b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
897s
max time network
895s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/06/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (12).bat
Size 44B
Sample260627-s3dsaabw2x
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4784	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270483480712861"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{372AE531-33ED-4377-9B2F-7784A214802A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 4416	648	cmd.exe	85
PID 4416 wrote to memory of 2348	4416	msedge.exe	87
PID 2348 wrote to memory of 4800	2348	msedge.exe	88
PID 2348 wrote to memory of 4784	2348	msedge.exe	89
PID 2348 wrote to memory of 2156	2348	msedge.exe	90
PID 2348 wrote to memory of 2156	2348	msedge.exe	90
PID 2348 wrote to memory of 2156	2348	msedge.exe	90
PID 2348 wrote to memory of 3168	2348	msedge.exe	91
PID 2348 wrote to memory of 3168	2348	msedge.exe	91
PID 2348 wrote to memory of 2456	2348	msedge.exe	92
PID 2348 wrote to memory of 2456	2348	msedge.exe	92
PID 2348 wrote to memory of 2456	2348	msedge.exe	92
PID 2348 wrote to memory of 3836	2348	msedge.exe	93
PID 2348 wrote to memory of 3836	2348	msedge.exe	93
PID 2348 wrote to memory of 3836	2348	msedge.exe	93
PID 2348 wrote to memory of 4460	2348	msedge.exe	95
PID 2348 wrote to memory of 4460	2348	msedge.exe	95
PID 2348 wrote to memory of 4460	2348	msedge.exe	95
PID 2348 wrote to memory of 1060	2348	msedge.exe	96
PID 2348 wrote to memory of 1060	2348	msedge.exe	96
PID 2348 wrote to memory of 1060	2348	msedge.exe	96
PID 2348 wrote to memory of 2848	2348	msedge.exe	99
PID 2348 wrote to memory of 2848	2348	msedge.exe	99
PID 2348 wrote to memory of 1380	2348	msedge.exe	100
PID 2348 wrote to memory of 1380	2348	msedge.exe	100
PID 2348 wrote to memory of 3000	2348	msedge.exe	102
PID 2348 wrote to memory of 3000	2348	msedge.exe	102
PID 2348 wrote to memory of 4188	2348	msedge.exe	103
PID 2348 wrote to memory of 4188	2348	msedge.exe	103
PID 2348 wrote to memory of 2248	2348	msedge.exe	104
PID 2348 wrote to memory of 2248	2348	msedge.exe	104
PID 2348 wrote to memory of 2248	2348	msedge.exe	104
PID 2348 wrote to memory of 3704	2348	msedge.exe	106
PID 2348 wrote to memory of 1364	2348	msedge.exe	107
PID 2348 wrote to memory of 1364	2348	msedge.exe	107
PID 2348 wrote to memory of 4604	2348	msedge.exe	108
PID 2348 wrote to memory of 4604	2348	msedge.exe	108
PID 2348 wrote to memory of 4904	2348	msedge.exe	109
PID 2348 wrote to memory of 3412	2348	msedge.exe	110
PID 2348 wrote to memory of 4196	2348	msedge.exe	111
PID 2348 wrote to memory of 4296	2348	msedge.exe	112
PID 2348 wrote to memory of 4296	2348	msedge.exe	112
PID 2348 wrote to memory of 4576	2348	msedge.exe	113
PID 2348 wrote to memory of 4576	2348	msedge.exe	113
PID 2348 wrote to memory of 1268	2348	msedge.exe	115
PID 2348 wrote to memory of 1268	2348	msedge.exe	115
PID 2348 wrote to memory of 5652	2348	msedge.exe	117
PID 2348 wrote to memory of 5652	2348	msedge.exe	117
PID 2348 wrote to memory of 5000	2348	msedge.exe	124
PID 2348 wrote to memory of 6104	2348	msedge.exe	127
PID 2348 wrote to memory of 6116	2348	msedge.exe	128
PID 2348 wrote to memory of 6104	2348	msedge.exe	127
PID 2348 wrote to memory of 6116	2348	msedge.exe	128
PID 2348 wrote to memory of 712	2348	msedge.exe	129
PID 2348 wrote to memory of 712	2348	msedge.exe	129
PID 2348 wrote to memory of 2436	2348	msedge.exe	130
PID 2348 wrote to memory of 2436	2348	msedge.exe	130
