b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
897s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (11).bat
Size 44B
Sample260627-rf46aabs2s
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2160	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270429726213123"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{F3B1D604-4B3F-494A-91AC-1B138CE3C3CA}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1072	2316	cmd.exe	85
PID 1072 wrote to memory of 2264	1072	msedge.exe	87
PID 2264 wrote to memory of 1968	2264	msedge.exe	88
PID 2264 wrote to memory of 2160	2264	msedge.exe	89
PID 2264 wrote to memory of 1916	2264	msedge.exe	90
PID 2264 wrote to memory of 1916	2264	msedge.exe	90
PID 2264 wrote to memory of 1916	2264	msedge.exe	90
PID 2264 wrote to memory of 3456	2264	msedge.exe	92
PID 2264 wrote to memory of 3456	2264	msedge.exe	92
PID 2264 wrote to memory of 2368	2264	msedge.exe	93
PID 2264 wrote to memory of 2396	2264	msedge.exe	94
PID 2264 wrote to memory of 2368	2264	msedge.exe	93
PID 2264 wrote to memory of 2368	2264	msedge.exe	93
PID 2264 wrote to memory of 2396	2264	msedge.exe	94
PID 2264 wrote to memory of 2396	2264	msedge.exe	94
PID 2264 wrote to memory of 2776	2264	msedge.exe	95
PID 2264 wrote to memory of 2776	2264	msedge.exe	95
PID 2264 wrote to memory of 2776	2264	msedge.exe	95
PID 2264 wrote to memory of 3324	2264	msedge.exe	96
PID 2264 wrote to memory of 3324	2264	msedge.exe	96
PID 2264 wrote to memory of 3324	2264	msedge.exe	96
PID 2264 wrote to memory of 2228	2264	msedge.exe	99
PID 2264 wrote to memory of 2228	2264	msedge.exe	99
PID 2264 wrote to memory of 1800	2264	msedge.exe	100
PID 2264 wrote to memory of 1800	2264	msedge.exe	100
PID 2264 wrote to memory of 384	2264	msedge.exe	102
PID 2264 wrote to memory of 384	2264	msedge.exe	102
PID 2264 wrote to memory of 384	2264	msedge.exe	102
PID 2264 wrote to memory of 3184	2264	msedge.exe	103
PID 2264 wrote to memory of 3588	2264	msedge.exe	104
PID 2264 wrote to memory of 3184	2264	msedge.exe	103
PID 2264 wrote to memory of 3588	2264	msedge.exe	104
PID 2264 wrote to memory of 3036	2264	msedge.exe	107
PID 2264 wrote to memory of 1304	2264	msedge.exe	108
PID 2264 wrote to memory of 1304	2264	msedge.exe	108
PID 2264 wrote to memory of 5000	2264	msedge.exe	109
PID 2264 wrote to memory of 5000	2264	msedge.exe	109
PID 2264 wrote to memory of 5012	2264	msedge.exe	110
PID 2264 wrote to memory of 4920	2264	msedge.exe	111
PID 2264 wrote to memory of 5012	2264	msedge.exe	110
PID 2264 wrote to memory of 4920	2264	msedge.exe	111
PID 2264 wrote to memory of 1372	2264	msedge.exe	112
PID 2264 wrote to memory of 1372	2264	msedge.exe	112
PID 2264 wrote to memory of 3544	2264	msedge.exe	113
PID 2264 wrote to memory of 1816	2264	msedge.exe	114
PID 2264 wrote to memory of 3316	2264	msedge.exe	115
PID 2264 wrote to memory of 3036	2264	msedge.exe	118
PID 2264 wrote to memory of 3036	2264	msedge.exe	118
PID 2264 wrote to memory of 1288	2264	msedge.exe	122
PID 2264 wrote to memory of 3168	2264	msedge.exe	126
PID 2264 wrote to memory of 4248	2264	msedge.exe	127
PID 2264 wrote to memory of 3168	2264	msedge.exe	126
PID 2264 wrote to memory of 4248	2264	msedge.exe	127
PID 2264 wrote to memory of 4568	2264	msedge.exe	128
PID 2264 wrote to memory of 4568	2264	msedge.exe	128
PID 2264 wrote to memory of 2688	2264	msedge.exe	134
PID 2264 wrote to memory of 2688	2264	msedge.exe	134
PID 2264 wrote to memory of 1208	2264	msedge.exe	135
PID 2264 wrote to memory of 1208	2264	msedge.exe	135
PID 2264 wrote to memory of 3304	2264	msedge.exe	136
