b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
899s
max time network
895s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (3).bat
Size 44B
Sample260627-rf46aabs2s
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270429723513757"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{32E940D4-BC3A-4FB0-A1C3-7D58C02ED458}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 5028	2628	cmd.exe	87
PID 5028 wrote to memory of 4412	5028	msedge.exe	89
PID 4412 wrote to memory of 4768	4412	msedge.exe	90
PID 4412 wrote to memory of 5040	4412	msedge.exe	91
PID 4412 wrote to memory of 1948	4412	msedge.exe	92
PID 4412 wrote to memory of 1948	4412	msedge.exe	92
PID 4412 wrote to memory of 1948	4412	msedge.exe	92
PID 4412 wrote to memory of 3676	4412	msedge.exe	94
PID 4412 wrote to memory of 3676	4412	msedge.exe	94
PID 4412 wrote to memory of 4112	4412	msedge.exe	95
PID 4412 wrote to memory of 4112	4412	msedge.exe	95
PID 4412 wrote to memory of 4112	4412	msedge.exe	95
PID 4412 wrote to memory of 2068	4412	msedge.exe	96
PID 4412 wrote to memory of 2068	4412	msedge.exe	96
PID 4412 wrote to memory of 2068	4412	msedge.exe	96
PID 4412 wrote to memory of 3720	4412	msedge.exe	98
PID 4412 wrote to memory of 3720	4412	msedge.exe	98
PID 4412 wrote to memory of 628	4412	msedge.exe	97
PID 4412 wrote to memory of 3720	4412	msedge.exe	98
PID 4412 wrote to memory of 628	4412	msedge.exe	97
PID 4412 wrote to memory of 628	4412	msedge.exe	97
PID 4412 wrote to memory of 2852	4412	msedge.exe	101
PID 4412 wrote to memory of 2852	4412	msedge.exe	101
PID 4412 wrote to memory of 4272	4412	msedge.exe	102
PID 4412 wrote to memory of 4272	4412	msedge.exe	102
PID 4412 wrote to memory of 4772	4412	msedge.exe	104
PID 4412 wrote to memory of 4772	4412	msedge.exe	104
PID 4412 wrote to memory of 4772	4412	msedge.exe	104
PID 4412 wrote to memory of 4936	4412	msedge.exe	105
PID 4412 wrote to memory of 1048	4412	msedge.exe	106
PID 4412 wrote to memory of 4936	4412	msedge.exe	105
PID 4412 wrote to memory of 1048	4412	msedge.exe	106
PID 4412 wrote to memory of 4980	4412	msedge.exe	110
PID 4412 wrote to memory of 3916	4412	msedge.exe	111
PID 4412 wrote to memory of 3916	4412	msedge.exe	111
PID 4412 wrote to memory of 644	4412	msedge.exe	112
PID 4412 wrote to memory of 644	4412	msedge.exe	112
PID 4412 wrote to memory of 4736	4412	msedge.exe	115
PID 4412 wrote to memory of 4736	4412	msedge.exe	115
PID 4412 wrote to memory of 3540	4412	msedge.exe	116
PID 4412 wrote to memory of 3540	4412	msedge.exe	116
PID 4412 wrote to memory of 3392	4412	msedge.exe	117
PID 4412 wrote to memory of 3392	4412	msedge.exe	117
PID 4412 wrote to memory of 5536	4412	msedge.exe	127
PID 4412 wrote to memory of 5544	4412	msedge.exe	128
PID 4412 wrote to memory of 5552	4412	msedge.exe	129
PID 4412 wrote to memory of 5932	4412	msedge.exe	132
PID 4412 wrote to memory of 5932	4412	msedge.exe	132
PID 4412 wrote to memory of 3668	4412	msedge.exe	135
PID 4412 wrote to memory of 3712	4412	msedge.exe	136
PID 4412 wrote to memory of 3164	4412	msedge.exe	137
