117a300163179fa72b8
SHA512 a8148acf2ec66432611efb7ac674aa0a2581c59e6466a28ad7993c684b0d198d1732bb38b0b4ac45b2e788f15624597acb53a7a29d8e7eb30cbf4bfc400493b1
TLSH
T19B71C5781F721B46E766127B90F0824C7777C1EEFA2B1E3D435028B9260D7880298D47
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591b5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591b5e.TMP
Size 3KB
SHA256 8c517b7dae8a8c3e3af8a5d8dc0adbe33f3ea9b5d451e7b8c6284e83903df708
MD5 79e6662a40a1e1491586feada21978e8
SHA1 0a73db4b25dce8304d8695257c7493bcd96eb6f1
SHA512 579308dcc4ee3bf621a8bf17226322b4959fd5c7510ba9ac3d45313d3a58913791be8b784027f5640d65aa272cf7ffa023704fae736dd444779526c737ab8556
TLSH
T1FC6192781B720796E366113BE0F0860CBB73C2EEF82B1E3E4390297A650DB944184D07
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f4a9eff9102b5a3e866c83757f7574bbd853176e72d05f03b942088bc1bebf87
MD5 33ad088839c389ef2e9cd578c126f839
SHA1 cc0f4e06f847bb693274e990b34ae8c7fa1d90ec
SHA512 50a7ac1e45b82d1995a46d52c563ffca3a4df6a4315eb9ce429dc44353c1a695d1ebc88f26fe1dfc0e99c3c8471e6797c4744e389237da9704df3ea48a21380e
TLSH
T1E871ABF783F4866DC90155F0AA246F1BCE5A0628937C3D5A85E8FF47A3E2472E24164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 716cd4764e1d212fe540494ae11a28346a7af5b424d38817fa286a64a3be5d02
MD5 f856c849af9a2879c443d09c0c511d35
SHA1 052f5ff9c087fcc52563f4f8a9440b3c5f51ab95
SHA512 340c99c4acce10eb97353271bca0a6adc34a31fa581ad7e692d08c381f55a32372ae816b590a5427243a1c57810c06cca9447f4cd7644c971fdde2bc34a02e6f
TLSH
T10C61CEF783B0866DC90195F0AA146F1BCE590524937C7D6A85E4FF47A3E3072E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 84adc1a4f42adf53db788fc8e04b83fb15e33a94f0aac93b08b552c6da13e63c
MD5 225a22fa44915f514c364ba41249d104
SHA1 2e0240c8c811f6dc15b873dc5de1fa14b4794d34
SHA512 aeae61de61ccb67e583d6fd74d380b366070c795e7eb4fa22980c3ae954d24eff143671bbe376205bd056d41a511c22d52e7e84bbb618b6fa3134d7cf7dd0e68
SSDEEP 192:sxZ9RXyM/jK1Ml8MiG/f4sg9MdIdpYPHW6+WNLNd/Y9IdCshIg4J:sxZ9rqG/f4sg9HCHbf/hc
TLSH
T15842D712BA345977CCDBD209BA55BF63D6F9056292900E449AFCCA0C05E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1d79a3630db0080a3c4b419e40c78467265be3ead929f8597ea891c2ba3549ae
MD5 e3d098508cf92e9468ad4552313a99e5
SHA1 63ab2df5ad90a54ee456a8713a6913519825e14b
SHA512 fa5336ac12f2bf24731792e3aecf61406ed8ef7b0174da2a6e7b95829a48eac6762cc102f8e1c95ec0355c7ae9981aa399864cdb531e827772e43ef37612a1e1
SSDEEP 192:sxZ9RXyM/jK1Ml8UQkiG/f4slaH10BdIdp+PHW6+WNLNd/Y9ILhshIg5/J:sxZ9rqpG/f4slayw4Hbf/+z
TLSH
T18052D616BA245977CCDBD209FA557F63D6F5147292900E44AAFCCA0C02E7BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 e179e934aa40145e9df55967bb5fa152241a570ca69de9b2b7e6fc95a0dc171f
MD5 87b698ce107fd6825988cd6baca96faa
SHA1 898b5dd69632051a6fbec1972e2989975258a0a3
SHA512 e0cb45cedcb84580186e741ec6344e24ca6ee77bd1853a68b55a26a32809c70f2dee2838f448d83fc86a1fdacbb924879fa60077f5d11d53a162f361cda74c61
