b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
899s
max time network
896s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (2).bat
Size 44B
Sample260627-rf3mfsa191
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3592	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270429636941064"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{0B7B775D-AE86-42DA-9F5B-306E619F5BDA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4040	3444	cmd.exe	87
PID 4040 wrote to memory of 5068	4040	msedge.exe	89
PID 5068 wrote to memory of 4060	5068	msedge.exe	90
PID 5068 wrote to memory of 3592	5068	msedge.exe	91
PID 5068 wrote to memory of 3292	5068	msedge.exe	92
PID 5068 wrote to memory of 3292	5068	msedge.exe	92
PID 5068 wrote to memory of 3292	5068	msedge.exe	92
PID 5068 wrote to memory of 2580	5068	msedge.exe	93
PID 5068 wrote to memory of 2580	5068	msedge.exe	93
PID 5068 wrote to memory of 3836	5068	msedge.exe	94
PID 5068 wrote to memory of 3836	5068	msedge.exe	94
PID 5068 wrote to memory of 1736	5068	msedge.exe	95
PID 5068 wrote to memory of 3836	5068	msedge.exe	94
PID 5068 wrote to memory of 1736	5068	msedge.exe	95
PID 5068 wrote to memory of 1736	5068	msedge.exe	95
PID 5068 wrote to memory of 4760	5068	msedge.exe	97
PID 5068 wrote to memory of 1476	5068	msedge.exe	98
PID 5068 wrote to memory of 4760	5068	msedge.exe	97
PID 5068 wrote to memory of 4760	5068	msedge.exe	97
PID 5068 wrote to memory of 1476	5068	msedge.exe	98
PID 5068 wrote to memory of 1476	5068	msedge.exe	98
PID 5068 wrote to memory of 1584	5068	msedge.exe	113
PID 5068 wrote to memory of 1584	5068	msedge.exe	113
PID 5068 wrote to memory of 2024	5068	msedge.exe	102
PID 5068 wrote to memory of 2024	5068	msedge.exe	102
PID 5068 wrote to memory of 2524	5068	msedge.exe	105
PID 5068 wrote to memory of 2524	5068	msedge.exe	105
PID 5068 wrote to memory of 2116	5068	msedge.exe	104
PID 5068 wrote to memory of 2116	5068	msedge.exe	104
PID 5068 wrote to memory of 1636	5068	msedge.exe	106
PID 5068 wrote to memory of 1636	5068	msedge.exe	106
PID 5068 wrote to memory of 1636	5068	msedge.exe	106
PID 5068 wrote to memory of 464	5068	msedge.exe	110
PID 5068 wrote to memory of 3036	5068	msedge.exe	111
PID 5068 wrote to memory of 3036	5068	msedge.exe	111
PID 5068 wrote to memory of 4488	5068	msedge.exe	112
PID 5068 wrote to memory of 4488	5068	msedge.exe	112
PID 5068 wrote to memory of 3064	5068	msedge.exe	115
PID 5068 wrote to memory of 3064	5068	msedge.exe	115
PID 5068 wrote to memory of 4324	5068	msedge.exe	116
PID 5068 wrote to memory of 4324	5068	msedge.exe	116
PID 5068 wrote to memory of 3340	5068	msedge.exe	117
PID 5068 wrote to memory of 3340	5068	msedge.exe	117
PID 5068 wrote to memory of 3464	5068	msedge.exe	121
PID 5068 wrote to memory of 4168	5068	msedge.exe	122
PID 5068 wrote to memory of 1260	5068	msedge.exe	123
PID 5068 wrote to memory of 2392	5068	msedge.exe	126
PID 5068 wrote to memory of 2392	5068	msedge.exe	126
PID 5068 wrote to memory of 1772	5068	msedge.exe	129
PID 5068 wrote to memory of 2880	5068	msedge.exe	130
PID 5068 wrote to memory of 1896	5068	msedge.exe	131
PID 5068 wrote to memory of 2880	5068	msedge.exe	130
PID 5068 wrote to memory of 1896	5068	msedge.exe	131
PID 5068 wrote to memory of 4608	5068	msedge.exe	132
PID 5068 wrote to memory of 4608	5068	msedge.exe	132
PID 5068 wrote to memory of 4568	5068	msedge.exe	133
PID 5068 wrote to memory of 4568	5068	msedge.exe	133
PID 5068 wrote to memory of 3672	5068	msedge.exe	134
PID 5068 wrote to memory of 3672	5068	msedge.exe	134
PID 5068 wrote to memory of 3416	5068	msedge.exe	136
