b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
899s
max time network
897s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/06/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (13).bat
Size 44B
Sample260627-s3dsaabw2x
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270483472903434"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-42486406-2033776002-1658862356-1000\{1A70C5EA-569D-45D5-B317-455D986D2E11}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 648	4420	cmd.exe	83
PID 648 wrote to memory of 1180	648	msedge.exe	85
PID 1180 wrote to memory of 4308	1180	msedge.exe	86
PID 1180 wrote to memory of 4708	1180	msedge.exe	87
PID 1180 wrote to memory of 3520	1180	msedge.exe	90
PID 1180 wrote to memory of 3520	1180	msedge.exe	90
PID 1180 wrote to memory of 3324	1180	msedge.exe	92
PID 1180 wrote to memory of 3324	1180	msedge.exe	92
PID 1180 wrote to memory of 3324	1180	msedge.exe	92
PID 1180 wrote to memory of 2692	1180	msedge.exe	88
PID 1180 wrote to memory of 2692	1180	msedge.exe	88
PID 1180 wrote to memory of 2692	1180	msedge.exe	88
PID 1180 wrote to memory of 1236	1180	msedge.exe	91
PID 1180 wrote to memory of 1236	1180	msedge.exe	91
PID 1180 wrote to memory of 1236	1180	msedge.exe	91
PID 1180 wrote to memory of 1360	1180	msedge.exe	93
PID 1180 wrote to memory of 1360	1180	msedge.exe	93
PID 1180 wrote to memory of 4816	1180	msedge.exe	94
PID 1180 wrote to memory of 1360	1180	msedge.exe	93
PID 1180 wrote to memory of 4816	1180	msedge.exe	94
PID 1180 wrote to memory of 4816	1180	msedge.exe	94
PID 1180 wrote to memory of 1652	1180	msedge.exe	97
PID 1180 wrote to memory of 1652	1180	msedge.exe	97
PID 1180 wrote to memory of 5048	1180	msedge.exe	99
PID 1180 wrote to memory of 5048	1180	msedge.exe	99
PID 1180 wrote to memory of 3872	1180	msedge.exe	100
PID 1180 wrote to memory of 3828	1180	msedge.exe	101
PID 1180 wrote to memory of 3872	1180	msedge.exe	100
PID 1180 wrote to memory of 3828	1180	msedge.exe	101
PID 1180 wrote to memory of 1048	1180	msedge.exe	102
PID 1180 wrote to memory of 1048	1180	msedge.exe	102
PID 1180 wrote to memory of 1048	1180	msedge.exe	102
PID 1180 wrote to memory of 1552	1180	msedge.exe	104
PID 1180 wrote to memory of 4148	1180	msedge.exe	105
PID 1180 wrote to memory of 4148	1180	msedge.exe	105
PID 1180 wrote to memory of 1692	1180	msedge.exe	106
PID 1180 wrote to memory of 1692	1180	msedge.exe	106
PID 1180 wrote to memory of 5112	1180	msedge.exe	107
PID 1180 wrote to memory of 5112	1180	msedge.exe	107
PID 1180 wrote to memory of 1508	1180	msedge.exe	108
PID 1180 wrote to memory of 1508	1180	msedge.exe	108
PID 1180 wrote to memory of 5048	1180	msedge.exe	109
PID 1180 wrote to memory of 5048	1180	msedge.exe	109
PID 1180 wrote to memory of 4604	1180	msedge.exe	110
PID 1180 wrote to memory of 4024	1180	msedge.exe	111
PID 1180 wrote to memory of 4336	1180	msedge.exe	112
PID 1180 wrote to memory of 3252	1180	msedge.exe	117
PID 1180 wrote to memory of 3252	1180	msedge.exe	117
PID 1180 wrote to memory of 4280	1180	msedge.exe	125
PID 1180 wrote to memory of 588	1180	msedge.exe	127
PID 1180 wrote to memory of 2920	1180	msedge.exe	126
PID 1180 wrote to memory of 2920	1180	msedge.exe	126
PID 1180 wrote to memory of 588	1180	msedge.exe	127
PID 1180 wrote to memory of 4280	1180	msedge.exe	128
PID 1180 wrote to memory of 4280	1180	msedge.exe	128
PID 1180 wrote to memory of 5112	1180	msedge.exe	130
PID 1180 wrote to memory of 5112	1180	msedge.exe	130
PID 1180 wrote to memory of 688	1180	msedge.exe	131
PID 1180 wrote to memory of 688	1180	msedge.exe	131
PID 1180 wrote to memory of 2096	1180	msedge.exe	132
PID 1180 wrote to memory of 2096	1180	msedge.exe	132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (13).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffe340bc188,0x7ffe340bc194,0x7ffe340bc1a0
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,2985663066028058307,14641589710991897075,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
      4⤵
      System Time Discovery
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,409206139342867262,2817380757549198745,262144 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,5784365232149324695,8792656688078750672,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,16281320757215115467,17195525835269270081,2097152 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,17390805497976415640,2915651050201344176,2097152 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,390730943804980781,11738862608513733275,2097152 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,17269398247253228438,13131761460255992097,2097152 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10717752423800145096,8169757304667594222,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,10827471927373196690,17771595265064556250,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,4307371935516493612,18364564719517709621,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,8435660669901029933,10895564072477639069,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5676,i,8993356014973062939,16878851040559985743,2097152 