PID 2264 wrote to memory of 3304	2264	msedge.exe	136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (11).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffa4b72c188,0x7ffa4b72c194,0x7ffa4b72c1a0
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,14168010064006138840,16139635227687854433,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      System Time Discovery
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,16546677601325899635,6611445257710960459,262144 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,54978619094545240,5664543830810774272,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7106353876968765173,16525216248549736219,2097152 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15403819824963957507,17753627461128915329,2097152 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,9339181112390010910,15640897177384060204,2097152 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,14092647758453833309,3268252797316417846,2097152 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,723665123853446183,14435735782560956794,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,10607223683450925156,9629573908580779562,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5332,i,10363723023846481060,10883093973714475198,2097152 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      PID:384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,3258807310730750123,11465025249537193442,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,11087782663167829033,12409151113735240652,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1615834216819422235,16003679926266625995,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1615834216819422235,16003679926266625995,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16200314410920057250,17860568808717423835,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,13855718974448033764,5247311280802999113,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,632609881457181856,6612735955127665387,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,7200940271002445151,11498354599611224710,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,12928225843272805620,9201945856415566075,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,13761267459710579110,5464499285613043521,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,10802138326714282887,12615126979243578010,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14439256217472023414,837625373863187031,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,15478766770811490274,14517945187328926497,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6736,i,17064614365820165139,581416658396381792,262144 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,13159729182600035083,15829100161383241280,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,17021943427403769155,5214904984862414579,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,6460282458603878574,15658870239516066954,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,5335996287822016821,3006140921103290147,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,5432297587524602958,6080440710599130483,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,1901068247265261075,4281055247670713119,524288 --field-trial-handle=2284,i,5389261075479122339,11854967181275621206,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
      4⤵
      PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0c3fdac4e24f8f82dcd56ce87525186752238d147a74e6a3092e3b7815b5789d