PID 5068 wrote to memory of 3416	5068	msedge.exe	136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (2).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x248,0x7ffef85fc188,0x7ffef85fc194,0x7ffef85fc1a0
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,2559555609852156914,1125763499525046559,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
      4⤵
      System Time Discovery
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,10931598348627500814,5678997959581326355,262144 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,13229571186760261120,16926314255435869684,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,14513207100361811480,9333140399230994360,2097152 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,3227057621030322849,17112216948613229187,2097152 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,1779078875516715942,16457061359319513393,2097152 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,12097974572944372165,17470892712216659936,2097152 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,2794534062769665668,15817172037178146645,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,8044131659777613696,6718508211795275262,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,786058859800901547,13467824205108800217,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,16662248150708135676,17114727049938551027,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6084,i,278664716614993581,1795557891400931457,2097152 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8854824703920150239,9728750881897095580,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8854824703920150239,9728750881897095580,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5453202890583662758,12563075837707634663,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,7328931877980412710,6084044358054593585,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,8161026160735266987,15910036134559398829,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,691117652255274885,3773485332388084207,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,6854993555685380689,12223059860839822886,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,8545579387596426483,12338294034550697491,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,15333752126067676499,14988518456497639351,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,15123194554149835927,13678466083984414447,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,9014344044753579389,1036144783916767829,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5664,i,17463829343025546536,10169859366643699485,262144 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,10721755419033181598,1430650270234381449,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,10495281800297872450,15100405053224716355,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,1632352650939872077,13375362045724690636,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,1988237016835092726,4032748503353177113,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4186998979258966173,10473779694078338043,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,9917225296507570758,825129621383927142,524288 --field-trial-handle=2284,i,671853046675331002,17005454109808540898,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
      4⤵
      PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 819ea8af5bb15e2822c9e99a2981dc594a8cbfe8a9a1903129ed2de6f25571e9
MD5 317c73818fbe82f631277b20016953ea
SHA1 7fb7a41925d60f508021627ec346a49bb9a69220