PID 4412 wrote to memory of 3712	4412	msedge.exe	136
PID 4412 wrote to memory of 3164	4412	msedge.exe	137
PID 4412 wrote to memory of 4844	4412	msedge.exe	138
PID 4412 wrote to memory of 4844	4412	msedge.exe	138
PID 4412 wrote to memory of 400	4412	msedge.exe	139
PID 4412 wrote to memory of 400	4412	msedge.exe	139
PID 4412 wrote to memory of 4936	4412	msedge.exe	140
PID 4412 wrote to memory of 4936	4412	msedge.exe	140
PID 4412 wrote to memory of 4512	4412	msedge.exe	141
PID 4412 wrote to memory of 4512	4412	msedge.exe	141

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (3).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x208,0x7ff84a22c188,0x7ff84a22c194,0x7ff84a22c1a0
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,36454377544231558,14769245343919882175,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
      4⤵
      System Time Discovery
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16880001220070496207,16993507105635791484,262144 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1194978122423322983,2757191793404571337,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,12510767926682724402,16080996643701373768,2097152 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,8008372628548847198,9541105473354995643,2097152 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,14601661627052883261,1517547329861157530,2097152 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,9038150530313598488,18292471744355043092,2097152 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,13745056967654458870,2412892172741347560,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,14485173593300355925,8537341129783287285,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5508,i,16235528661337225729,6951108831745368498,2097152 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,17308390084011252080,13737602000766704517,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,17695456102492253276,4312162682966780317,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,5115946384041663485,9343611606063856161,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,5115946384041663485,9343611606063856161,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3148916168301291521,7909814606717480947,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,2603466375765788428,13517099973146612341,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
      4⤵
      PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,740566447406025067,8161805741761687349,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,14395881315614025431,5305334629269502643,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,13373154739685972556,292212854485179560,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,6970940056987250258,10863785150439716735,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,12805502506113880905,9991869923878004686,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,13756771779324059496,11945790032336355877,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,7308620519617050683,4935904425467431460,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5140,i,2477481935219900644,2688000468440108778,262144 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12778461026568909483,3051583510750353998,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,4222465493780810182,9009460481007659220,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:8