MD5 0d63678d468db02d2ccc6e450c0f4a22
SHA1 cb2e2e4e0910d45d13821c807c33ba215b98a1de
SHA512 4c5c0e8d3fab1460760bdcaafe4429dd64174f5ec1ad20a098ddf50bdc8db239207dfeaf8f26218293a72aee7532290b007eab80d7a0f92706a590d656785c4d
TLSH
T14CE080D545C9F75FF105644B415D574C8290770FF6C56E4D2B04C4557143554F2D5550
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d7f743a610b012fbbb10ebfdb5f91bc5cdfeb0bfdaf9bb511ec7cbefddc332e7
MD5 75f27171226c64cd37efc05736fab19c
SHA1 b5276e855765d51aa03a41fb9def09efbf4835a0
SHA512 8609a12c8210530a0d139f795a7f4d638ea83ff63025e09059a7afa5c88708ea397f3d0558c3808d1c1026d25abd4319c299c3b822d2a343239c9f70d326a322
TLSH
T198E020DD9286F3E605F6D44A80FCE3144261FE8FE18D56DF7704668C1A83201D3D58D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 fdbbbbbd89d7aef112786e87439b03bab37259076ab2edd70851d81e98dcf72d
MD5 50ae9265b391c34ead71ae1f06e84f9c
SHA1 7966624c12f6eb08349cb5b6ab2cf18ac5dd3049
SHA512 8e3db7fd533617e13e21a8966ba53f8a15648c9e19974560b1f5e6704d76477dee38a28cf9ccb4b9a32930c3ee05ec4687c7be60c5620364e19942a4f3f7e140
TLSH
T124E0D1DBD1D0F396814895C751BCB21C533AB28BD5CD855E3704714C699B2004F9544D
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 d8ec3c3baae8286bce03ec5a8799756fb085187618db1fa0de70d167c7aca850
MD5 b632867adb89ee2896ed5db80c6836fe
SHA1 1d0a79c98897d7595df65c626dc9c144bb7eb02a
SHA512 950cb32bca128056a24320f80d0caa9693a30d03c92d0c5228a249a90b3e1e0308a7dc3f02e3a83da1fc838f9bc1b81a7097902ed0fac48fc167f3e52e949bde
TLSH
T11ED02BE8B8DC6C4FD3E01AFD5B62B0400F5057D24426DF020211F8C13766AF01F66035
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0bffefd6b614b9098c22bc798e026f60a71f412bb36f6cee233aba68a6e5fc0f
MD5 2dc8b9d084c8fdb410792a3d44f705bd
SHA1 bbfdf8691078c921c65e9808c1f9678d6b3fef85
SHA512 68632c13244078bba56f87b585650335a82910e0d5f0ec2352a479175105d89dad0f36dbb823d5d6ac5fea722e229e5b7c34a9c265e94485e1eefb184e409d90
TLSH
T18771E7350821B8A0F3800F3A70DA0557FD7AC9D8F7478E97906ED9B81627B65523E2CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588ad6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588ad6.TMP
Size 3KB
SHA256 3aff7256f0517b8326ca644a4e09cd2a386727f54c00fbe0350f4c2191b2c13f
MD5 db0b6cf6eba01292881d7c44aef0c231
SHA1 8c252aac29a8425adb29436863579e8d7c5cf679
SHA512 7ed5b42e3f9b68a3a9f3cfd8948b90fbc942e47862dcd7b90a473bcc06828a8562422db975610d5e32f2a2b46d2224228e547a581afeaf3c18f71ba7e9ff74ed
TLSH
T14071E7350921B891F3901F3A70E64557FC7AC9D8F7578E9790AEC9B86927B60413E2CC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f92519caead848a3c4af4cb2e8c8bd9f3283ab472324b7fcfbac9aec2990255b
MD5 2946299b0a844e15c0959d60f367daf6
SHA1 97c891cdcc73abe1d0139e619ecfdffc7234fd56
SHA512 cba2ce1e1c526c20ac0bfd685cadf65bafab0380ce5a55d538492569ee72ef7acc6c07b4487220860db9bf4f60d79422f9dc8e161d7ec6dc1d4ebb880e94e33d
TLSH
T10471ADF783B08A6ECA0195F0AA146F1BCE590524937C786685E4FF47A3E3472E241B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f2c403dcbbc91bdca0a3f517cdefe9e308797d06c68e4b283836217fb7e05dbe
MD5 062735a7d25dfed43ada37542b06fc94
SHA1 ea56f8aac9eb9316e587de8f386e9622b0b6c9e5
SHA512 eaefe67bfece63fdb99a60efb0b6adcc57e0fd3236b4a221ed644983a050e6fe8e95644ab7f557465e411fc8c788cac4bedb98f48bfd66f51eb80306eb512df3
TLSH
T114718BF783E48A2EC90156F0AA246E1BCE590624937C7C5A85E4FF47A3E2472E24564F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 063a2248812d5af4ffbdbe3031444db02954927157a3369f7858b77b1ff942bc
MD5 b0f73e0ff9d4e634ed9aeb5d718251d1
SHA1 af878a3932063aa86ce35ca5c915406b0038f334
