b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
899s
max time network
894s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (2).bat
Size 44B
Sample260627-rf46aabs2s
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2468	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270429721343956"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{6FBD2CCB-835D-4B5A-9FF3-8F5D65810ED3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
984	msedge.exe
984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3808	2608	cmd.exe	86
PID 3808 wrote to memory of 2300	3808	msedge.exe	88
PID 2300 wrote to memory of 1352	2300	msedge.exe	89
PID 2300 wrote to memory of 2468	2300	msedge.exe	90
PID 2300 wrote to memory of 1756	2300	msedge.exe	91
PID 2300 wrote to memory of 1756	2300	msedge.exe	91
PID 2300 wrote to memory of 1756	2300	msedge.exe	91
PID 2300 wrote to memory of 1116	2300	msedge.exe	92
PID 2300 wrote to memory of 1116	2300	msedge.exe	92
PID 2300 wrote to memory of 4856	2300	msedge.exe	94
PID 2300 wrote to memory of 4856	2300	msedge.exe	94
PID 2300 wrote to memory of 4856	2300	msedge.exe	94
PID 2300 wrote to memory of 4016	2300	msedge.exe	95
PID 2300 wrote to memory of 4016	2300	msedge.exe	95
PID 2300 wrote to memory of 4016	2300	msedge.exe	95
PID 2300 wrote to memory of 3564	2300	msedge.exe	96
PID 2300 wrote to memory of 3564	2300	msedge.exe	96
PID 2300 wrote to memory of 3564	2300	msedge.exe	96
PID 2300 wrote to memory of 4316	2300	msedge.exe	97
PID 2300 wrote to memory of 4316	2300	msedge.exe	97
PID 2300 wrote to memory of 4316	2300	msedge.exe	97
PID 2300 wrote to memory of 2600	2300	msedge.exe	99
PID 2300 wrote to memory of 2600	2300	msedge.exe	99
PID 2300 wrote to memory of 3452	2300	msedge.exe	100
PID 2300 wrote to memory of 3452	2300	msedge.exe	100
PID 2300 wrote to memory of 4704	2300	msedge.exe	102
PID 2300 wrote to memory of 4704	2300	msedge.exe	102
PID 2300 wrote to memory of 4704	2300	msedge.exe	102
PID 2300 wrote to memory of 620	2300	msedge.exe	103
PID 2300 wrote to memory of 1692	2300	msedge.exe	104
PID 2300 wrote to memory of 620	2300	msedge.exe	103
PID 2300 wrote to memory of 1692	2300	msedge.exe	104
PID 2300 wrote to memory of 440	2300	msedge.exe	107
PID 2300 wrote to memory of 2188	2300	msedge.exe	108
PID 2300 wrote to memory of 5096	2300	msedge.exe	109
PID 2300 wrote to memory of 2188	2300	msedge.exe	108
PID 2300 wrote to memory of 5096	2300	msedge.exe	109
PID 2300 wrote to memory of 3440	2300	msedge.exe	110
PID 2300 wrote to memory of 3440	2300	msedge.exe	110
PID 2300 wrote to memory of 2248	2300	msedge.exe	111
PID 2300 wrote to memory of 2248	2300	msedge.exe	111
PID 2300 wrote to memory of 2088	2300	msedge.exe	112
PID 2300 wrote to memory of 2088	2300	msedge.exe	112
PID 2300 wrote to memory of 3652	2300	msedge.exe	114
PID 2300 wrote to memory of 5096	2300	msedge.exe	115
PID 2300 wrote to memory of 3756	2300	msedge.exe	116
PID 2300 wrote to memory of 3044	2300	msedge.exe	119
PID 2300 wrote to memory of 3044	2300	msedge.exe	119
PID 2300 wrote to memory of 984	2300	msedge.exe	130
PID 2300 wrote to memory of 3020	2300	msedge.exe	131
PID 2300 wrote to memory of 3020	2300	msedge.exe	131
PID 2300 wrote to memory of 2516	2300	msedge.exe	132
PID 2300 wrote to memory of 2516	2300	msedge.exe	132
PID 2300 wrote to memory of 4912	2300	msedge.exe	133
PID 2300 wrote to memory of 4912	2300	msedge.exe	133
PID 2300 wrote to memory of 5040	2300	msedge.exe	135
PID 2300 wrote to memory of 5040	2300	msedge.exe	135
PID 2300 wrote to memory of 4380	2300	msedge.exe	136
PID 2300 wrote to memory of 4380	2300	msedge.exe	136
