b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
900s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (14).bat
Size 44B
Sample260627-rf46aabs2s
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270429721558450"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{96198DA1-161E-429E-AE1C-BE0079B46743}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
756	msedge.exe
756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 3168	3696	cmd.exe	86
PID 3168 wrote to memory of 1084	3168	msedge.exe	88
PID 1084 wrote to memory of 3848	1084	msedge.exe	89
PID 1084 wrote to memory of 1556	1084	msedge.exe	90
PID 1084 wrote to memory of 332	1084	msedge.exe	91
PID 1084 wrote to memory of 332	1084	msedge.exe	91
PID 1084 wrote to memory of 332	1084	msedge.exe	91
PID 1084 wrote to memory of 1312	1084	msedge.exe	92
PID 1084 wrote to memory of 1312	1084	msedge.exe	92
PID 1084 wrote to memory of 3632	1084	msedge.exe	94
PID 1084 wrote to memory of 3632	1084	msedge.exe	94
PID 1084 wrote to memory of 3632	1084	msedge.exe	94
PID 1084 wrote to memory of 3612	1084	msedge.exe	95
PID 1084 wrote to memory of 3612	1084	msedge.exe	95
PID 1084 wrote to memory of 3612	1084	msedge.exe	95
PID 1084 wrote to memory of 3428	1084	msedge.exe	96
PID 1084 wrote to memory of 3428	1084	msedge.exe	96
PID 1084 wrote to memory of 3428	1084	msedge.exe	96
PID 1084 wrote to memory of 3100	1084	msedge.exe	97
PID 1084 wrote to memory of 3100	1084	msedge.exe	97
PID 1084 wrote to memory of 3100	1084	msedge.exe	97
PID 1084 wrote to memory of 3812	1084	msedge.exe	100
PID 1084 wrote to memory of 3812	1084	msedge.exe	100
PID 1084 wrote to memory of 3628	1084	msedge.exe	101
PID 1084 wrote to memory of 3628	1084	msedge.exe	101
PID 1084 wrote to memory of 3412	1084	msedge.exe	104
PID 1084 wrote to memory of 3412	1084	msedge.exe	104
PID 1084 wrote to memory of 2800	1084	msedge.exe	103
PID 1084 wrote to memory of 2800	1084	msedge.exe	103
PID 1084 wrote to memory of 4264	1084	msedge.exe	105
PID 1084 wrote to memory of 4264	1084	msedge.exe	105
PID 1084 wrote to memory of 4264	1084	msedge.exe	105
PID 1084 wrote to memory of 4460	1084	msedge.exe	107
PID 1084 wrote to memory of 4680	1084	msedge.exe	108
PID 1084 wrote to memory of 4680	1084	msedge.exe	108
PID 1084 wrote to memory of 3592	1084	msedge.exe	109
PID 1084 wrote to memory of 3592	1084	msedge.exe	109
PID 1084 wrote to memory of 1840	1084	msedge.exe	110
PID 1084 wrote to memory of 1840	1084	msedge.exe	110
PID 1084 wrote to memory of 2720	1084	msedge.exe	111
PID 1084 wrote to memory of 2720	1084	msedge.exe	111
PID 1084 wrote to memory of 3436	1084	msedge.exe	112
PID 1084 wrote to memory of 3436	1084	msedge.exe	112
PID 1084 wrote to memory of 4940	1084	msedge.exe	114
PID 1084 wrote to memory of 2312	1084	msedge.exe	115
PID 1084 wrote to memory of 2772	1084	msedge.exe	116
PID 1084 wrote to memory of 1480	1084	msedge.exe	119
PID 1084 wrote to memory of 1480	1084	msedge.exe	119
PID 1084 wrote to memory of 756	1084	msedge.exe	123
PID 1084 wrote to memory of 2016	1084	msedge.exe	126
PID 1084 wrote to memory of 2016	1084	msedge.exe	126
PID 1084 wrote to memory of 3344	1084	msedge.exe	127
PID 1084 wrote to memory of 3344	1084	msedge.exe	127
PID 1084 wrote to memory of 1180	1084	msedge.exe	128
PID 1084 wrote to memory of 1180	1084	msedge.exe	128
PID 1084 wrote to memory of 1968	1084	msedge.exe	134
PID 1084 wrote to memory of 1968	1084	msedge.exe	134
PID 1084 wrote to memory of 4472	1084	msedge.exe	135