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,5334843117194114034,7137673665852017543,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,7276940890380795233,8540914882491579941,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,1980829297331586447,14044739452040094576,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,1412749908353657953,7304278412806682579,524288 --field-trial-handle=2288,i,10211348849911213976,11212903479619555800,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
      4⤵
      PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 328e342c243d0b2c5d2c534801580c16ed39bb9f73b3a2014e8fd132dfa171ec
MD5 80b58d621f84992837e95442480aa1d5
SHA1 7508cc668938482bfaaf6ad8e812bb2a1661efa3
SHA512 72807f600fc8233bb667aadb21046801b675c9af3c83559a38e4c34faea6bc17ce88be73685943fc390ab31965c206bf5149820f4d853df1c4e25042aeb83fa0
TLSH
T1C1E092CBD287F39A01E8A546C0BCE3190222A25E918E975E3704AB8A260314053D1CC4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d77456ee487fa3737fc536c2d4659ad43a2168067c2bfaef181f3203bc753b79
MD5 3e080783c651415e148f2e578dc183fa
SHA1 612c01a95216933f91631f197c82b1b35901cc06
SHA512 10391cb967bbe94650d0c06fea68eb4c92e5f82561dbb158b9979d565e616b3f033f66323dfb9e0b82d248491e1d8cad6a47ccf9d60ef63f600de5545265098c
TLSH
T1C2E0D846A2C7F3966282D54A804EE31A4170F34FE54DCE9E33046094750390081B9191
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 979ab51e03991b40f9741b2a5be61116ca485fe8c79703e40091dba79a43b63c
MD5 3ea8ebfda53b8bbbda5ebb2917936efe
SHA1 b67edbd64a3090c735cf606839fa746a5d7bd3df
SHA512 20e631ce59e7ce8e9e24121544c0462f4b8d33bb52fcbb69566b7a19d9f48a69159e15b7cf764e0b28a5b4934f2d67673513f202fdc8038cb265ab125804bfef
TLSH
T1E1E026C9C4C8F3AF9249A54B91AC530C93A03B9F92C86A0E2700A5A87203240A7C25D9
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 275B
SHA256 7644d982d721ebb80505be7bf15e54ab3c77d5845e1db8dde522ff687dddea5a
MD5 6af951e1af55ef1ee1cfd8aac1888512
SHA1 145b728cb3bfbce69da26c56b792a3193ebce337
SHA512 6c1c023602de76dd82009e7c3ea0c1856f86f096a2d5b38dc9d88dcd7f715ecc78efc6c594992680d581313ea631490cb52e08b0da84b600787de105f4ba84a8
TLSH
T1B7D02BA9BADC999EC3D409BF9772B4000B6552A2981B9B131561FCD032807F01F29134
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2a69505e3ccdb5a82f5ec9a91c8fce840e1efc85615103d23dc5ff61d471c2c
MD5 6b2b7ba1501ceb98fbf91f4075801eeb
SHA1 48d263805b8cd2cf8ddc517ee54b85ec00c7d95e
SHA512 b3f365f0b4c0c4e2e5fde35ec971217212f54b2bb1ee4fb3b52d8cc22e192774a83c21774b64cd2f28dad38d82716426f2b1affced183fb82d57bf9a44aaf626
TLSH
T1EF71B42875C60911D73B0A31D8C0D0367D3263AE365BBFA146D6743F02B67EDC978444