PID 2300 wrote to memory of 1200	2300	msedge.exe	137
PID 2300 wrote to memory of 1200	2300	msedge.exe	137

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (2).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffb8b18c188,0x7ffb8b18c194,0x7ffb8b18c1a0
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14360399995329315812,5482967278223431997,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
      4⤵
      System Time Discovery
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,14144932114590813472,15966160011979262210,262144 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,2557448371649136207,8278701594757196020,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6087249692362471790,14718572653254500867,2097152 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1932387305946092245,766986565580543153,2097152 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,5756186367996567439,6047044834697919989,2097152 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,13129802394533337943,18091695890653430334,2097152 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12170740024475420663,17862140500923555402,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,17825955971995102068,8653074572879986469,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5504,i,8725175338487204425,6895777278414933585,2097152 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5157201715290935242,2037460409576869284,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,6538828388407645767,15063433674490343643,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,3679428580152585404,4418970926488042842,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,3679428580152585404,4418970926488042842,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6567059982263686084,14254365963429068903,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14646106812477584160,2404033397780121270,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,13574579392498288512,1699043366370929127,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,15614605813964017310,9025185244994862582,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,13364327802596283306,6591836409655129298,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,14420367073366064831,2520598301517865185,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,14537021401358251744,11656350391650207231,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,1072583063794117534,7559467843408388675,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,1071614335250089468,5291590471630751736,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7164,i,18249342253794724036,9165485670000915040,262144 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,6259653171569109270,2711863807631312665,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,16299145659223656775,16062503011532400678,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,12047222803696331990,1054054908955366711,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,7249924334288596654,8992968797113633118,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=1068 /prefetch:8
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,17697147231276419688,8823969283016288330,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,7582767433557580041,3778600760226399898,524288 --field-trial-handle=2316,i,7149319004506253585,9976263389490676527,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
      4⤵
      PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9de568177de37788f769137556812a62f9eee654580c9da1ef3bfe46527c4cc2
MD5 1ed4149b9fb683de504bdec6d31d0956