PID 1084 wrote to memory of 4472	1084	msedge.exe	135
PID 1084 wrote to memory of 2988	1084	msedge.exe	137
PID 1084 wrote to memory of 2988	1084	msedge.exe	137

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (14).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffb4f7ac188,0x7ffb4f7ac194,0x7ffb4f7ac1a0
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,14535344583089202225,10507534190569089915,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
      4⤵
      System Time Discovery
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,12078339144902182190,1363027765739683671,262144 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
      4⤵
      PID:332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,8178531414786009078,14524148578088816603,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,1704385771109266066,8108025135904246489,2097152 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,1754372757034674509,3031210192143818244,2097152 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,1684037903612184694,6618704127376987505,2097152 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,4202717827776349178,3078183689476565260,2097152 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:2
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,1808591506863372523,17350873234144374801,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,15111042376404845005,14859914845989202952,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14928369792314531811,7355706348588038720,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9751106478095857552,6545210078736096896,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5632,i,17921539634976902190,1252810768372069022,2097152 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,17961943429703444284,9236570166473443054,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,17961943429703444284,9236570166473443054,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,14568923827271464680,7531573941694623160,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,3986820082078275941,5392376123081836734,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,6628998769272078032,16016982223589942675,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,8411418660174888595,17887317487843666847,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,4417535466073246919,2225689699102816337,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,9558795737047096999,2809773768244911208,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,2276622384920981517,5826366452744894905,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,2709025911046865883,3893141162636293183,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,17750952055834415759,10893859228769140482,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,10117358245467118421,7911854968450008387,262144 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7420673598122175560,9592038427537527873,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,3359179388359134512,8717185686691094051,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,17696113219401833768,1179171205350061592,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,356144677146165142,12632042555449213684,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:8
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,2460147912942855273,5494716231782016847,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,17774652152028089994,3432460929431730282,524288 --field-trial-handle=1984,i,10620348395315611018,4433908390794731226,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
