b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
898s
max time network
898s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (12).bat
Size 44B
Sample260627-rf3mfsa191
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4496	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270429634492087"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{4209F050-73B0-4DA0-AF78-EFE8779FEB44}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1036	3444	cmd.exe	87
PID 1036 wrote to memory of 1644	1036	msedge.exe	89
PID 1644 wrote to memory of 632	1644	msedge.exe	90
PID 1644 wrote to memory of 4496	1644	msedge.exe	91
PID 1644 wrote to memory of 5104	1644	msedge.exe	92
PID 1644 wrote to memory of 5104	1644	msedge.exe	92
PID 1644 wrote to memory of 5104	1644	msedge.exe	92
PID 1644 wrote to memory of 828	1644	msedge.exe	94
PID 1644 wrote to memory of 828	1644	msedge.exe	94
PID 1644 wrote to memory of 4532	1644	msedge.exe	95
PID 1644 wrote to memory of 872	1644	msedge.exe	96
PID 1644 wrote to memory of 4532	1644	msedge.exe	95
PID 1644 wrote to memory of 4532	1644	msedge.exe	95
PID 1644 wrote to memory of 872	1644	msedge.exe	96
PID 1644 wrote to memory of 872	1644	msedge.exe	96
PID 1644 wrote to memory of 4196	1644	msedge.exe	97
PID 1644 wrote to memory of 1320	1644	msedge.exe	98
PID 1644 wrote to memory of 4196	1644	msedge.exe	97
PID 1644 wrote to memory of 4196	1644	msedge.exe	97
PID 1644 wrote to memory of 1320	1644	msedge.exe	98
PID 1644 wrote to memory of 1320	1644	msedge.exe	98
PID 1644 wrote to memory of 1708	1644	msedge.exe	100
PID 1644 wrote to memory of 1708	1644	msedge.exe	100
PID 1644 wrote to memory of 4792	1644	msedge.exe	103
PID 1644 wrote to memory of 4792	1644	msedge.exe	103
PID 1644 wrote to memory of 2588	1644	msedge.exe	104
PID 1644 wrote to memory of 2588	1644	msedge.exe	104
PID 1644 wrote to memory of 2588	1644	msedge.exe	104
PID 1644 wrote to memory of 2036	1644	msedge.exe	105
PID 1644 wrote to memory of 2036	1644	msedge.exe	105
PID 1644 wrote to memory of 3736	1644	msedge.exe	106
PID 1644 wrote to memory of 3736	1644	msedge.exe	106
PID 1644 wrote to memory of 3508	1644	msedge.exe	108
PID 1644 wrote to memory of 2928	1644	msedge.exe	109
PID 1644 wrote to memory of 2928	1644	msedge.exe	109
PID 1644 wrote to memory of 3340	1644	msedge.exe	110
PID 1644 wrote to memory of 3340	1644	msedge.exe	110
PID 1644 wrote to memory of 4472	1644	msedge.exe	111
PID 1644 wrote to memory of 4472	1644	msedge.exe	111
PID 1644 wrote to memory of 4980	1644	msedge.exe	112
PID 1644 wrote to memory of 4980	1644	msedge.exe	112
PID 1644 wrote to memory of 3112	1644	msedge.exe	113
PID 1644 wrote to memory of 3112	1644	msedge.exe	113
PID 1644 wrote to memory of 2624	1644	msedge.exe	114
PID 1644 wrote to memory of 3360	1644	msedge.exe	115
PID 1644 wrote to memory of 5008	1644	msedge.exe	116
PID 1644 wrote to memory of 1924	1644	msedge.exe	119
PID 1644 wrote to memory of 1924	1644	msedge.exe	119
PID 1644 wrote to memory of 4464	1644	msedge.exe	123
PID 1644 wrote to memory of 3964	1644	msedge.exe	130
PID 1644 wrote to memory of 4372	1644	msedge.exe	131
PID 1644 wrote to memory of 3964	1644	msedge.exe	130
PID 1644 wrote to memory of 4372	1644	msedge.exe	131
PID 1644 wrote to memory of 4068	1644	msedge.exe	132
PID 1644 wrote to memory of 4068	1644	msedge.exe	132
PID 1644 wrote to memory of 4292	1644	msedge.exe	134
PID 1644 wrote to memory of 4292	1644	msedge.exe	134
PID 1644 wrote to memory of 2796	1644	msedge.exe	135
PID 1644 wrote to memory of 2796	1644	msedge.exe	135
PID 1644 wrote to memory of 1752	1644	msedge.exe	137
PID 1644 wrote to memory of 1752	1644	msedge.exe	137