SHA1 84228ee5f30c76a9ae90bd7ce4e8bf343bc41abd
SHA512 76734f2419dc2f65649f342e54dfa3986ad271d7566008a6740e142d2edd481482090f7e454baa53e36b7ab1e7b5189a55e1e9496499c18393f2c86f3b490d96
TLSH
T145E0809945CDF35FB10468C7417D634DC1A0FB0F97C56E8D6704C454758395466D1650
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 b8a602bbfa714dafc68f0f7d117ded58a5fdbb61e55800dc823c288359fd49dd
MD5 1c42cb73b74c53db7e3ed3303599e0d5
SHA1 5ed5a8e7671f477d34641df272c5336e1bbfb8a2
SHA512 4a4fb6db9a46cabf1f44bda34814c27a1ca5f6b24f60a42973d14d82be5e6fdae8edaa4ae85f1a7af21451033464c9ae6a63ac0ba8ff9f0806e5f91f3c899e67
TLSH
T155E0D8CED6D0F69601CA944780ECF2144265F28FE54D865D3304E28D176390587C0598
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 1038e2ce21caa6768a23f65f8911e2b04538e910c2a383275b322e04b7680b7b
MD5 d81b6779ce6eca795694fcdf0d03d461
SHA1 c425a5efcefceab31c246000c28f1cfd557e7c41
SHA512 3f623cb81600957d5c3bc73b48372bbd5dba5af374493cd417a06ac6781b7c5ead29c7bb9984eed094570e7ad8042c6f7a0f5f721137d7d8fcc36722f79dd570
TLSH
T179E0D89DDADAF2A65190984A80BCE21C4360A2CFD38D5EDF3709A28D1607100A3D2594
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 8c0715cf1417fd892e2fc923eb74b4959ff5af5fa3d71d863a243feb4357cc3a
MD5 347de7040055b602ddecf87194988acd
SHA1 dc54c972b93965e83ad702274278d3076141a27d
SHA512 1efd645ac433103b0ca1400ec0788286e86026dc20d125494a633a49c815dc5f9e9771ba119ed41f4bb4b51c71efe0d9f165647cc7ec785bdd20199952350544
TLSH
T140D0C2F8A88CA84FD3E52AFD5262B0400F6442E29816DF030115F98132555F01F560B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d9f232f5ea8bb3f34a93c9484e3940cbceeec995da8a3fe2fe711b2620674c7c
MD5 81892b59c4bd7c8f9e15f0c408ef8e5b
SHA1 5425cd19486eea2454387ec5c8db632b22e877a6
SHA512 6ba88c83c07dcaa4607013fe66bc435a3f0685a62b22b185d543217105babb16589ba1cf3793172f1f1ba902a31ba7210cfdce085015c552e4101de94fd16fd0
TLSH
T1DC71893427008164E3260872DFD916DBB73685E7FDAB7E8110F2BC789521F76466AB4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ac58.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ac58.TMP
Size 3KB
SHA256 d882f514800ffe73f8beb2772a124ed7d058cd5b76b440e49d0996d2826eee50
MD5 d4fd0b18d27b1792cadf594d4baef751
SHA1 d3eae69e54a3e856c4068825c321d294fe812304
SHA512 04aff5668c6ca2d48854b33e141b10879e24775c835759214712dd6eb7a2608a5bd8e8fa83c526e0ff926162ab21679d02b651ec20cb96f45a2835d6e733e538
TLSH
T1EA71533933108058E3220872DFD916EB763685E7FCAB3E8110F2BC74A521F728666B4C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 23b2a071b984173ef645e3c9dfc88b07a6c510bdb0a3d681a75328e7d3ee5b5d
MD5 27d5cec874c1248cfd81750ac9af60f9
SHA1 bbcd91cb608add477fb4056bb1472bb5e262b884
SHA512 ef4699259e2e58e4e3c10c86ba7f26fa3bd92d27de1c07bfba0cf702b05ebc8536e3ee6f892c230c474c74407f34e1ee4c461b21952658a24e8c8fd684fd802f
TLSH
T1C471CDFB83E4862EC90195F4AA146E1BCE5D0629937C3C5A85E4FF4B93E2472E24164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 296cacd6bfdda9d47478ca9e96237b4a6d6b31682883724307a8063a3f33c931
MD5 a611ea1ccd961a7cbc97530e1b280f66
SHA1 09ff0a91852ad80389147c0779246b85c1bffb61
SHA512 62a2a98bc991dcfe50e13b7910221877699e48c7249f547f62881273f3589fbc47c74b74634436181a41574332bae59179a67ba3baff6bd3b4123e8586138e74
TLSH
T1E361BBF783B0866EC90195F0AA14AE1BCE590625937C786A85E4FF4793E3072E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c76a12134368403154fadfaaad928dcd66fc632a262812a0d7f16f91d752e05a
MD5 e7bbf8f735ac7816905bec8f364d0fc8
SHA1 1c2137e8aa0007db2fb5f4b585a55172595b11c9
SHA512 65d8ef3573177b07ec1fc4ecb87e90598139454c830bc308d4e01cc5d40ce303f0908df518fcf9d87e9fe47be3add9d82154e2682c62c6092a9ef7446aee106e