SHA512 17242ca5ad649b60c1fb6eed4fedf201820e4950ba6f1d882cfafc073bffacec08af48d5216cf28771999cc3e32c504a2a27b4c48f969883da1e86d2caae5df8
TLSH
T1A5E020CD85C5F31FD360654743BC930C6390374E92C4AA0D67048858B102184A3C3954
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 1863bdb952306a1a31443a4349082e16e9f5b7a350355f0ca29d1dc7e943243f
MD5 97325c369fe6f03dc9c13ba97519213d
SHA1 6cce8b8fa4e80a74bf463d566738596d20abc2dd
SHA512 5dba4664e61f3926c93ada3cee786afd680823b348ababd8ad29e5f8e60d2fa75933d79c0e1d8ac25a986f703eea57f9d5d1caeeed688469a02ccae17b8215ba
TLSH
T12DE02047D28EF3A7610BD64B825FF3994171F30DDE4DE65D330F60956543B0042D8690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6cc734f5d161503a2a8c15034b906759588eff4bbfec8c95c9e6b7859840a78d
MD5 bf2f0a2b6042f660c8ec58453f6b78d4
SHA1 706cc3309a87f15910c7d7fc10f4ecbc61015823
SHA512 0137edc08244a3d2c86d0715241472ea4ea4773edbaff6d173900e823bd22da783ca79d95d5ed9c363ee03757e78b3aea376b47b46e282ec874ce77b997937c6
TLSH
T1DCE020E584D4F35FD1456447429C730CC390774F92C4BA0F2700844835C3150EFC6594
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 966e2aa64b67619ce748a82250cdec67ffdd3752e3660ab5ee4914dfc964cf50
MD5 31d9a23c4592a27e2a3ecca4559bca02
SHA1 335833b3b9f34e90e88c2f45482d1b6050aaafe7
SHA512 7918312da076aa6d6363dafe37e1a28c603a8e0427acc6cb9c29518bd76cd224ffa89de952dd08a6f6cae923a45c69b861f2ed4bc39c2c4bb9eeee17962fdc18
TLSH
T1BC712C39C10D59A5E7D1433291D100977A3E82CBF503FE8541A0BBBB13E431B828EC87
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c232.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c232.TMP
Size 3KB
SHA256 fc88bfb627e893e1a1231545ae281daaff20eebe6a2c35773ba6f554f989bee2
MD5 9d040e3c535df2a07e63be8ee809c7c2
SHA1 d8e426128f2ebc0a7a15af86c42d678c0c501f5b
SHA512 9efa8a455da282ff16507cd2e7d8dc35ad03cbfed0dfa9623720ac7046f489819f2b22561879b0c419f572c4b7a3d391aa098fe3ff8a8dc2e3d900eb2f02b9d8
TLSH
T1AC713A39C50E48A5E7E1133291E10157B83D82CBF803FE8552A0BBB717E4713868EC87
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cd2b95cbf049aa51c3b3831680ecc58714655f7561099d5bbac6eaec5859312f
MD5 b50ba5decefd5a4d8aea061d09eb6739
SHA1 b8759718f51a6b92d125eabf87d907b7b1af330e
SHA512 7574388eb42fc3125c06295f0c38ccceb51bff588863f4aa1b0cc1157202511d44f8e13f18f2fbf4110806853a0893ec3510b585eeb0228e34b7b7ddcc10ab3f
TLSH
T18B61BFF743B0866ECA0195F0AA14AE2BCE590124937C786685E4FF57A3E3072E28574F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 77bd070234a17c55eba5e0811a73b554be2f2f6ba3b5a396db5a5ed2255eda58
MD5 9ed1274e70e24922382d30e3b7601b17
SHA1 cdb84cf409ac1cf6e2988da95aab3db04768f46b
SHA512 b0ca89c15cf6bb3fb79233f41b82581b92d2615cc0da11608f3ae6d6e6ca0f282f77ce3fb12e089386b60327629b06ccf55655a9b98ee41b0fa2f356e5fce46c
TLSH
T1B861ADF783B08A6EC90195F0AA14AE2BCE590624937C7D6685E4FF4793E3072E24574F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 03d96b37c62e4e75cb347b3b91e28a7cfe86a7d811ad8b2acd2abcd1e33450dd
MD5 d7c990f5bb2f38bdd0db9ad35c14b9a1
SHA1 6e0c86aa486534489c8224767879c97d5b7e64c3
SHA512 a9d2f08e2f5d124bb3282d656439c49f330c866a3965bc7af699fe4758c5a1f0782b48120214a023c2fc3ffbfe055b85b73da23d33ea679082e4261556300449
TLSH
T192719DF783E48A2EC90155F0AA146E2FCE590624937C7C5685E4FF4793E34B2E24564F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 272bf176753ea61f8814ce463060b9c3627f1da3a2f606e992c329cdfbdcfcaf
MD5 4f9aafacc3d971b50d97cc4698358deb
SHA1 7d18977dc4fc96775dc51ae1f3abd201520b6f1e
SHA512 a564fc970b1e3c5b8441637b80698c5ac87bb2003e4d201e55a42955dfb4bf05cd66b4fa3fd80752282076592d4165851ffab05ca7ba87d53277962c952c59b9
SSDEEP 192:sxZ7RVyM/jK1Ml8Mip/fNs/OHDh/FUP0IdpY8HW6+WNLP1/YzbV62Ig4J:sxZ7Pqp/fNs/Oj5FU19HbZ/ic