SSDEEP 384:sxZ9kqpG/f4slE66s8qMpRiYnazAW8pZS15posJWeT+Myw4Hbf/gz:sVzpG/fBE4Mnc7WeT+MyLHbn2
TLSH
T1DDD20906A924C8779FC35D18B43D7E33D9EC50925285CEDA59ECCA0C029E5FDAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 cdb3fe029c770818917c7c62070b703dead2c495c89093c78d53d6bf302edd71
MD5 ab2b80dc9236907882f2885a9b66c59c
SHA1 d1c91044ebbed83903b878b0186e6a7c98978635
SHA512 3bde2e633383e4ede080efd6198c66d40c8afb97224f245a7341ee06373c7ed6b2cc7d59c5685c6b70693689b87b9336e66754724db9fdc36c8fb0c505368d80
SSDEEP 768:n8cv20wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVc8eFLlwmWNcroz6VF1:n8cv20wWvu+Z+u1jah8eFLeRNHz65
TLSH
T1D5E20A3B280CCB7E4F841E9CED2A6F9A6DE801CB5798895447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\218d0785-0b3d-4579-991c-c324dd8bf389\index-dir\the-real-index
Size 1KB
SHA256 b0db08b268f350d1c1ae29183231849709cac1e6f64782fb96593a14b868461e
MD5 37aa750ebb89855e886b85b6f71c442a
SHA1 f0bc5a5c22373a6b90eeef04a2c9623fdb5e701c
SHA512 2903466934c5af577796b6936025fa5e80b7f3d603d46247c693a7d0ee2cc6a787d73aae63f8b176b412141713524e4fcff0b88dfdd71c2cb805a3d423b05a1f
TLSH
T1AC215E4A4ED05C1FF8A445B70972B4F8B3308ACC5720E723682C22222E1138A199B4DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d4cbb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\218d0785-0b3d-4579-991c-c324dd8bf389\index-dir\the-real-index~RFe5d4cbb.TMP
Size 1KB
SHA256 cc03ffbe86fb0ed30d94490a8e9e4fd8985042834ebf89c8f333f90de27f4a25
MD5 8112c06389f96df2780963cc3795a887
SHA1 5bb8b8ea52d2b66651f018bfef49bf6e71f9d8cf
SHA512 6f9eb5d972a608db7d7db725375132ad5a0072721c7152e120764efafd758a55204bdadac459f997ac6592d398edbfcb64ec7b5fa9e41bfc2bd999582b76e8f8
TLSH
T1FC21F1964AD54D1FF484617B0966B4F8B33088005322F763693D21399E35B990D470D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 acea197975a90ea9862e8949612dc5dd164578bb34b136ba8fbb0ab768e04666
MD5 7b7acb1fb9bc2b1b9473ab8363898c0a
SHA1 d0a05fc7ffd8da8a60fe6ad4d0179eedc1dd07ac
SHA512 5af925d36524153be77dc06610dd587c8c18ac403d024d2250be3d3b00a6b1a08efffc4e77c26d2d20d4b2d9448dc00e81bf4687bc0628188c00166beed64046
TLSH
T19CE0C0B73DE32914AD7FC3DE3431A46000573894D844AD4F103666D360723543896C32
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599fff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599fff.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20a6b861845d522efefd41c423c5782301feb6310f87162e4fe489e8d84266d2
MD5 92104263042bdccad9b3eb7b5f0d35eb
SHA1 28461e488596180f288267babaadb4d09c04f4c9
SHA512 7b7d989ec7cde42c1bb0dd2412edd51e5c111954caaec8146d3b4098aa6859807a91b5370462dbd64e159606bd8d86972343404bccc7b7066143834c49335482
SSDEEP 192:JONk6v+YLNQmiUy4NZh+CGQO9UoushLU6:JONk6vz/nZh+CxO9PtU6
TLSH
T1A902E835BD381C7B9EE2AE45F98737275FA8217BE5912F90D9D82B1C01D774C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bd04de862dac82a3b0662222d16ae2f47b65f8b9191e174bba812e0b4114b10c
MD5 7f791219f1deaaa99d76b7cc7f2527d4