PID 2348 wrote to memory of 5272	2348	msedge.exe	131
PID 2348 wrote to memory of 5272	2348	msedge.exe	131
PID 2348 wrote to memory of 4912	2348	msedge.exe	132
PID 2348 wrote to memory of 4912	2348	msedge.exe	132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (12).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x260,0x264,0x234,0x26c,0x7fffb1d9c188,0x7fffb1d9c194,0x7fffb1d9c1a0
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,3906032658452073480,10151021988333209350,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      System Time Discovery
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,2996975635243985274,11321865125263846984,262144 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,5799577991567285188,13881076818425192901,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1132963343645072018,11881847979747377728,2097152 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17686886592108127280,3451304464316778643,2097152 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,2800494006353137003,4409766802515675064,2097152 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,13088485607892390287,4033550861505696779,2097152 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,8417119005232829249,3348651098875186456,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,11332157413451333457,15089465487510279072,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,11931672117247374959,3298193618275083093,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,14761809632289613134,16674418483001774873,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5608,i,4477068170730429225,5632111700707530417,2097152 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,953466690530941486,2881633241253056253,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,953466690530941486,2881633241253056253,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9008589443431461975,9057305776261340329,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,1078306414838931187,2228022199370691239,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,18028659121241122102,10699170746456826030,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,3327588303201246112,17435199433301067566,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,13661533019253562489,9797040561684380595,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,10820556092842008781,861717378547407389,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,11380388298985131323,12322517855438580565,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,9412048880255398277,3357949818492799396,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,1208017936498910743,6348686979081425114,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6376,i,7893964464705969522,9007031643172712120,262144 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,16345875497771264650,8494894869787813496,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,8013147902443052832,3765139357425568196,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,4815252404842196694,16634873380046555928,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,1667615581548481259,14382657232288384999,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,2260330087092802705,13277249983268874366,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,7300422880347205769,5845455027672271195,524288 --field-trial-handle=2308,i,16456567598254050841,3675031493476099389,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