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (12).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x258,0x7ffe3bf5c188,0x7ffe3bf5c194,0x7ffe3bf5c1a0
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,13638585108858210245,10806551852580747895,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      System Time Discovery
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,1627520018230873611,12167687843452660418,262144 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,6820549141142232538,7732107044495988519,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,5807061420913000266,13428635000232110037,2097152 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,5611718184439697687,18243463793520756331,2097152 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,10345898922564575030,1936083791864503862,2097152 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,9262983004401872650,10226626976659219590,2097152 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,1350732223358948936,8099955185540242262,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,11755231628783147759,793623578094771603,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5332,i,9183056857788536505,14132807786631524395,2097152 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14821842140989959005,9494911833865973138,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2136459775342449947,8890687812897253246,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,1705420211584612768,11170278839672926538,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,1705420211584612768,11170278839672926538,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17035069723123383362,2695434712336111568,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,4049968800864353990,12684710404363229983,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,15739463436487894744,6761953557581157935,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,16229402930279375861,5304524684247932466,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,1006106579801710860,17584006192796785931,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,12722109327566787556,18022388995538282690,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,9859637191993975430,8578050131184868152,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,17774934898140862000,5008034046986734002,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,3388837878646053848,15200031990724109931,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7016,i,3121645716470508205,9518308832846946184,262144 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4056,i,12231534482846753469,463781388919462126,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:8
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,10733158277410971261,11272826208321021015,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,17875481413857848355,17944809772688111293,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,5412045412569035222,13524726297924483919,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,11561248815361649956,6228492695224032203,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,3936373053799921933,4875346479926304060,524288 --field-trial-handle=2244,i,5300212603519215358,8043160332510271623,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
      4⤵
      PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3d498eb9-38d6-40f1-b475-30f251206cf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d498eb9-38d6-40f1-b475-30f251206cf5.tmp
Size 25KB
SHA256 b8ffabc942978a5d66b76f511d401d9ec322bab2476d1e6bb20b81ec75853949
MD5 651108c0b835ef354ccf338efc5092a6