SHA1 dc22ee9d8c32adbe87c29b49f247ce940eb5ca92
SHA512 79ece6b016580b4ec771739d3c78c9c7730817f5616ef150de0b724ac7f90069ef6e5f9afbfedb66f173dc0fcffec14125960c4ccab650bb4d7dc836a8a7eb4a
SSDEEP 384:nw7iF1tNn/s3n9SkzsNU8TUNTUlIlWkykzi6Y6ZDf4S+CxO9+RaPmn15wbAjET:9F1j+9jNwg6wGXS5OoRaPmn12bfT
TLSH
T139B23936EC64CE3BADE38BC5FA0776579EE441A386C86AD4D9C85E4C02D72DC130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a6b14ee70e0850cd20636f8b4b4788d24e1f1167b558a85d0e13303c6c90adac
MD5 7ce5cff0d1784ba4dc5c8af02c0ccbc3
SHA1 e9c6aec94507cac7852e3e98701f65025aa7ef19
SHA512 94eefe16944c67c0ff90346de761f487ffb4e7101ec737c9d347d21144534cb457d5cc84b3b7fbe385852252287e4296108d9456db60dcd52665269096f818c6
SSDEEP 384:neGtNn/s3n9SfsNczkykzi6Y6e+CxO9+RvPmn15wbAjET:tj+9UvwG95OoRvPmn12bfT
TLSH
T10E927C36BD380D775EE39589F94736176EB880A7D2842B94D1DC9F0D02EB39C231AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2ceee40b6ca413e1057a07c9419c274a3a37ad1b0a9d10a2ae38fe58f8315ebb
MD5 b0a028b078c8fd88b614caf17139ddba
SHA1 1fc6da171fda228ae55a5d500cfb9d4c9dd7bbec
SHA512 7394f06ce6bfd7c8683796f049fecf2ea0bb32395c13f814721515036fb40b379514384132bf094cfc5b715c261ecb64d07e5341788705d167fce0d2f991b8ce
SSDEEP 384:nIGtNn/s3n9SfsNcWkykzi6Y6e+CxO9+RvPmn15wbAjET:Lj+9UkwG95OoRvPmn12bfT
TLSH
T192927C36BD380D775EE39589F94736176EA880A7D2842F94D1DC9F0D02EB39C231AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31daea16ef9f95aeaf30acbe5d8dc6ca4244f2e87a1de002825908544bcc48fa
MD5 a3df61f9be7638f518a6de64a2923e7c
SHA1 f282ed163ed816cda86c10035b808332a15ae4ea
SHA512 e3fbc771e33d90a060464d19f058d60f32043f0b81e7ab585f7cfaa89e277404e3dd739c91a16a1a57725d099460da7b66928324657c01715158972100ef7efe
SSDEEP 192:SONd6v+YLEQmiUyJNmh+CGQO9UNRSCHuqJVU6:SONd6vzoumh+CxO9+R7PU6
TLSH
T1FA120932BD385C7B5EE2A944F48732139EA95167EA857F80D1DC3E1C02DF75C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 324354329ca3e3dde3c89d4547dc5af5cee4f2861c162cd8e6d42a0129a2a778
MD5 b904311db6b7178f3a088e6c7c054180
SHA1 eec0650912a909feb543ecbac80de8e16d547e22
SHA512 14eea4bc25b3305d8e987807e35d2080c064ea08ef09cc170d66af5662e1559a00585616f4289b828e3fb692306172d54c5dd77e7b90a614a6827e9b6ca448db
TLSH
T180412A5CA6FD1148B3B76F1AAFF7A86D447EB8362E06D49D00110E4F0A63A44D9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

7cc57a29-cbb6-463f-b911-4c59d697ff52.tmp

Path C:\Users\Admin\AppData\Local\Temp\7cc57a29-cbb6-463f-b911-4c59d697ff52.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e091d18d-d4a1-4257-b54d-b20d6e9912d2.tmp

Path C:\Users\Admin\AppData\Local\Temp\e091d18d-d4a1-4257-b54d-b20d6e9912d2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4228_1495113427\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4199946-63b9-4c1a-b243-310da55af4f9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4228_2012911552\a4199946-63b9-4c1a-b243-310da55af4f9.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download