      4⤵
      PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 e0556d97abe0d4986887540969d906146a67f6954734ecf601fe1567fac030ca
MD5 4fcbd79b47afc722280d343dcfdc4270
SHA1 bd5cddc8d284162f98af46b7e8729a62a3eaf998
SHA512 59034bcced5dcc6ff46869e0280fb700d69a19aee1ea08e8050650218674a99ebc561d8d8ebe73d780ef0997b4487171725e1911d2718d269e4fec8547c532ae
SSDEEP 192:NjEuITmmmmhhhhsssssXXXXKKKKVVVVVwwwh:NjEuITmmmmhhhhsssssXXXXKKKKVVVVq
TLSH
T163E18307C2D9E3968B1650DA4E54736D00703B0DEBDDDA0C174CDDE9328F5DEA8B9A98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 f33d3d6248a367b58e7e03ac10cb1d5c1ad278584ea83ab6a5d445d74ad4f781
MD5 f855e34049d73ba604a02c295d7265c3
SHA1 17c8abd329e12dba5b2aadaf6f37f604bae704ea
SHA512 ad8b2ba5e7aa5f5fdba744be91712305ba7a72bb914490770fd7fba53e34cc430717b7509ec123c22f8c9a17dafdd4c09f4e35045acf3f6dabdaf3277be663f4
SSDEEP 192:DjYvRNNNMMMXXWWZZZoo66bbbQQQ99CjjfsLO:DjYvRNNNMMMXXWWZZZoo66bbbQQQ99C9
TLSH
T13CE15606C2E5E79FDB0521CE4DB4A39C40707B0EEBDDD60C038DE9DA314E99EA9E1690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 7e20ef1037ccb01cbf7eeea456999b19244c29bcaab20ad4364d1d011cdaa13f
MD5 bda93c4940e3555f481d091e1227d29d
SHA1 2828228dc32a8c2d7364fc60f3d7331f60d03467
SHA512 d90d62b9f96368659b62f7ef29c5877e796eacb02a4e2fd59b8461c371e3efacfb431f881011c647eedd99cdf0ef3526787dce9c2cf3f79912dccb8528560f79
TLSH
T19FE0209882F2F3E48114BDD6806EA73DC516F10DD24F565D3704789D164550062D7494
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 c39ed4dc1e0dd5270e05fd128a275effd56a2bfb04521b4438b1103b61b992f1
MD5 06ebfdd9fe152db487b4e0ea2b25e475
SHA1 7de7f120795e976af70aae3198a32425045d8650
SHA512 751ea8ba698f45f4e81de6eec3da57fba615d24855b1be9faabb6248d2dc901c3c799c8a09022388ef4638a63528aae2bf1aa9eddba83f0503506560593fe943
TLSH
T1B2D0C2F8A88C688FD3E52AFD8362B0400F5442D29416DE064129F98136959F01F52070
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c80d308e6f4228a3d530a2238afeefac645b54c88841901e3b0e86df157c843e
MD5 32ffb914bbd4aa2409ac1708baaebced
SHA1 0bd20e1badc72266df6748378e079a053a355fa0
SHA512 66a4a8d5c99ec4bd7a6bf29b0148870a7456450c4ea415881ca1efdc470e3fab3ef8c293c5da5be7e4a60724cc584f69aca3f23ccd5fdd1c3335c20feb32e725
TLSH
T12071801F21C6C8E5EFA108F11DCAD24472B682CEAD1B1E9759F009BD2706F3C5D27968
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 efed70763b4a248ff7a61f7d027fc909c3387f3ee57064e2d658ffc0accbfddd
MD5 43d681490a627017e91f9ba846eef635
SHA1 41191ab0e6231e5c925540e218d6c7c55e09a748
SHA512 f3feb7bcc17442448c38c1a8368bde843dfa09f852715dae25a3e3d679c8cb999ce36e85f45ef8cb0f0b63b3d39221e206c995ec77ccea045e7c51db4cea8799
TLSH
T12061CDF783B0866ECA0195F0AA146F1BCE590124937C7D6686E4FF57A3E3472E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c5d657a1d8a6f5a13b4700a1c102b169dd681d8ca1070b512522f29c92891372
MD5 581e3290760f8ef8b9788c37706b838e
SHA1 84965eab5374114ecfd05c24c65eeea55da32055
SHA512 e7a6b365649995584831daed909b660bce77e655920f838babe382789a9dfb04d6664225edd215fcfddecdc21853a1c6e425a03af4fa04faf09afc8746b208e9
TLSH
T14E71CDF783E4862EC90155F0AA247F1BCE690624937C3D5B85E4FF5793E24B2E24164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 1bb5d49cedd8c0cfd1f9b8f61bb2a14aa764a5dd8f7767f8445bae68a4ec07fc
MD5 b570029b19964b501eb6df34d1180120
SHA1 b1160d469a1de9f131091ea61fe0038b6b3d6802
SHA512 33c1b43e8e97266260b2e8a667d21c0bc18eecbcb1722eb962b0ffcd0007b0d4f7798109ecf0e849c09ec564a79494bf57436976a26bc8302e04480ae2e748e5