      4⤵
      PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f76d63ff2e2350f73533bb23032e7f6b55f9f70556362a07ac81b2024b72117b
MD5 5e4c8f2c8b122ff98e125ff70a5a753e
SHA1 ea144cf70795d6fabf3de9a0d55de8cab54b5d86
SHA512 7f755b2958357440c9ce8583cfda0cc73d7f097fab62233bf9778b6db55493b98e0034687e686957edca04883a9c0b11257eb8f1e165c4da466133180e656b11
TLSH
T159E026C587CAF32FB2047447416D5B4DC2E0371FA3C96E4F2B0084947203E40A6C76D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 eb82ec0b0c40b17d3e7ebb35d0116d41268cd70a593f0111f59e0423bc3f3ae2
MD5 e381e1a2a4640e55a5b72895195eee3f
SHA1 e7e62a76572da91a77d9c971650f35f8a8850600
SHA512 b1c1da044843b741337880c6802fe3563b54fdc8919ef93f3d36ff5bae32f3b17e80826aef04418e66423b726b85f2b92c5c6247b352ccaa995f3b89fe92e8f9
TLSH
T126E0D89DC292F2B70150A68A84FCE2154234E28FD1997E5F3304B34C25435C063D54C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 e1a1bd1f3566d5a2e36006569f6c247e4fd2592f3f633a29a1d6dfa2a6f928f4
MD5 fc7a2d3531e1d4586ad1c891874a7d8f
SHA1 cef85b152c1a840e1f03346c8b1ea826a0102405
SHA512 cb57366d8ec89d8a46975f7215e327f641f59a1a186b4ea311b6af0360e772dad182de910295ca64d61d25953b4d5711eea3a84e07abafeaa0e51ee5809dcf41
TLSH
T146E0D8EEC2B0F3A6814A954790ACE314476DE68FA58DA69E3B04A28C2D631504F8448C
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 c39ed4dc1e0dd5270e05fd128a275effd56a2bfb04521b4438b1103b61b992f1
MD5 06ebfdd9fe152db487b4e0ea2b25e475
SHA1 7de7f120795e976af70aae3198a32425045d8650
SHA512 751ea8ba698f45f4e81de6eec3da57fba615d24855b1be9faabb6248d2dc901c3c799c8a09022388ef4638a63528aae2bf1aa9eddba83f0503506560593fe943
TLSH
T1B2D0C2F8A88C688FD3E52AFD8362B0400F5442D29416DE064129F98136959F01F52070
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5bbf780ca808fd52a50ccb823d5e04a5a554ece3d100c79e2b1b782dc0b2f125
MD5 f49f75bca6e205ebed20351ce476f36a
SHA1 2148d8cf0ab445041b3dba7e178479aea50350d8
SHA512 a89e9f45e5a34cb3c36e139727e23207f260e1799a3a5ea8c1e4ec07f18d6ac387f3338d5bbf03b4fdce44f24fee27f806d8c6df8f0fae899daa288d2b1702ca
TLSH
T13D71910B06593E95EFDB1170F3EC060C3AF283F50E536EA60D6CD87D662AB2B4295308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591fc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591fc3.TMP
Size 3KB
SHA256 86c2af9dccb168501b5c280be1ae57a4a52046fd6a97e99163860565c76bccee
MD5 2dc69db284d53fdf288827c90785542e
SHA1 c992b1bf52b7d2c450e1f9c142bfd564329aba52
SHA512 ee481a502dbc0fc6ae8a3940dbb0609b201a3777a2559736d34212a948988fc1a78556b69dddb278c81151074fb3be1cb65bbb5771839fd3508788234c3b3b9a
TLSH
T15471A20B06693E95EFE71070F3EC420D38F283F94D636E661DACC87D652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 dbe8acec0ecfe24477ecbc66cfdff5852bbecdc93b92c0e03196e5ecb18f8381
MD5 d73c9ee728b88fbeb9b5c53cba5ee938
SHA1 db5ff6246c1b724b25e1489b4e544bd7f304ee86
SHA512 66e23402ac0e626c1e9c411852d946c5c13cca2f8998c2facfdbae6c9ed2ecb45d69d1d6ffa97b116db6a61703d67b5084731d37e35936b9a86a52fba673d156
TLSH
T1EF71ACF783E4862EC91156F0AB146E2BCE590628937C7C5A85E4FF47A3E2472E24164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ed2c15a03f518fb85f79d76b41f7748c509ba6167cb2c799afebcaf4df84164a
MD5 f8a9f48721565c523f578e37060ac013
SHA1 6600a81383dc9f7d21cb13ce750de73aace3d9d8
SHA512 5e651f02fa7db59a326ee30ab0081118ba3af9b27498f579274ed9faa422e5edabde95a93310de53b1a07c84689bcb558390af563fef61519ed69531637a3735