SHA1 e8f73fed0ba166cd1d0dbeb19b0c7c292a209f2f
SHA512 b5673e760324f043814ee36d4b1943df4dd03070871254686e5e094171765609f5b4cb968d33eeeddc2efedf1d2eed5bf54c8d910b634a3d75b43440068e6dac
SSDEEP 384:n9xiF1tNn/s3n9S2zsNs8TUNTUlIllaTPcbkdYxi4ZDfQndV5+2llmn15wbAjEi:CF1j+9VxwgC7cFkRnVlllmn12bfi
TLSH
T18AB24A36DC65CA3BADE387C5F60A36479FE441A786C859D4EADC9E4C01D72EC130AC09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7e06c65c501c3b1addd515b10466a6255332e20cf6fca8954a1fe368675ec780
MD5 fda44d093b594e8f1307046976fe946f
SHA1 875c3afba5e5ab03ecabc8ae4ca0fc26da2a5eca
SHA512 07055d678dcf45a6d3d589c00f5bb03c6b0b1217d9f83822d19fcbd812f7ba6814e7ffb881c1fe507b0e53c4ee4049d4f311cb2a3148a9276714ece1010fbc55
TLSH
T1DBE0DF85C8CBE32FA20864A7526C534CC6A1370F9AC87A0A370588857203A50A2E6690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 c833aea8ff4c2bb5ff53b72c6cae6600151671da76b4a3d3cd92cd33761d901f
MD5 fc4dc4b3d6ed583f4e4cd9c86d7b98df
SHA1 eb16a7fda822b4882453b9f2e9ba8319e97de0a4
SHA512 4dd0f32cedf31699c9d35c792ee45254e26e6b6e7bdef953c919ac689de1d4c4203534ed58aa1217ad18b53d84165cf77040a28fcf2b5aa7ebb4c369da66ba82
TLSH
T11CF0C8EAD390F36E5383504B928D72180170F38EEA99DA9E370C64887553155D6D5199
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 b7fa260a091f10193b1f4fabe57ce46cb4a4b034b0c99ebc6c4b47f6ddc958ca
MD5 9aaa11f9cf56059468ac92a8b25caae8
SHA1 c204d5282d5c8246ce07ed9f9795c199003e47a9
SHA512 21390c806b9d7db3df4c20e624b8ebe92f02a554c3eff2b85854d77eba86f9492fbfd6e51654be4582c3f11e60f92fefdef3ed41c2f372e942d3d75f2f7fac88
TLSH
T16BE020D6C386F3A64361960782FCE3245220F34ED54F5A5D330471AC35412D05397C94
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 852efd21696d618ac68f9ef38eaef97f6adfa4752c4d881a5f647f436986d92f
MD5 910a72c1c4528a86e4f070fec77b8261
SHA1 57c3bfcb94338174eaaf86df993d98b348ca95c6
SHA512 fc6c1e35aac8789705965256ec5fa51509497b199a637d956dfb85cd2b11c7c40254e43f20136302e87c9c50bebc4cf8ab89a09727e05ff3889ef96a65e0ee98
TLSH
T187D0C2F8A8CC688FE3E52AFE4662B0400F5542D29416DF130119F98132A59F01F52070
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5241b016146e77cee983eda71c1ca7844d6782c00630f8a530649a2c239ef237
MD5 b6a14ff592a5a33274f83b5b5ccba21e
SHA1 16773dff965720b366f83643eee60c4b40d286e9
SHA512 a09a87c0c7edb8ea6b96a24c6618afd0925f0e86fe8d7d04921cba8aa166dc7909963981d6e945470bd2c5480347db1c05986ec2ec6b6bd3baa777ac4c99b94b
TLSH
T1A571E734013504ACD32002B064DD65487EF481E8FE775F56A1CC7ABB6E1EFE9A3AAC49
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c743.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c743.TMP
Size 3KB
SHA256 fa4df0ea1ed137d13b46ce548210c03cc7630f97f2d39f207203bd2dffb58ab6
MD5 71c5388d7064f3bf87e754c534b9f1ef
SHA1 9182d5615230e30955e665ee277a57e73e100f44
SHA512 2d1dfe6cb30f28d23e01a11f77e4ddff48103ce5de5f90252b06ebed910cd7a3f347e8adb61863377eacb764df549442a8ec60ac15685464c82522ff2cebcec1
TLSH
T1A471B634023500ACE36042B1A4ED66457DF481E8FD375F02A1CC7AB7AE1EFE4A76AC49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f566f7ad6724b7248c028f29e098daa066d1e5a59d9d22dbc75ab13eb3b9177f
MD5 1dbed58d9b785d7dc354a203e26fb609
SHA1 83d40f8dd2f2a62a8d20656f53431eb9af39bafb
SHA512 160e6615111fcbe60ca202ca5746742ba4e6ad2994412d64db1174effb73450c94794b0abee97ac000a269943edfdb197f8f13a55e5fdd10331f8a2d1f906dc9
TLSH
T15771ACF783E48A2EC90155F4AA14AE1BCE590624937C3D5685E4FF47A3E3472E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a0a63de26fd1f0076d27f4b2924581551ec785229512c093a236cd457f1cba49
MD5 5f77c29808d5e7a109f6a276b99b01c3
SHA1 a44921aad8784bae859f3474f979f02762ee9824
SHA512 11e9fbc90cb44f47a898c4ed377adb1f57d7542f6b6e9771aa22be0df753657e9fa16d7ad9b71574111d42af2f2b6eb173ada8ef803191cd7f6b8746f1995650