SSDEEP 384:sxZR4qdm/fYsT866s8qMpRiYnazAW8pZS15posJWeT+2di7EwTYHbB/K6:sJfdm/ff84Mnc7WeT+2dbwUHb1Z
TLSH
T1DFD20905A924C877DEC35D18B47D7E33D9EC40526284CEDA1AECCA1C029E5FDAB4786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 15af320c73c3542e71dafdbae6207af964f8c5980657ec8b818b4ec4744a228c
MD5 ae10fda4f4b1b1f2b5b267aaea096308
SHA1 7daac57fea3ddedc52c306484474d67c56990d5b
SHA512 cc329bb5f265f9f0c89f148662d2a7972a564087535980425f4c8d8ec67a5ef966afa3e0cd9fe88cbf1e1198ffb4b30b586af1f5d639e0b89bf9c340fe70e8b0
SSDEEP 192:sxZHxR/yM/jK1Ml8Mixg/fRqszjPT2IdpY7HW6+WNL9j/Y4eycRIg4J:sxZRZqm/fYszjPTKHbB/cc
TLSH
T13352D712AE34997BCCDBD209F955BB53D6F40572A2900E449AFCCA1C05E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 79e1cbb64a1777f88e38268b3793f6fd2bcbe7956768d923355dd5bb7a885188
MD5 f86f6ba2810b8b49ed1a361db5a1595a
SHA1 2c4497195f268e711d6cb0a0f26814f90949ba5c
SHA512 64913a13e5377f8e894effa45621d92f2ba9c743c86b90f3b36f1efbb02c2936e3707eef176ba42c6653d6d2d4fb8d4610f26ee2fd21ba6a647b8e5c27daae28
SSDEEP 192:sxZHxR/yM/jK1Ml8UQQixg/fRqsTUH9i7EwT2Idp+7HW6+WNL9j/Y4uBjRIg5IJ:sxZRZqdm/fYsTUdi7EwTYHbB/46
TLSH
T13662D756AE349977CCDBD209F955BB53D6F4057292800E44AAFCCB1C02E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 795c95fc0d5915bd31e49e22a94fc706c76a3a7457364f3455602000863fdef0
MD5 8213e7dc1fe73ebbc19bab6fe96cf0aa
SHA1 2ad1de1293290581d14848be3e84fef203428cf2
SHA512 4155fbf6ce9f0dc1feab2588b55701ed45cd5c9a7d249d7bf67428252a1bb57195fff04dc198d0cf76ceb312e68d14d70d993c7c5e76a18840261bc54aa355c2
SSDEEP 768:rAEPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu1qroA/GSce:rAEPO/KWvWeI5u1jafqLXO1BPS1
TLSH
T1B5D20A2B680CCB7E4F840E9DEC26AF966ED801CB67984D5447FA884C03C77EB51169DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index
Size 1KB
SHA256 57c4cdd1dcf72fa3518b4ba30227b33144c6e57773ebef15de4c9cb96a3dcb17
MD5 996a11f707c74a589f4fa04b7b1b40f2
SHA1 4efb36df84d355cd63f772cc82b6427eca934d04
SHA512 14d0e78bbd1c694fde1368be3b0ed4d7e86a576b1dc0cf588a25703a9a442fc5b193b04b4c70f221d2f63ef2f0adb0ac8cc73edc58324ebd02cd89fde88a7bf6
TLSH
T19121529D8E52851FE8A089B2207A64F433A0CECC6712A2A30C3C333B2E3735E2D471C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf5d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index~RFe5cf5d1.TMP
Size 1KB
SHA256 808bebebe6e5b5e4c07789fba842039d9dcdd57191a1cfc9cb0ccf62e8aee1db
MD5 727e17030dad40d67511983c66f13f6a
SHA1 dcfb47328a14997f35617f1481b6feb17d8b4dbe
SHA512 c8871812c9e0d941b8b6f13e46554ed59468e3284178b0abd0334a9d9894b8b037b69bb2649b647e7cd224ad7cdf9c2e597e024e48823289350f80abbe49f640
TLSH
T1C0211ECA8A96594FE8E495B60547A4F43334CC006323B793993A273E5C3579D49471C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 652bf9b95b4a533b78305a3e498fe77240eae59e86e6dda04d7d957502f3d3c4
MD5 9a1e7021bbc7df2ca1ccb8515e094a0e
SHA1 0a52304363b5ed17f5272d965cd253bf9a8202ee
SHA512 05db43d3ee402b07e2c8e534594010fe1ed32b362f19543f052ac0ab8be11412e872045e702cfebb3858071ad754b1e696871a0bd84abf200e56d881c2e2d6bc
TLSH
T170E068B63CB71C14FC6BC3C2A47054A400567A688A00EC8F141AA2CB30F5324344EC72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 528e778c7f7724b98e41cc808ee2829354065b9d621331e0eee0bce891a51392
MD5 cd27350d8e797742edda6489fd47d416
SHA1 22b919eb8f27a8d457d834e1b6c22b9b0518d1f4
SHA512 c5792d0cca2fe01d77e30b1f0055ab569254d920c7aabb349f4d76c5b0ecbfd0f48f0574a3e4b0402d607c1bdb22d1316c23d67ab51b260d7e1abdfdc05b5eab
SSDEEP 24:Kdvf290axdl1l4VfAzqaPdXD74z3+KIjf7KiUhax71EdrSmlMA8jIyXYffmtkaBs:KEx6I/K3qozypcI3KFWcF+IXKzKMPyD
TLSH