TLSH
T12071BCFB83B0866EC90195F0AA146E2BCE590124937C786685E4FF47A3E3072E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9e45516a8a9540d03091bfd4215fc5d8f0144c231940fe222c088c06cf39353a
MD5 b01eee61565d7fe3c42401a792253d2e
SHA1 145239b979d15c3864698baf531b7617dc91ef54
SHA512 06be9bc7289f78a74185c373cc1224e4ce229dae6219ee768fbd7f500c3d743fa8821e1df4852aaede2afc3e0864eeff25ddcb58e6a941d730c63f2d8f9ededc
SSDEEP 192:sxZARryM/jK1Ml8MiqJ/f+sJBY/HRaIdpYIHW6+WNLqmGZ/Y4EAA5sUIg4J:sxZAfqqJ/f+sJB8ZhHbY/mfc
TLSH
T17E52F916AE349977CCDBD209FA54BB53D6F51563A2900D48A9FC8A0C05E6BED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 333413eace6e2b4c587121a4f512293137593c3a51ab90add73d59e09642921d
MD5 67f0ec2a5c8b44ba6162195a3c77cf81
SHA1 5775e367ea112200ab84c1e04a1c087becd0e15b
SHA512 cfde705d846dad4a34bb61400c73c4ab2dd6a22bc67ba016378ea1b6ec3780f6b6f5425fe82c55524349e06834b60265d008d7df02e8bc4973922d13e9cc4784
SSDEEP 192:sxZARryM/jK1Ml8UQeiqJ/f+s+Bb/HRaIdp+IHW6+WNLqmGZ/Y4E8AWsUIg5SJ:sxZAfqnqJ/f+s+BjZPHbY/uAk
TLSH
T1CE52F812AE345977CCDBD209FA50BB53D6F5546292900E48A9FC8A0C06E7BED224782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 ba65e3de52d928746a3f74defa0622d1ea923eec1269cd6f84da466152822c36
MD5 4ed9cfacd35464005e2c44f7adffa03d
SHA1 6e7acb3cc1cddc93514e0197f1a5341666d0ac4a
SHA512 51583e91e65400c27da62f645349c5704fd8791cd30787d0d64e1a485d6f5f05186f6f39491467dbbe78d9ade4ac950128b4d390bc13734d9e8c43f74a51f990
SSDEEP 384:sxZA4qnqJ/f+s+Bx66s8qMpRiYnazAW8pZS15posJWeT+3ZPHbY/ulk:sYfnA/f0Bx4Mnc7WeT+3hHbKH
TLSH
T12AD20905A924C8779EC39D19B47C7E33D9EC50925285CEDA19ECCE0C029E5FDAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 01f7b03b6131cd099c3ca7d5b60982a6ac414856ba504dcd2618ac1e256d36f6
MD5 b23d2b3d66adaa98ea5e619f6a08e93a
SHA1 055458f46d787398f39da0fa6c6419a1c6ab5e9a
SHA512 98b9dcfb21cb05eed55fff3a3b9bdbda234782821dbee288758cd875493eb5874079d479b10cd3e36a65392a0afd92fa682681c9a90809f22a1e25398be27b2f
SSDEEP 768:8a8iJNu7pLuL7xNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3iQALl6opdjroC:8a8iJNuE7xNWvx76ru1jayiQALocdQuN
TLSH
T1A1F2FA3B6C0CCB7E4F804E9CEC2A6E9A6DE801CF5AD8895447FA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5810cb146fe2215f75cc9164368fbe942e3f8c72eb4d084e66a496225acd2967
MD5 1bee53f250b36b4371b08389442cee38
SHA1 78f4c56eb28cfbeb2f935cbe365a9990990f51e5
SHA512 3931d3c9eb52d3b323defc5ff7d8f0264c3c076737510daa2d26728ab2e92989eef834dfc48f039d86c2c6482836b9414e9f04b9a1df131725c51fecc7cbbc58
TLSH
T189E0C0F72EE72844FEBF63E10470A8B00641B859D585BC9F1417EB8324613533406C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d542c37164bfa634ef62dac379bb167f09ad360803e4c2757880cf57e79cb9c8
MD5 c5816e08bcdccdd984e5ac340cba7c3a
SHA1 eba7b556ba01a68f68897851b139df5bf0e8479b
SHA512 22bcf67571781f3d2ac597a29265d097ce2ff7c6ff40a77c7df7b6ea627787b10f18f973ad67022c017bdb6608c1bd52d30cef027252fbd8e5572192ac92a355
SSDEEP 96:KEIgK9WK6A4KBGCwQKl+EgDc3jRKHWKcUd:azbG9gDc3jRlw
TLSH
T19DB1531236BF1302383F2A0CD296961B468171A7319DBD3B3BA951F24E67E150DFCAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dc53a33-fff7-4259-a248-2f7c10fe140e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2dc53a33-fff7-4259-a248-2f7c10fe140e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5ec1839e53c2ac26716c42678174a92998a71d7ad365df6ec6171df808232cf9
MD5 72b436e13b4c7e8de5608e4d6416e63e
SHA1 0e42dce492cbe05c8845a8822b5c76a83249285f
SHA512 54e3b2d01a6298a11456a7ca04f2a93b51a702e6a0b07a6ab8769930c20d35d59d7df2245c05269a859414560f74493df30e5bcd5ec9ed71f827073ae7a8f7e9