TLSH
T13E71CFF783B0866ECA0195F0AA14AF1BCE590124937C786685E4FF47A3E3472E241B4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cb0c631ee262dc7771a877b4d199b9af4de67ffc22111ea34a45e9f5888cd555
MD5 fa905fbe0c8a8055d437947e2807be4d
SHA1 3b3a86cf7f86f55844c948dc9cc97774ee6497f0
SHA512 1ebd6099b415130a8bc188ffc1322e5f40b31b976f0e5de443fc631ed3eaafe8aa1e264673e77d2318f8809c5296dab9a643c6f28c90be930af5cc830480b1c7
SSDEEP 192:sxZ6RmyM/jK1Ml8MiF/f9s87zRHmPgIdpYr4HW6+WNLRg8/Yzdt+NIg4J:sxZ6MqF/f9sCzRG5xHbX/rc
TLSH
T11C52F9127A34997BCCDBD209BA54BB53D6F51562D2840D44AAFCCA0C01E7BED225782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b88cf8c745748b527c605c0e50eefee5fb1c5035bb345ffc5c25a44c8eb56fc7
MD5 7ea6b243ed23e4d00c860dba3b42254e
SHA1 2416dbd23715adb1597dd32c815d3ff3581278ac
SHA512 4631cb37a358ecf4c67f94b2fcc94bc6fc1ed7e2c26ef3b6a94a5a24b477daaa21c864a365d80f187862ccb414c9aaad6a22952b964591693b82f78899396919
SSDEEP 192:sxZ6RmyM/jK1Ml8UQ0iF/f9sK7CRHmPgIdp+r4HW6+WNLRg8/Yzbo+NIg5bJ:sxZ6Mq5F/f9sUCRG57HbX/Ab
TLSH
T1FA52E8527A349977CCDBD209BA50BB53D6F514B2D2840E44AAFCCA0C02E7BDD225782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 6dc661d7e11b3509796663a41fd68ea80c6087cd59def379cd025f3c05d7bf48
MD5 516ed880a87a95ab5584e71793fe0592
SHA1 2a84e7af69350f900d18beddbe8b0d92b21130bc
SHA512 c49144439cf45b7d3c0c3e62188ab72f0b4a5b18b6bfed918970098d22ad104dbed8916f8cb586e5434f0a72d7aa0733eb8100870458e4288c4a2a344f175b72
SSDEEP 384:sxZ6jq5F/f9sUj66s8qMpRiYnazAW8pZS15posJWeT+SRG57HbX/Qb:sye5F/fdj4Mnc7WeT+SRGRHbPe
TLSH
T16DD21906A924C8779EC39D18747C7E33D9EC50925285CEDA5AECCA0C029E5FDAB47827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f59f17307d7afedc187ab9600a8a536e0f5a33f133feca211372da401392cc8f
MD5 2ff07f946861639e9db8ebea75388894
SHA1 65b3000923e7b654a2d0d0776397e494630f3840
SHA512 6a89ea94d3f930221d4fa56102f85383a8ffe679bd70543f0c65978790a99b1aa0087c23f2e6ecd56814bb99fea290acd63b45b06d156556be51d9f6f05cf6de
SSDEEP 768:IPW7ko77pLuL780Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnSa5LlWYSjDron:IPW7koNE780Wvqidau1jaOSa5LA3jwDb
TLSH
T136F20A3B7C0CCB7E4F844E9CEC2A6E9A6DE8018B56D8C95487FA844C03C66EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 f806359b1bf194ae57bf777eea265f7dfbcf1078bf36ce45ac925b5bfbf8a302
MD5 d52c178d11e52704d1aa0cd484484c28
SHA1 07b8b081fa64f5fe514e70d2dd50daa5992fdd7f
SHA512 d33872a72c8af24fcdb2719dd8b72f7db41255fe9638ab1a20f241e373ab94cd482d3e882add8d0c2d434d341abd5657842d6aba0608a7d8a4268e8cdb49e647
TLSH
T19A2165894E80955FEAE484F1107771E03371D9DC1312A3938C3C72352C273592E4F1C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf871.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5cf871.TMP
Size 1KB
SHA256 3594f51146e244adbe397f146056b62b10438e2ca91b6b6637a23297fb695903
MD5 5a83a0c8f3251d81d150eaa42a1ccf00
SHA1 663cafc39e6195fb35fdbfe245ad683719df90f5
SHA512 72aad1d048cd70f6bab964f4a64a5a14bf474d3c745a10127e4c839c01d57074c5e9f2e48c6de1b839d35588c0f2fe3c854443d501f602a7a2663bac1651ec70
TLSH
T169211CCA8A92590FE8E080B60552A4F83374C900A322B3D3993D673A5C3979E6A5F0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 681c571380ca83226177cfd04612ee2085bda075dc0dafd84c4d0d4eacd08e2c
MD5 a4ddd9ff295b7a5672d2b0ab18e9fa8c
SHA1 4087c52611d54c1bb99f6f2cf1124bf103ef2979
SHA512 2085aeffb4c75d7b90087514aa17ed9204c7813cdacb5d21f231a461a1ea18cb4d393d54dcddfc7b887a3f900b46b439c250e0a576c0adf1b6ccebfd20c4005e
TLSH
T17DE068BB2DFB1C20AC7F97C538B054A085853818D504EC0E3027A28730F23612406C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 63defdb9f8ea9f944eef3bd1f91ee954f35eb6ce7ac1fb6538d7c87e48f43a94
MD5 0c5672864a696a72c7e24cff76236418
SHA1 d50ec60534b6372fd8de01137d812c6f0a31ee37