T1E2918911367A139138BE690D92A79A3B198131737204E96F7B7900E21E77E111EFDECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594e55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594e55.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f3f49f5f7fd8ef4f100fee2a62972c31a995c094a58b29a223b097e70b0394de
MD5 67e80a735c671f4085712a5f3572baec
SHA1 acf549138daac91092bd62a7e3537132266ff6e9
SHA512 6e39c8773f36cc16fbec25d4f5bd1d555e40156ff5d1b4a1f811a4ebe665245bd516dee335e1318f5e12168348d4e888a1c95e7912c64214a49fd9bd6743f82d
SSDEEP 192:uuLLsNgkpQ+BEqvq0mNQmiU1uRp4hC4XqMB/1jfX3jzocMet+XuHbnqQb/U8:n3sNgkpkXnA2VXq69X/hJt+Xwd/U8
TLSH
T12032F9326C78AC3B5DE7A585B04736139FB4501B9B883F84D6EC1B1C01DB39C535AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0367ffa051fe3c25b4f39e1325b2d32b33a2ed6e1045de97993f2c609c3b6a24
MD5 efe03dbf0c98f0dc9a5590e39135db7c
SHA1 40e0fe98a1910499f2aa725679d5e040f357cce6
SHA512 e0478dd8b7c9afa21aacaeb4629a5f5d0f732eb117bd23d0103143413776e32ee22c2b6342144d9fae1c5105ecc9e9f81b68e8a1cfdc425324baa9561f1c6e22
SSDEEP 384:nYGiF1tNn/s3n9S3zsNg8TUNTUlIlk0kXnA2nDfYjXq69X/hJt+Xbd/mn15wbAjR:YtF1j+9Mlwgp/rwbd/mn12bfwD
TLSH
T119B23832DC64CE3BADE39BC5B60B36479EE0516786C86AC4DADC5E4C01DB2DD030AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77c9940c582ee6d4a8375737a0e205d8e2d9dc6fa14af0494a0196c1fb678687
MD5 bf75f3c4dc4f24612b428d942ab757e0
SHA1 40882e0581b92ef423d2a33507f990aa4fc648e8
SHA512 67c42a14c6e72854f73ef8591683c1f89b8efe180d76e4b3bfa166a6cfd660f014e89e79e53bdeb1650e899f6f3aa7aef7304e3417ee122ead4520d11ec88711
SSDEEP 192:mOND6rvoQmiUyHKBDrKhD4XqMB/1jfX3jzocMeBExClU6:mOND6c5+6Xq69X/hJamU6
TLSH
T1A202E835A8786C7B9EE7AE49B0872B135FE4202B9A856F84DAEC1A1C00D765C1346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2a0e2d7865a9d81048ce26f888487aa8e3ba850ba6d53a79d9867421b674846b
MD5 3878c307140a883d85edf7e027d2e461
SHA1 b90bb6b412f14115827cec453eac037f2ab0f25a
SHA512 01e5f0ca28256c4093e405cf637af52a280f1e6c8d9935f1a26e789e9f54b609f13f337207cc5812cc723d6b5c3ae5c215890d1ac7d4c2907d8a61d85103621e
SSDEEP 192:lONB6rvSQmiUyMBDihD4XqMB/1jfX3jzocMet+XEICnqQb/U6:lONB6Kli6Xq69X/hJt+Xid/U6
TLSH
T118120A32A878AC3B5DD3B545B08736139EA4511BEB887F80D6EC2A2C01DF65C534AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 859739c993e41bf68248c8b687f4df428f446939aa46b44efc47349151350167
MD5 3a09c89a7f8dc20b53fca26294c0c591
SHA1 a2d65523584d7387f99fd6c4e94064b01f943870
SHA512 8a90a30bbcf6969f02c45b7ba35169baeaed59c6c530e59cad87658342090db4173ed8a73faf916649b30787d3bd1db4682bcd78413e9bea99e80af76fb3b211
SSDEEP 384:nJtNn/s3n9SfsNgk0kXnA2VXq69X/hJt+Xwd/mn15wbAjEwD:Jj+9UzEwwd/mn12bfwD
TLSH
T194926C325C389D3B5DD3A585F14736179FB4906B93C82F9486EC5F1D01EA39C132AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0fe3d71fbcd2bb037f7f1d6e750bcc6c5ffab1153790640f10e3f418f4d58a3c
MD5 038c593f0e92aedef50c0cbb60ddc62f
SHA1 f92b18409fae37674f7f60d55718e5b4696e7a0e
SHA512 e6bd7c45e987d1bd22a0aef4e1cf9e6a8286fb633353814f6d02c79f30617846eb4e135f6684c46bf7ecb463c9113ae2f7b131f459003ec818a217cdd68a1a82
TLSH
T1A141E748B6ED1108B3B76F5AABF7A86D587FB8673F06909E10110D4F0A66B40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

0866c8b6-f878-4458-b5f8-b9481ffc0adc.tmp

Path C:\Users\Admin\AppData\Local\Temp\0866c8b6-f878-4458-b5f8-b9481ffc0adc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2348_1039000646\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2348_1644673345\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download