SSDEEP 384:njtNn/s3n9SfsNp3ZW2WJGb/kvMofmn15wbAjEx:jj+9UCxifmn12bfx
TLSH
T169928D32AC381D275DE39549F54A36179FB485BBD7C82F94D8EC9B0C02DA398131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a7ad9833bba654549a6084568e0d9c57f225199d198220c451602b622abe5bd9
MD5 975ee74b717d4e87e3dfb3d6705c60e9
SHA1 51b418705c0747b99731bbb28dd140cde7964686
SHA512 57351202116bb5933343c1053a068c546a3b3cb6dd18c8c124900edb40ea453f3c7da6d52c02e46a6ab1e8622c5a5a681d36db243bbd3aefafb5680c6a894e40
SSDEEP 384:nGiF1tNn/s3n9SMzsNL8TUNTUlIl8ZW2WJGb/0DfQdvMZfmn15wbAjEx:tF1j+9vawgMxbafmn12bfx
TLSH
T163B23A36DCA4CA2BADE38BC5F70A7657DEE041A786C86AD4D9DC5E8C01D72DC030AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c3971dcfc54eb1747763a4d1f82fe629e14bbfab3d04e7bbac1402d8bd9b9d1d
MD5 3625abc9fe45309cb0a6fc0af67a52f4
SHA1 8ebcaf518e4a2b1733e61c6f24d9d8de26d08ea5
SHA512 f20ba78f9e56311c25afbfcb55a0e17a5cb2cc5c0d0b9627f2d43742d0db9f67d63ba0b2d171c02632b7e09f10daec0ee35fb5911f87839f77e9bd4ae6d7307a
SSDEEP 384:nvtNn/s3n9SfsNp8ZW2WJGb/kvMofmn15wbAjEx:vj+9U3xifmn12bfx
TLSH
T1A0929D32AC381D275DE39549F54A3617AFB484BBD7C82F94D8EC9B0D02DA3981316D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc7f2ed413026530bf076d245975d82e1aabdf6d3011e6612853cc5c4021d72b
MD5 863c5fd2cdb6fd14f6edfb51f57db26f
SHA1 0be4daaaa792816ee26250a0fec16baacfebf208
SHA512 dbe8de6650ea179ddd1505322f739b4bc1978ab1530bb09f64fd67d8ade6f62b7ba1442570ba0b0cb0fb85a36c657511d556ef58b65f11602f52131c1003086b
SSDEEP 96:ZqONkcQsjpfmUTmDK5ih/cIPURHl8h4otop5f5DjBhPwivh50xy0SFYK7Ax6YLga:gONc6kDfQmiUyx9Z903NIQiJEU6
TLSH
T1D402E8356C786CBB8EA3AE05F58637275FA5112BEA942F80D9E81A1C40D724C1743827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38f51945389b228931fa30e7e6603e62aabeafaeb8d0bdd685453846e8534aff
MD5 763715b8d703ece16e10118af8749646
SHA1 230e1d979b20803fc9b9ffb1ede92ec9ce6963b2
SHA512 5ef88ef7eda3ac145ac3ae5516883e12e05956367aab6d0734bfa05feedf445642236ceb46fb86a4adea7b1fd6c6a024e74dffe6a4f2cf6be54eb486219d8613
SSDEEP 96:pqONkgQsjpfmUTdK5ih/cIPURHl8h4otop5fJDjB9Pwivh50xy0SFYK7Ax6YLgC5:QONE6kYQmiUyh9d903NoeNEcRSqR9U6
TLSH
T15F123C35AC686C6B5DE3A551F48736235EA04127EFC96F91D5EC271C02DB29C5307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08658b92-7545-43d0-96e1-6372a6a70004.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\08658b92-7545-43d0-96e1-6372a6a70004.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d9c74a1323cc31d770cb0f382e7e991e115bdc5498754205e81de0a8478a9b70
MD5 5cb9df29ba09f3ae7e1540fee525a894
SHA1 cf85e7c9c1197267340a7111d07508cb1b4badff
SHA512 89c0ecb4f488900b206411be053e9efb89c36c022bf9e5bef4ada0812eb7283a232d11077a22b6613472e47ef5d40f4465f2f73a2bc9198e7b2ba7dfee08520c
TLSH
T14F410758A6F91148B3B76F5AABF6A86E447FB8772F06C45D00110E4E0A77A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

4fb6e8a3-4a12-4519-81b8-2d15476c97ec.tmp

Path C:\Users\Admin\AppData\Local\Temp\4fb6e8a3-4a12-4519-81b8-2d15476c97ec.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9ff18340-9819-449f-935c-0853f7e35a52.tmp

Path C:\Users\Admin\AppData\Local\Temp\9ff18340-9819-449f-935c-0853f7e35a52.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e0d10fe-3129-4533-b27a-d6790fabad41.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1084_439061492\2e0d10fe-3129-4533-b27a-d6790fabad41.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1084_891669693\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download