SHA512 2c02a82aff3b0fcb68f05fc93a9fd5e51e128b07025b4803c9499c6851fbd3fe003777998acf3e5f74e98d02203247acb8dca55d0e1da65c77a8b4a7272692d8
SSDEEP 192:sxZ+R+yM/jK1Ml8MiT/fTssSHyG/dIdpYWHW6+WNLtC/YCxOrftIg4J:sxZ+wqT/fTssSb/eTHbc/mpc
TLSH
T16E52F812BA349977CCDBD219FA11BF63D6F51572A2900D449AFCCA0C05E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5597070d16b1ff7c29de7bbc259edf076d096dc167b6715b4153aaa7087c1d32
MD5 ede8453c0d6ad6237ec10567b5a13904
SHA1 309c0409a5d42ba5a6cd4553a9c9fd6b113005de
SHA512 399b82632833066fff5338ac4ef215ae1c35e54935f9188a573f5ac41690ac96962715b772e718d7490847bce85db02619be411833c19c5dd13b37512131af3a
SSDEEP 192:sxZ+R+yM/jK1Ml8UQxiT/fTs8pHyG/dIdp+WHW6+WNLtC/YCOjrftIg5AJ:sxZ+wqoT/fTs8pb/exHbc/4pG
TLSH
T14352E712BA349977CCDBD219BA117F63D6F554A292900D449AFCCB0C02E6BED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 876077731581fa5fb4106c05da4e8f7d6fe2612d8f8f7acefe2bcf81b71563e8
MD5 bae3a6a2c62226ac28d026ef9024b2ea
SHA1 be7a2b4cdbda829fae9c1d6c9afc169e2d2d019c
SHA512 708222e32dba278659310ad16a5d9f46ee31456c56dd1d52545d0c08a2d0d91bc823ac3c9c1b3a68430bcca4884fb0aa0c72cba941ccf4cc81f0a6c2cae134df
SSDEEP 384:sxZ+FqoT/fTs8x66s8qMpRiYnazAW8pZS15posJWeT+7b/exHbc/4TG:smUoT/f3x4Mnc7WeT+7LQHbe4a
TLSH
T1EED20905A924C877CEC35D18B43D7E33D9EC50925285CEDA5AECCA0C02AD5FDAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2e1a4340d5440b64f0a9932f41b92d98a03bd0a15b784dd5e7a2bea4ee479f93
MD5 fe3f4a03649d27edb4165ddac1395022
SHA1 0ac3e960e5e54cb58f1c0288ab6c8e8808fc1cd9
SHA512 b48f5da0ee7897079c8b734cb80acfe105ef4fce10d442f74aa05f473cde12a2f9371e960d11f41c34d6ff9bc636acf45b681f034aae2738a3af4bbe80a3c5cd
SSDEEP 768:r08bq2h7pLuL7a+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnbCZLlRTKV8roa:r08bq2XE7a+WvSCt6u1jaibCZLbWVna
TLSH
T183F2FB3B2C0CCB7E4F804E9CED2A6F9A6DE8018B5698C95447FA844C03C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 648B
SHA256 b82de4f41dbb181dcca3fff84bc717f27476d9e23809dcc17e10d11d6604fec8
MD5 31bda33a2a6010b811997f9c8785c4a8
SHA1 cafc07e37686441e65e4fab3ed84d0da914e41bd
SHA512 052546601fcb05675feed3983a40bde85c2c9a16bc1874cdf96b421be54448a0fba9ab0228c37acfcf209e4aea09b81453e75121ebdbef5862ab0538e0edcca8
TLSH
T1ECF05C0A1FE08927EEA14DB320F520B073B0CEEC7722C4A7002C232B2C3A308A0432DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cbb39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5cbb39.TMP
Size 648B
SHA256 a31aa2ff2b289368e8fc2da69ac21bc852d22a3ec7be3c156f68e72c4ab02c96
MD5 a80459fe61cd13ccaa9028a49490f2eb
SHA1 d623517c3963600f44f7063b8a3c4805b711ce3d
SHA512 178763a5911ed7ad70bc5fdd3ef04464a7d423b9ddd1f3e54498acd303d8f1b365262cdb966f86874f8a40932f676033f73a12856adb31dd344fbf047be5486c
TLSH
T137F0239A87E2996BE89009B718E550F5B330CD003372E49390A96A3F1C3638895030D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 faa00797e6b1b782b0398186a911a20e17a47be3de32ac218d64e5d02da872e4
MD5 8e650af26bb01d639132cca911135541
SHA1 9e703ada4d3e376fc4ad64e5b7da550c550b6c57
SHA512 43ca380e25523139ffa1d93d8aa9625112f7fd58f01a3faa4405160aab192aa8a062b9f323e2dc4f898b1b4eccbb8bb8e3ce6664df9434fa2732321ae9e2ecda
TLSH
T19FE020FA2DF72860BC7BE3F524B048E002597998CD86BC9F1469A1D750F33653856C61
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5910b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5910b0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5dd745ca6175dc911382c2fd8c6a1120cc3f7bcd58705d195b64897a1cb27bca
MD5 2ae8a4f207688dc77c3c6b055d54d23a
SHA1 8c847103e8550b47acb9c65eb814349e474d52bc
SHA512 6ebd39a797188253e964b998a3c20a5aee497a9f68a45b4b2531de53d864028a37b1bee958bb662f0d27745cdbc08ce133847fe8e040f04a2c6c9f2f80523e81