TLSH
T1F052D852BA349977CCDBD208BA557F53D6F514A2D2900E44AAFCDA0C01E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66b53014dbd093247a7ec0acc1cb0d92faedd8dc5fdaa6f7a450719600e2a3ee
MD5 39d1b561b3b90b5ceac084bd3e71dc02
SHA1 4386b9c51866e7f890e6071309b640e3dc5c94ca
SHA512 c3cb7a7728e7b86eb45d146335682134a57ee5ec651d05fcf4f4b47286a02d9f8261f9b252c26f62b48b56f9e0d4dc38151e44a44103b100ec01e5cb40fbd2b0
SSDEEP 192:sxZ7RVyM/jK1Ml8UQZip/fNsWfHDh/FUP0Idp+8HW6+WNLP1/Yzfw62Ig5qJ:sxZ7Pqgp/fNsWfj5FU1jHbZ/vk
TLSH
T1F952D852BA249977CCDBD218FA517F53D6F514A292900E44AAFCCB0C02E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 6455d79360793c9323f578cc75ae6efcc0e62732b1229e2782a2671f58405861
MD5 c100f59340a472fe39d807565ed517b4
SHA1 ca079e90cb7da8645bc4844be451827a02c79cf8
SHA512 d53fc0b0a90786288168ea7f308e94f26d0a47c6f6e02db9116be008a56cc09db37d320577872460d96cbbfaf41dd71c69245daccef200cd9d64bb5fb27dcc21
SSDEEP 384:sxZ7Sqgp/fNsWZ66s8qMpRiYnazAW8pZS15posJWeT+Gj5FU1jHbZ/1k:sD9gp/frZ4Mnc7WeT+GFuHbdW
TLSH
T102D21A06A924C8779FC35D18B83C7E33D9EC50925285CEDA59ECCA0C029E5FDAB47867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 573588dcbae4206c0a45d3bee4e8ac0a97f0b71f67b260ced4001a3d7990a3f4
MD5 d461a9694abbf582390a3fcba047ca2d
SHA1 4844d29439b2efdd2fa166753f9a519ad08f8f06
SHA512 6caf1d162785b4988b2f5fc297060c62c142e13a1db0e574309e3cf5bbd27d511139067afdabe6a3b8d33d17e19013e4de5096b9fbd1e457427d31ad3610f969
SSDEEP 768:A3W7kHY7pLuL780Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMZa5LlWYSjRroA:A3W7kHEE780Wvqidau1jaZZa5LA3jqJW
TLSH
T18AF20A3B7C0CCB7E4F804E9CEC2A7E9A6DE8018B56D8C95487FA844C03C66EB15165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 906a81d871a71c0efb25dafec2a2e30b9280b7520e0d745c69d86be7ffced6f0
MD5 d5e32cf74aa76477712492ee1690a02b
SHA1 cafbc3eaed830d700be193eb547bb2b82b537fca
SHA512 e53cf5276f01d6d312772d0085251ca0f272282d887729ca4f77d0d6732834c82e834d17f93638e912a3af9bc2592861a0f6e577a31109c68a25daa14cfdfec4
TLSH
T16F31818A8E40D5AFEAA444F114B760E433B0C5CD032262938C3C363A3C6736A2E4B18C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf0ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5cf0ef.TMP
Size 1KB
SHA256 2a79da93bc018e47da0293cc6cde6c804601c59523df0f9c71131314314c7c6d
MD5 500cfb31ced8f2e1288250dddbb10787
SHA1 9a1ded41f7df5c9f8964de85f24ff556b1d74f37
SHA512 0672fe6cdf402f2cf5d5521c44a8f961487836e3fba7e2de7fb700712df1da1351143823ef2439fbdcc17502b4056050b7e343d4903fbec63e2c522e14a3fed7
TLSH
T18A31938A8A418A0FE8D400B20993E4B83379C9405312B387987C663DBC763BD1E9F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3c1d69f599dda538f9f9bc89345f98d535dcb8d3d38147b21ac8a6cb6dfce5dc
MD5 c6c2d4a91dbec1e24013581c2049550d
SHA1 a636cb75cc9d55679fb0bad94fbc9a0575460fa4
SHA512 7b959b4adf4cffe0652e6691a049951aa39484bcb578502d4a5f2d7a702ce919a4a0f006f85cca80bc7d8e33d000f8a7437e9ab399ef455f44e4e4787dc25a53
TLSH
T117E068BB2DFB1830AC6FC7C138B154A082953918D500EC0E3127A28730F2751240BC22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7a9cde131979df7b6bb48ac42cdd44c57778d65bd1e23f092a6d1d7f713f3dc3
MD5 595293b81b61b8c35ad6955441759f09
SHA1 bc11d53269415410a1e95711b83f5d1210956fca
SHA512 0aadaf3edfe1fb56f78958877c71af41f8fbdb786a460822a54edc8ae3f5fa3380540f67be03a1ad419024dcec36d40cb192797874fb5e941e12979e15ab9fa0
SSDEEP 96:KIbCKcWVce7KKcE2WBiKC4a+HCecEE+eUVlM++KkLMg+4m+NQOfg:sWVc5BV/lg
TLSH
T13EA1D60AB2762641383E6C88B16B85770F437293311468BF3FB854A21E67E124EFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c53118da632b0b723a4ab6e6d02e99d68f54dc95daddddf162cb2effb64e0df1