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e3f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589e3f.TMP
Size 3KB
SHA256 d9a446579ec4d21f3f269338bf4eee15f29757b2948be9ff99b7391916c8d12b
MD5 f80dd4fb470b1b9c5d6f249788c47c35
SHA1 601cb98e40aba61110654cb025fdc038805cdfc3
SHA512 f0e131ed49bd76d80d093029dbc59c137ebeb342a59ae3ca7d9fdf3a86e570208afca1be4a0d4495401451bdddec3dc5e871fc959bde3ba34f808a31299b42e4
TLSH
T1DD718F2875C20441D7371A32E9C0D0363C72A3AE366BBFA192E6B43F05B67EDC874804
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4492c076b9c6c3d8b0ba6aefe5980ed4f2daa66979fd874406dc4d4a5dcb0e5c
MD5 022794c60b80c4efd5de0ea77a6ddd9e
SHA1 f4963f666b828b1baeb3cf542bc39ae8bbd50f9d
SHA512 968275d891ae46fe512ef655a513f30e456ccb5cf5b515856a09cd8eb1db41bae0443e81da4a3dbf2b5116ba168078cbcfa5a06f2af330ad962c63375fb3253f
TLSH
T1C0719BF783E4862EC90156F0AA147E1BCE590628937C7C5A85E4FF4BA3E3472E24564F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f7eac652857161090b72256583486173277deb2b0cb4db13cddc73f8dc0eece1
MD5 f1d6331a4b34b1678d679c144ac370af
SHA1 9f29505a25b2b47de3efcfc0ac296ec607a68f7e
SHA512 16c68c8a26cdf3b50d688ea7f212f06142a96d0ecdbe3ece8c21fbbc63c54830b5d0625b2437749e6d70a13ee4b06d0bccd63c9152c738d249b05260ed35e498
TLSH
T10371ADF783B0866ECA0195F0AA14AE1BCE590124937C786685E4FF57A3E3472E245A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 df008dd7af35250afdae38caac5458349090fd5859fd02296fbfe7bedcd1b075
MD5 538dd3034912efc6d13ac4beeeaf07e4
SHA1 89294b35495885a76ca9600dbe5a834f38aa1ea0
SHA512 94905e3cdf7623367250c3ceeb1b60b0ebaf019c8208f90c87b9eac3fba0fcc4c9ffccaf82962e0fe8bc13e44622e13108cb352eedd4da7c906c7c3926c34615
TLSH
T1D6719DF783E4862EC90156F0AA146E1BCE590628937C7C5A85E4FF47A3E3472E24564F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 95c94c2cac8a432271030b362f71d114da7556317cb3e46bb7d27837e06eecc4
MD5 73d002e1741b7612b3135ca59906ff52
SHA1 1e4809fb331eb14e256e5d2d77a38bdcaa9c621d
SHA512 ed51898f5ca60161908b2c6fb70c3b5d7c2bb12c0eb5ae7c72a630e7ff86cef57641a7de222917f07dbe9653a0d3b1bfcabaa403e84340ad33a3d3213b9041ff
SSDEEP 192:sxZuRFmyM/jK1Ml8MiM/fnsbyHV/IdpYDHW6+WNLml/YwmVcXIg4J:sxZuv+qM/fnsbyaGHbg/Bc
TLSH
T12952EA16AB349977CCDBD209BA15BF53D6F51572D2940E44AAFCCA0C06E6BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 31a34e2e33c1f8893bfdaa7690eff0790356e6db2cb7ecd8182bdf20a25eb686
MD5 1b59b32d30e5c476e3618ada68cdf979
SHA1 658bc1c03d46a08e0f2adc6ae85cc2f4f22fbf35
SHA512 5ae5fa39b7e502d6ce9a3e3ba13dad450c2fe749a7c497a5e08ca9e5142467f2e7d5e1959d22975dd9a6ec1fa95e63ccab8dfbbddd8b326ceb73c9d54fefe73e
SSDEEP 192:sxZuRFmyM/jK1Ml8UQOiM/fnsp3HV/Idp+DHW6+WNLml/YwEecXIg5aJ:sxZuv+qXM/fnsp3aEHbg/qM
TLSH
T11162E716AA348977CCDBD208BA55BF53D6F55572D2900E44AAFCCA0C06E7BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 57616015d7a2bc635539f32cdc79405f062208c6b7e10cc51b4120f20c6af880
MD5 2582cef77b07bb04954b705bcd3646e5
SHA1 1dcd3ab320e856bfb15cea9386176274eea7ffb4
SHA512 9c60d17b4201f458ccbadb07a5224a3a79134f4cd9aec6d1e78e1276abe7647d83e6a2743009d33177ba1ea1e54613b37f7647c2fac8dda2647b14441c2c144b