SSDEEP 192:sxZ/RSyM/jK1Ml8Mi//fksZ9HUqVpIdpYWHW6+WNL3c/Yv+Cj2lIg4J:sxZ/Uq//fksZ9sbHbY/I2c
TLSH
T1D252E752BE349977CCDBD208FA51BB53D6F5146292900E449AFCCA0C01E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e5d883dfb6d0548bf47145222175ba3606b86139fdc78e65f2797465010fd30e
MD5 a7cd59bfcdc147ebfa14efd9701977b0
SHA1 c29d4097009c88a3f52f63c71cd4388475bc8414
SHA512 61d8511e6d210867da8d1222a58fce194277eb33ac52406a7f1750de07ed6e5b6737e19613df4ec0c995426794b26c4c2ec6199cad34489b0ec3ac645e2d8238
SSDEEP 192:sxZ/RSyM/jK1Ml8UQbi//fksCVHUqVpIdp+WHW6+WNL3c/YvINj2lIg5mJ:sxZ/Uqe//fksCVsFHbY/v2Y
TLSH
T12F52F752BA345977CCDBD208FA51BF53D6F5146292900E44AAFCCA0C02E7BED225782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8e41663bc319ea0b57a766509481b51bb267909f1727376e48ca24b6ea4cb221
MD5 30e7a0bfc239363bb061b9ce799fed0c
SHA1 46a13e366917695e6b23b037be17214483887920
SHA512 63941bb56751d707c4baa942d369a93eee93eef0444564d9cccb9d09b8af775f15feb0c24112ec3a806867bfc0b1ace44d9910ba3824c38a6a59d94510df8c60
SSDEEP 192:sxZ/RSyMqZjK1Ml8UQbi//fksCVHUqVpIdp+WHW6+WNL3c/YvINj2jWIg5mJ:sxZ/5qe//fksCVsFHbY/vVY
TLSH
T15762F6526E348977CCDBD218FA55BF53D6F5146292900E44AAFCCA0C02E7BDD225782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 65dc15fee8d1306634cdcc91a2bcca27de5ca752069535eca5f7faa39a8d983e
MD5 e6bec7128675f92e2799bb81ee7a9e94
SHA1 2feeab71b8a11316ea8963fb8935828d2d07666f
SHA512 079c623ae918b97ad8ad2aa613b4e22124987cd2482e16e9d5f224e9186ceee6cc60f58a24f4da081ae2be2fa1484e3541888d585d074dc3089a1ed48ce415c6
SSDEEP 768:6EseJkn7pLuL7hxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNpVcLly0ppxrog:6EseJkhE7hxWvhfynu1ja8pVcL88pKg
TLSH
T12EF2EC3B6C0CCB7E4F844E9CEC2A7E9A6EE8018B56D8895487F9840C03C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 816B
SHA256 48398411d3ee4a7e31e7cb7a7ca376e2c4ef87a60ead1d5d562c1444d3b8fb5b
MD5 04a0db014ddc40b2e6d54dcdf7eea9e8
SHA1 551590e2c007a27c26705c16f0034e46fdc7da7d
SHA512 000a4f341e47fcb15ad61ef77b24e527012f286c85b7d131ea820a9841ded193b5a5e8a417b2c882cadb3d4b891ba140ce1fbd7bd47bdebac47ec723e6bbbfd0
TLSH
T11C01020A5EA2495FD9A805B314BA60F433B1C9EC1321E123883C2C2B2C3B3CAAC07098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cdc00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cdc00.TMP
Size 816B
SHA256 307a007ea7423eef6f74f6d243efb11ea2147bb2b6fa15887a54426e34857084
MD5 581a56cf192213023150028f2438ff30
SHA1 eec08f6c5dffca28c3f2e2e6f47b7466079e0264
SHA512 0ec7f1c2188c521ceee9632c1c16fc88c3d8d09c93dd14469619202a96d4d784f3e1337a9e8c27b054133a8a99d0f13c41c5bb37fb418ea202ef67d15027bd3b
TLSH
T19901E1868BA64D1FD85405B7088560F47331C9106322F793D07A253E1C7A78959070C4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ed9152744c1cfb8f1a162149c183f84503e3f1a992fffe7c249bded8e849a338
MD5 bb4a6dbea266cf2952680323428d3d61
SHA1 731de87d63355399e5ac51ec20a19deba9118d8f
SHA512 85121325da4fe8259ea6f3ddf97291c5bb0074a02b9425bf1e186aa2718f292f1ce7966717f2dd692de67b92e84038d906972db159ccb1280cbf9e9dbc27e713
TLSH
T1C5E0C6B62DD32810BEAFD3DA20308090064A78ADE941FC4EA42FF6C310B231530DBC36
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593474.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593474.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6f1ff61994198b0889157b50d7a7e6d0c527899f12384dba0a6d7f2e2dc6aca5
MD5 263601c027716c2eb4e53d4972d92d75
SHA1 14ebdf6946680c9ef570f5db6da3813c88b953d8
SHA512 ae02d488eba7d4e1970264d8e08793e33af373ab81d5a6ae7bfb06b863ea1ccbebdfc7072bff9460dbe91dac5c00b3b82f042e247a3b17e5931d830479427b3f
SSDEEP 192:uuWLsNVmwQN7EXVM72CfQmiU1PSM4MTbt+FdLjv3mhg8z1VqLUMZ:n8sNVmw0wG7phsDDd/kGUMZ
TLSH