MD5 0c7309506785bc65a9cbb5ed2cf6a9f9
SHA1 53647036ed2a5a76486af2eae10d52821467e646
SHA512 2aad9c8a0d74cceea9591df2817060c247773e539aadfec46e7db29519b947028b333ea3fd2e7b2ddbbd33e44e8817546ecdaf51dcfccdd6065d1e585ab38560
SSDEEP 384:nWtNn/s3n9SfsNgXmu8bs1Ezd5L+2JPwmn15wbAjEK:Wj+9UijY2rlJPwmn12bfK
TLSH
T1AB928C326C395D375EE3A445F54636179FA881B7A3C42B58E5EC9F0D02EA39C231690A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6f5a2be76796203d4a44f2a76415bd29f2d21b26a04cad1da341793db2199d65
MD5 48590473b1e9df6b00f93c63bf85e2a5
SHA1 e9fce95aedeb6aaaee4f7252d4f43ab7140df075
SHA512 a5d31d838955ba4d049bb2af823d945739f02f0e4612f1e3d67bb37dc6c2b12ea13f50bd47c2cd482cb34b2d562554be6a2fd0891488d26b8095429d5c6d5da4
SSDEEP 384:nP9tNn/s3n9SIzsNgemu8bs1EZDfwXd5L+2kPwmn15wbAjEK:1j+9r/jYFXrlkPwmn12bfK
TLSH
T19CB24B36EC65DE27ADE392C5F606764B9EE4416742CC1AC8D9DC5F4C02D76ED130AC0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 488a9236e39018cd9c3cbbc45ee581e7066e64e29785992fa7c9b61b08cdeeff
MD5 ef838e9590d5f4e2a25a67789f93f0a9
SHA1 b6a5969abcc0d3f7ee64cb3afeb950acc5111a95
SHA512 addb311610dc449084779814ebc9964989fb12b33ac71429e77483f4b9eb59038dd9b064f362792be235ac4c2009d44778c7b1f959340e55b985c5940c4b231e
SSDEEP 192:MONT64BAQmiUy11UW5GBPKRV+FdGy5LaDOvPSU6:MONT6eACiWcd56qSU6
TLSH
T186020A356C787C7B9EB2AD45F58637175FA8117BEA816B44EAE85B0C01D764C2303427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0c82b7b87404087f7f4b0e59323d667ab7c228c9fa5deade112dfb9d3e009ad1
MD5 6e34f441a7c5ee8b05e15ed5b58fafa1
SHA1 505b6810e2058c558f308b96af553cf90f254e2a
SHA512 a7566880c38e841895c9fa132ada6f3c676d97782fc1971b12bf30a99578f69c3378db4161ecb44519e48a3eb711955daa03c538bb9ea0bb5f16be59317470bf
SSDEEP 384:n9tNn/s3n9SfsNgemu8bs1Ezd5L+2JPwmn15wbAjEK:9j+9U/jY2rlJPwmn12bfK
TLSH
T1BF929D326C395D375EE3A445F54637179FE481BBA3C42B58E5EC9F0D02EA39C231690A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 39c3e94b827d493f78c6ed31a144b05ca6700dc0ef2d7a2b664b1181cb0008e3
MD5 3a370484a01bfdff8bac9d7f4d349c74
SHA1 c9552bc0bab851474807ed99d77d49774c851bc8
SHA512 abd33fa3d19f9b70eb45e3dc8ae07917d19293ad1173486faea2769b0c07a5bf5039309facde05f1def34ee44bd186eeeb1fbb25311e095dd770fe46e89a3e49
SSDEEP 192:QONB64BfQmiUyQUE5GBPKRV+FdGy5gk+2qWwwqhwU6:QONB6ehOEcd5L+2oPwU6
TLSH
T10D122B366C78AC3B5EA2B541F48737135EA4423BEBC96B54E6EC6B0C02DF65C6307416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c42b1f0-36b4-4acf-8355-a8f6fa7b2bdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5c42b1f0-36b4-4acf-8355-a8f6fa7b2bdb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f956e56b31944a7288553531c6c669156b18567e5920983ac91ec0e3ec8400e2
MD5 6ba1c5f46ab1d6d74f206b3443316730
SHA1 e3a179d14ecee4f77a88a83e6052ed19f7294166
SHA512 a1a7f6a15ebc48c479d5d931976b7928a476647ede181ac6b3bd95e94ce99fa56f192828ef0c97925f0c11c674bfc10face0d24e7811a7c4dc8b04db885b5fa4
TLSH
T156410A58A6FE1148B3B76E16AFF6A96D447F79772F0AD45E10010E4F0A63B00C962737
MD5 SHA1 SHA512 TLSH

Submit Download

58ae9c01-02dc-410a-8497-fec156aa03ce.tmp

Path C:\Users\Admin\AppData\Local\Temp\58ae9c01-02dc-410a-8497-fec156aa03ce.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82beff12-0699-4e62-bc7f-e45780f3e759.tmp

Path C:\Users\Admin\AppData\Local\Temp\82beff12-0699-4e62-bc7f-e45780f3e759.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f71af376-d8a5-4076-b74b-d0dd89e3e751.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5068_364442684\f71af376-d8a5-4076-b74b-d0dd89e3e751.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5068_55660296\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download