SSDEEP 384:sxZuvZqXM/fnspe66s8qMpRiYnazAW8pZS15posJWeT+caEHbg/XM:smYXM/fSe4Mnc7WeT+c5HbCc
TLSH
T1CED21905A924C8778EC39D18793D7E33DAEC50925285CEDA59ECCA0C029E5FCAB47867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1ec19be99cdb683e3d1abf2f82a379a61ca7616f0a0273bda0894f77dc3cf21c
MD5 ba7b550fd0d833b02814148079da6331
SHA1 47e84c74bb4239663c2077a664431eb1d9e20164
SHA512 1ec5f79cd6fff21294cb3c0b4dfde5648c1bc83e6b81c4fc1dce97f145e6f44cd889bd54fce1cf2eb47256601828b4507bb8cab76188850223af71c558071cad
SSDEEP 768:SP4jepx7pLuL7mmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDhNPLlrZ+dNrok:SP4jepnE7mmWvmKLEu1jauhNPLZQdmGz
TLSH
T1CBF20B3B280CCF7A4F844E9CED2ABE9A6DE801CB5A98895447FA444C03C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 6700d5eef369666c536a8b950c5746e9e879b7bd8cb7bbc1ee9c2b4a6784c77a
MD5 98504782b5a9342f1ffa17c24866e483
SHA1 de8fb5f59d9b7434da7bbe29cd093362b59a25ce
SHA512 5257c252c4e6aa04b788537a1655e960b272ca19d3fe57a137bef349e08b4d462ea830dfa35636ea7a2612da4b5354c8f203bc9d0e3344626d0a5f90e29365e5
TLSH
T17F41A54A4DA4A92FF854447205B3A8A83774C9CC0A22E2235CAC15757D0336E198F2EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ccf9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5ccf9c.TMP
Size 1KB
SHA256 f7745530426994faf9cc1467f9880ccbb4bcd5d7893519c394a95565eb7450d4
MD5 f11e10f97a294d436829e6f7df16e9aa
SHA1 ee4e5fc37766f16e13ebddd6d3ae13cc709dd22d
SHA512 2bc38c0a3f11f2200cfd8fab94c62a9bf5c6e5b0dfb85a791a105987b9e1171b6c1286fdb6399d8484165d511f47555c0ec32e8d39187fd1b83c0a216530c0c6
TLSH
T16C41BA4A4D908A1FE8C040770EE7E8B8733594004311B783A4BC5139BC617FE1E4E0DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8a0c87ba571e51a906338e693e4e2a7c8ed87f260f98a6b225337d57aaff8338
MD5 65affd5d962aac6a3cd92e43795ca1d7
SHA1 754583565de3f3154bec63d87c318559d8363f3c
SHA512 02c383780ec7f59ef052e53e26e878cb556887b6079a46e0c6d7064a27653c3cf15509b5a5e34943b376220db7654a1b7934af3b9a3d09334e765a2261d727b4
TLSH
T1E5E068FA2DD72E20AC7F47E228B204E48146B428C550AC8E2016A2E750A02282016C60
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f6851bfa9818420743c591d7d27b7ad0ce7b5e234c6402b149e9f968a22b4312
MD5 c33a0a109f55c4508b67a1f235ad1948
SHA1 9706161881407356cfbd1e5e0b2266bced4d43bc
SHA512 4bf5ce7236b87d53b9f196e2f7967d49e0d886f525097d157c27298682e01d9eebd1d2be05db3bd058931235271e5336ddf586208af71695b6dc4d21c35c0620
SSDEEP 48:KwjIhKE4svytjIlKsEoUvIhK4QU3yiKpuqIwB:Kwj2KE4u2jqKsEvv+K4QWy
TLSH
T1FC91500135BB32013C7F69189291A61B4A5275673189FC7B7BA860F20FABE240DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1932e7aa2097792322bc485b998a0da810a6b3e4e702b4bcf9f14d54809be0c
MD5 c2942a2f87630c42f26e6e0aed36d7de
SHA1 732f4e2d4ef4247a355664f9ffabfedd849f2d87
SHA512 9714b80ebacb855c9a81b8d33daaa0a1385072ef0f369c59f68542d0fd2dfdbdb9201e585f26323baa11c9aecb1a8035ffff4d12a3af1391bb7bac5030b96e7b
SSDEEP 192:EONY6hZ0QmiUyhhpc/+jVx+Fd2YHC5wOZDnU6:EONY6ocpu+0d2YH52bU6
TLSH