T1F74229326C789C279AA3A141F44736135FB451BB9BC82F54E6DCAF1C02DA3AC531B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 29d88198fd8ed9d0e321fa3ee0a91fc8020f805ec4d01945220d88a7b0ac1aa7
MD5 9ab2e724eaf419164c5c2b2ee51f8f05
SHA1 995bdcd9da656fa4c59766592b31d22d31dddc97
SHA512 ab50cf5c26a6b360410ec271ff6e8aa7384f6dc0ca995e2d33205adf8ba971b4476793447d59942dab5a1c1be011ed5a729a899d499135e753e7f55a917f72cf
SSDEEP 384:nhiF1tNn/s3n9SezsNv8TUNTUlIl9VX0wG7phsD5DfcHd/UGey:IF1j+9NGwghGEuHlUGey
TLSH
T1C892F936DC65CA2BEDF397C5F60676479EE041A786C86DD4DAC96E4C01C72AC030BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca82f5a352c0fc6272748c1d9eba23ae8baae07062058c0cea2593279b448b1c
MD5 8246906da4c9d9abc3f37c299beef422
SHA1 db3809c14c1326ae9837ad2c9638e001a42f4487
SHA512 34a501b9f1fb95351f57ce348f6f5f045b46a7b9c995e140fa10e983e102d59ead51d7c896b99ecf02fb4e3df7b100073095bea5a9ced423abcc51a9bb2fbdd9
SSDEEP 192:lONe6vMtPQmiUyv3ThTbt+FdLjv3mR847najU/u:lONe6UtR0TMd/+KU/u
TLSH
T14B02FA35BC786C67AAB3BD45F48A27175FE4217FA9905B54EAD82F1C01D774C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7d0f75765e8d077971d3012739d8828def3189f142cf56c8873d36ff58d0ab40
MD5 ec640fe9e339e1504b96614b62e1fc84
SHA1 c3577452c12efa02190fba1eb5a66b554231ed32
SHA512 b2219ea7fbab0b786205542260231f01b97aa96336b50093274b6ab320dec9800cefc70d5c9fc64172aee5e2c5653c74b3bc396aab4efeb9055735a87615fa67
SSDEEP 384:nJtNn/s3n9SfsNV9VX0wG7phsDDd/kGey:Jj+9UIGEPlkGey
TLSH
T138625B326C385C2B9AE2A585F44737075FF491AB97C42F94E5DCAF1C02CA36C1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ef9844e997b3a49a594502bf4d14d041ee68a45a3d5fa58b8cb345c12bd42eda
MD5 8581435043e0a7e83d2a5db770c3a087
SHA1 53fd0bbb202a4afd007d4b11175cca8f4297d5fc
SHA512 0841be52de3e6f8575124f8ecdadac9554797b4275a667439a5fb8efeeaace8c4394602a6a1fb9c3f693e6a38844515a330154375e556ae8360f723ee719a52f
SSDEEP 192:tONQ6vMsPQmiUyw3RhTbt+FdLjv3mhG80IVqLU/u:tONQ6UsR9RMd/iGU/u
TLSH
T182121A32AC649C6BAEA3B585F48B36135EA4917BDAC46B50E6DC2F1C02DB76C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 7c2abd3f2f92ec6dea94da80fc75f2b66a97d55ed6a5f205c262cd7d2ce7a991
MD5 6a26a864fad987a683e213e59e4c3e7d
SHA1 bc524a0ebad90a097aa26e28d330006a05865d27
SHA512 7a5c636ace607e9d13b8f620d80b7eb5bafcfec936a4dba306dcd50416e638aeedfe600b9b463c3055dd4f6e1e7e35433264c8cbbda1708a71a5e9b57647011a
TLSH
T1CD514CB7B987D46818B00726CAA3682A9DEFD024215D21BEDA506FF450509DFC25BD94
MD5 SHA1 SHA512 TLSH

Submit Download

07f7c246-3077-43d5-905d-29a4feab9383.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\07f7c246-3077-43d5-905d-29a4feab9383.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a7ed3703b38fcf208269449ee855145b48d038c38ba9cc2b64213e23fdc5dd4d
MD5 db9343d728b9a16c4a8113968dc7b65b
SHA1 e5a93dee9b0248adebecdf0588cb1bc14146a369
SHA512 360889009fc4203be5c473f2ebeeaa3dbb1f61c0b8dae2a3cd2b84ad79f81e2ad1830d192f5a3ff8b81636ec1a82ba2fb8146b223472c3ed9bc531ce1c8c798e
TLSH
T18141295CA6FD1108B3B76F5A9BF2A8AD487B7D372E06D45E10110E4F0A22B41C8B2733
MD5 SHA1 SHA512 TLSH

Submit Download

1bd7b0bb-1302-47dc-a913-a95526b8613b.tmp

Path C:\Users\Admin\AppData\Local\Temp\1bd7b0bb-1302-47dc-a913-a95526b8613b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6a03d088-2691-4ccd-9c42-c1ffb0e612eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\6a03d088-2691-4ccd-9c42-c1ffb0e612eb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92f39701-213f-4c35-a72c-98164236ddd1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2300_1168393562\92f39701-213f-4c35-a72c-98164236ddd1.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2300_2093563070\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download