SSDEEP 384:nQtNn/s3n9SfsNbvNW3a4Ea+lOy+HVYo54Wmn15wbAjEB:Qj+9UEba8Oy+V6Wmn12bfB
TLSH
T17F928D32AD385C731DE39589F84B32179FE851ABD6892A94D5EC5F0C02DB39C131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2a4b00a19edd50982586b3c3ff04b423f0b94c3a7e4fd3860bbd47ba5209295e
MD5 8f605652e6a9628591f755223aab8124
SHA1 c8f0bbb378088cc4187e47a082673a4b5b43239c
SHA512 9704ef772bc73d07287a82c3fa784e7d65309ff9856ca796f329833bf307f7a0cc7361470481ab3f7c2f2ced153b43c6b303e09f1a479b7a7d9cd8fce4951e99
SSDEEP 384:ngviF1tNn/s3n9SczsNl8TUNTUlIlyNW3a4aDfYxa+lOy+HVYo5yJWmn15wbAjEB:g6F1j+9nswgoAxa8Oy+VkJWmn12bfB
TLSH
T1BDB22A36E868CE3BADE387C5FA0B3657DEE041A7868969D4D9DC5E4C01D72DC030AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 52008406cb3e502e0c960e91018150af8a754c33038ccac1343761c646e6804e
MD5 70a7ff8eebc8f39134faf5c66924dcc7
SHA1 ff37b94194a27e7dafdb1b200518af911f3c8669
SHA512 4ee7844d671eea53e97cf3105fc30a7e776f5dd545b7d22891f7a7df6e926fd789c1564108445094aee605e9a826b59b8095fe139e57efe531dbb0753b577c33
SSDEEP 192:vONf6Db6QmiUyOazHBa+jpOmN+BRgaRrU6:vONf6u2HBa+lOy+IsrU6
TLSH
T15602E73968385CBB9EE26E49F88737279FD4203BD9566B94DAD81F0C00D765C234B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 31d0137f8465f0f3912b287e9743fbabeb203b5e696e8ea5eeabfb21eb96d5f6
MD5 6f6d2861cec6db8dcfce6aecb57ddb20
SHA1 f4bb9c80bbad28445f269b44f1a8c4b6f9523530
SHA512 ad2b714f9e9c82c454c7151d5e6dac0c305dd47f46321b988f60077fd5674212687d4ea216a6ff41969cf9616e9b81aff9b45e94a018f17ac10a999c07b7f0bb
SSDEEP 384:ndtNn/s3n9SfsNbyNW3a4Ea+lOy+HVYo54Wmn15wbAjEB:dj+9U9ba8Oy+V6Wmn12bfB
TLSH
T172927D32AD384C735DE39589F84B32179FE451ABD6892A94D5EC9F0C02DB39C131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4b40372c4a672f4ad3e8686a608230edc6759ff491f153cba43920bfe8fe2649
MD5 6e4555226df8894258a065ec4d665661
SHA1 b847528a8bdf94d993ee7edeca55dbe1a77987ea
SHA512 4c732cbbd36e78163c585df5243a1e83bed28573e369840e17db2f46db83c6437e0b6a325df57b3b80e37f0e01fb9b54a07dd924e86feafadadac532c2dde867
SSDEEP 192:YONe6Db3QmiUytAazIBa+jpOmN+HVPPwo5sNzydqCU6:YONe6h6JIBa+lOy+HVYo5sWU6
TLSH
T14312183679389C775DE26585F88736239EE81127DA8A7B90D6DC1F0C01EF69C134E82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8f1f2cf-95fa-46ed-86f1-009aa9dbf9ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f8f1f2cf-95fa-46ed-86f1-009aa9dbf9ff.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 649aad7a6cb1eaf2952d6949499ec7219773ee00a29e8cf61dd273e462d492fd
MD5 d153bf48c1a5a9bcdc7a35f289759283
SHA1 ae86370740e2d451fc592f5a03f161dbcba7cbae
SHA512 d542a328824bb456e8d9f8811f7fe1659a20436839e74c08cf9f5a5e45adedd97f3144d68fb3b569f0f5048437a8c08bc54285dae8480ebd5def3a804faba6a9
TLSH
T1D8415858B6FA1155B3B36F5A9BF7A86E447E7D372E0AE45D00110E4E0B22B40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

64017949-18a1-4940-ba0e-5f21cce34730.tmp

Path C:\Users\Admin\AppData\Local\Temp\64017949-18a1-4940-ba0e-5f21cce34730.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

fafc4518-64d1-4430-9381-a48d0d86d729.tmp

Path C:\Users\Admin\AppData\Local\Temp\fafc4518-64d1-4430-9381-a48d0d86d729.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2264_1207668186\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2264_1207668186\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

29a94cf5-ab27-4958-bad1-37bdebe3f142.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2264_1564875829\29a94cf5-ab27-4958-bad1-37bdebe3f142.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download