T1DB02D935AC786C778EF2AE06F48737235FE5116BAAD56F84D6E81B1C00D766C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1f2d77efa4ccd03c83b2fc6473f6c20bf7dfa44c7b8f4dc502e70ddf76969a40
MD5 545c2dc4e96b491cfdac904505894256
SHA1 1bdc32e90cac75d336f8341ea5cf1064dd8d5e4b
SHA512 4915baa2d6a7a008dbd60b2fd16961157afff46a9f3c17a3c82871f59d795c8c5a6bf49f200a0e83e522526c7e3f34f042605f566739b8e3fb2bbf7f23ef8cb9
SSDEEP 384:n+tNn/s3n9SfsN6Ao4F4QDLuf+0d2YHRmPFWmn15wbAjExQ:+j+9U1wKhtCWmn12bfy
TLSH
T10E927D326C285C335DE3D58AF44B36179FF591AB96C53E8491EC9F0D01DA3AC131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1e48795bef84c9e15ae338f5836c4ed8bbfc673c39c87f71492a39f4821161fd
MD5 6acef0a5007cb24b1f3a90b0f8ca7afb
SHA1 adf3fbf7d7d328a73e22162a33d0c6a0fe12e5d2
SHA512 fc2cea4302b7be62a5a447298c757d4e2779debfc1792aa0408a0980a33354d4dfa489e5cebbe587daf028e7ccd92c15a22167ef373bc3585b1ea4dd29700fdd
SSDEEP 384:nFtNn/s3n9SfsN6No4F4QDLuf+0d2YHRmPFWmn15wbAjExQ:Fj+9UowKhtCWmn12bfy
TLSH
T11E927C326C285C334DE3D58AF44B36179FF491AB96C53E8491EC9F0D01DA3AC231AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e07eb20d406f6ae2eb2cd70c0c994b481ba982688890f04c7da6ef38ef1f153
MD5 afe07bfa7a351eb07ad7b8ce1f5f2cc1
SHA1 2ed7ba4793f448ea4bc40e29ea848ae8732ab17f
SHA512 933cca23cf0552fd62511b46445f7e46150642be6c9ecf4657f63f99e9b2c0a5de600e047703d93d08099fa113d2701b79bc3dce210345d6a9e9b82c294b36d8
SSDEEP 192:+ON76hZTQmiUyXhec/+jVx+Fd2YH8FEml5cOqSqmU6:+ON76Bkeu+0d2YHRmA9WU6
TLSH
T1AC120B326868AC774DE2A942F48736135FE5512BDEC97FC4D6EC2B0C01DB66C234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 17866c90156bf4ffe9e546545159dd9106d2fec2a9367fbd880dc49759cdb9c6
MD5 4b763eec31a5e01d7715fe81a71835fc
SHA1 c7c01794259ccc43b69f784a608934d355af1c08
SHA512 d9446e0ceb025c6a36c90e24ad91ac64f8c602bd05ec97f1464bd9ab8ee35a9dee7068ec48673235fe1b61030dfa309fb191e160768f9a6efc9851644d3f4dd4
SSDEEP 384:nD9tNn/s3n9SqzsN6No4F4QDLurDfcx+0d2YHRm0FWmn15wbAjExQ:Zj+9NowBxhtTWmn12bfy
TLSH
T116A23A32E864DE27ACE393C6B607765B9EE0516746CD2DC8C9DC6F4C01DB6AD130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 21f2193dfc0cbba57a94833e3efea0fd90030ab597e6bf91ff669ddc71134102
MD5 892caee6ea01fcc033e98ab2df2e46d8
SHA1 b1b954637058ce20fca205fa6e329cb63f070087
SHA512 e17233b7232064957c4f24076b79f39bcfa4efdd124b0c10a9397ad00ae56449441eef30afc270ccb59154e9c771876d23e642015850eb55f93373ab7be417b8
TLSH
T12B411C58B6F91148B3B36E5AAFF6A85D487B79772F06D45E00110E4F4963B00C871737
MD5 SHA1 SHA512 TLSH

Submit Download

2b4be8e8-57ca-4737-9ab1-4969f86c952c.tmp

Path C:\Users\Admin\AppData\Local\Temp\2b4be8e8-57ca-4737-9ab1-4969f86c952c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

847d532b-f6a1-49c5-8923-004f8d4be321.tmp

Path C:\Users\Admin\AppData\Local\Temp\847d532b-f6a1-49c5-8923-004f8d4be321.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4412_131284153\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f543b95e-c922-4db0-adb2-af8a73f577cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4412_1551423488\f543b95e-c922-4db0-adb2-af8a73f577cd.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download