SHA512 69768c83b42bb799f1cf1ce32c430960d372ca692f0bd0741e6e09dd04ce5abe1d69a58290a13c7766a53976498ccf0fb0b5f23055603a6a7fd92aff7fd5f752
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTT4IHKVG8jyJCIfKLagflIRKGMcU:KIbCKcT4wKVGKaCMKLaoliKGM9
TLSH
T17CA19B12377B1A0138FD2914A2AA8D374E923963341D686F7BB921F51E2BE111DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39c704f9-4ea7-4374-946f-0de5c9f63d01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\39c704f9-4ea7-4374-946f-0de5c9f63d01.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594d6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594d6a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 19c6d3e2ac7f93715d882b9f3489b09dbe9b1c59384603bcb3ab0365e2d2e6e6
MD5 268aefbf2af418ad79858cc0f1269565
SHA1 09dbabba8fda867291a7859caff68d987bcbe220
SHA512 1a24698ba7fe4dc9fbd6da8cf483028dd77bc463a9f6276177f4f9eb0258488e4e5c17900862bbbb45eab1dd564423e0409414fd8158e865ad77c1e7d164611e
SSDEEP 384:nsDtNn/s3n9SfsNkgaTPcbkdYxi4rdV5+2mlmn15wbAjEi:Ej+9UB7cFk+Vlmlmn12bfi
TLSH
T12D928D366C391D375DA39589F10A32176FA881B7A7C42A58E5EC9F0C02EA39C231691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7f432cb2b333df3ddc3508bd22aa2c0360b42965d697dfc8a3b23dd35ca6633d
MD5 f357d2d117d4b5a8676a2ef64e7cf01a
SHA1 43dadf3f1025c71c9bd791768e75a87c0e8c75ec
SHA512 d75769e6970e1d1ac1e3090ca1c06d57e11a62ddb49c6c5fa3601ea0b9583b4039f0d2e246234e194dfaad4eade67488880295934ea223c34a3c84734661f0e3
SSDEEP 192:MONM64BAQmiUyP1CW5GBPKUq+FdGe5A0aD8xU6:MONM6eA8YWUdVs0U6
TLSH
T110020B396C796C7B9EB2AE45F48737175FD8103BEA852B44EAE85B0C01D769C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2dc855917222e23a0474f3ab09526ec41374b65bcd35403d94fd6e359f4b22b0
MD5 609b4859bc79ee42d5865b3feee7dd8f
SHA1 54cce9bae6adaf6e8f392dd3ca90480f3968d3d7
SHA512 4bea71d96ef70a8146922a121c086d915554b5a42a6dc6d75d58144cb3cd0b136d067acb11913c30646c5d1416d023d8a948a790e0523a6ebc0d164d117ee93a
SSDEEP 384:nlDtNn/s3n9SfsNklaTPcbkdYxi4rdV5+2mlmn15wbAjEi:lj+9Us7cFk+Vlmlmn12bfi
TLSH
T163928E366C390D375DE39545F50A32176FA880B7D7C42A58E5EC9F0C02EB79C231691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f233a891496bc267f7267fe237675c30d1ea22203fa96fff51cf4f5ccba594a
MD5 89cb77ba72bef293929cefd6c04844f7
SHA1 aae58956277a404eb78350400fc52e42d613d3d3
SHA512 f5e0402ecdd0efde4a016523107f0d17ec1e30d9d6566573be028464a9fceecbf620080f8276f2bbb85e83594e739114c1d9bf955f34ab1a4461f36179521474
SSDEEP 192:4tONd64BQBQmiUyQCxR5GBPKUq+FdGe5AMV+2nWw8qXU6:4tONd6eQfkxRUdV5+2TlU6
TLSH
T1A3122C366C745C2B5EA2A541F48736175FA4413BEBC97B44F6EC6B1C02EF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e470e2fbcf5cae14e0d4ea080f2ec80eab86c90dc78b5c7226296ae370b420d6
MD5 4ab0859a5ea2dc2cb072d65c8087cd0a
SHA1 4f1f732e7d3c12d1195cddf5088aecf0cb46f3b5
SHA512 835e5e15f3903d3aa917d2dc55310837c4ec0c4ebdc7c8ee3884f8541c74beaff940f6fd0be6460923f7f4cadf7276c37de32f8cc0acf7736066c9973d8cfc6d
TLSH
T19D41099CA7EA1148B3B76E5A9BF6746D487BB9761F1AD05E10010D4F0A22A40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

ea80a333-9c76-4c26-bdf1-9b5008fbd164.tmp

Path C:\Users\Admin\AppData\Local\Temp\ea80a333-9c76-4c26-bdf1-9b5008fbd164.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f0e73d2d-d1b9-4305-b625-685cbf7a5c3c.tmp

Path C:\Users\Admin\AppData\Local\Temp\f0e73d2d-d1b9-4305-b625-685cbf7a5c3c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1644_16194197\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81797bc7-e4f6-48ac-857b-9118abb78148.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1644_207212479\81797bc7-e4f6-48ac-857b-9118abb78148.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download