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,7243311934584608045,13558711876570445086,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,7243311934584608045,13558711876570445086,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,15816832945239611257,8363066942501260522,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,5232188961524430427,2259438944411322646,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,351775640544273122,6841453675188036051,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,11286653235376982087,7907498566106767659,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,8425197135526166674,2459917027389797453,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3352,i,13567931896641326877,7177294182097200058,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,13653011353227132690,6503386784157194827,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,7457241243131883071,13097524058299650518,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,7066180017818083399,16192129404316639309,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6680,i,11838102184838248806,17588424922199901067,262144 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,15581321459001397587,11413949784505485300,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=1056 /prefetch:8
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,5597506604424014464,2946027237275895975,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
      4⤵
      PID:588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,5816632487223577821,5415554454206340276,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,2376932982035255847,16088566912762388746,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,14609508864074929860,8124556483713298230,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
      4⤵
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,11586317692050679668,2061181890035287248,524288 --field-trial-handle=2348,i,3094641321226310732,14481963974708981833,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
      4⤵
      PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a64f2ae6a6617d628aecf24522b5fc03d56fd3b87da29c09e359aa8c784278c
MD5 319f3e9547ae8f5bd93b63a209353feb
SHA1 2cbbe39cbb469d1b008a38a5f66950de62d7be5d
SHA512 2335ad7dd232ded853c12042411a51f4c045d5ae5954aac7df9f840b69e4aee72129d3b0d5a528b94f8c84e50d9f92ecc1fcda50496c846e7b2b716f7e287127
TLSH
T115D080F777586105E75DD131EC13CB111B65195215D7DB02E314C99CA4644F566871C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5c85913b3d3cab7ba2879d18441341b2b4fd7ad9ce12d0c3ebfe421e6267c647
MD5 962c87a3f67f82f2083d6294250d9e58
SHA1 cfe9fd1f6729400cde038cbdead8751b96eacaca
SHA512 059eed3376b6b470a0be74a5db7d47fa3bae4b0557c4216789040d711e15417470e3ff6f96808c2e42bf6080c9af25da282ed4dabe378bd81b0971591713ef3b
TLSH
T11FD080F737586105EB5DD131EC13CB111B65195215D7DB03E314C99C94654F566871C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 5fc5ce0fd0d84a806e8daa37204dbb193eba6c76cab91fa46ac46d299492a35d
MD5 53030e3f2945aeda3238aec05139e28f
SHA1 9b7dac092dbaf06cafe28b9f3433e7a776f8f359
SHA512 fcb1408df8e007bab5992535d45a2cfa860927be1c5b8023cb3d1bf38d4211abfe8543b8ce93b76781e9eb79d1d7ad510902a933089379be8b3b066162e90236
TLSH
T1C1E0204482F2F3E8116194CB807CA33C8D07F61F934F5ABD7325788879C51805161491
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a9368f793d00b04dcb809f8103a1a91aa9f44d86185df3e322defc4725a66a55
MD5 cdd579c01947ee04ee6e4a3d082b0d7f
SHA1 ca95140135968d45efe060ba52031f5c8d47fb4d
SHA512 27436997371ae39c172d467143be9a0aa71c835495fb9048ac59974f44c16777e109190628d6db116b3c0898c3d36e3abf7f8df64fec488f1b4fbf690cd132f3
TLSH
T15EE0209446C5D31E9590F8C74378D70CC2D0360FD2C66F4F3B04C8D43347D8066865A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 5ab0bcf34d3cdfbe63ca527f5643cfbf48b14b61742d178ce3c5a052c2318b14
MD5 ac0a5eac480a4a651a73cc41b0314c96
SHA1 4153ed48cfcd9041a64fc628d652177fb1492bf7
SHA512 1845ac524ed2afa928583fb6f4237bd969a9fe69a5eb0e2b52486cfa7bf4ac541dd1ba0f317c05895d5f63e366dc86a06c40a70e30461fe1ef8419c2d551956d
SSDEEP 192:djQ0cx3mhYY444XXXGGGGlllMMMrraaaaaMQh:djQ0cx3mhYY444XXXGGGGlllMMMrraaK
TLSH
T195E16846C3D5E79AAB0620DA49A4635C0071770EFBDEE61C138C89DE318F5DFA4F66A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 275B
SHA256 a0591e1b57aab72b5b0b4748f2b9850c49b0612c97e79d457b69759fa9c11b08
MD5 f915042851e8f590c36df2ba86d26d64
SHA1 ca87c792ec528eec8ae4a248f53aed28e6af179c
SHA512 4e06f9a8e9337a4e0ba75afa230a3df054713cec786dd48b34bb5fcd266e62d1fe8e780872627507873f09c4e5458c92cb5f7977d6e95f9a95275ec46d43aea1
TLSH
T198D02BE9BDCCD98ED3D11AFE4722B4000B5563A3881BAB030520FCC03681AF01F25124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2f61e548b62947892b6d050c66db5dd037a278e3df39c191609e14f9e154e96
MD5 d39f0424a28a6655ae02093fb4c83d75
SHA1 c7fcdab1c53cdd6530681a8ddd212739e6171808
SHA512 00790124f5bdbda1e942e527bc54550f7f72107ff841cb05009408903f207ea76d4a546a2e2402bd3572bbece9584068f1940bacaf083a8d4efb38b22507ab16
TLSH
T12781510A06F704E0EF8DC27175D122833676457F7B576E9E50C654B83B157B093EC058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58729b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58729b.TMP
Size 3KB
SHA256 4df7f871e50852d59c067f6e4475da8aa63c57b81436e843c029223c8893757e
MD5 e2fea07526f5f44138ec37d54468e88c
SHA1 4f18c719fc159a5d600f333fac21c13d5dbef3b6
SHA512 93937b0faa60468f6cd39dc774323df93a5a1e2e76f748be250526d5f954a9c5c0c0b8e13f6d70b13e8024d6b43198f89297c7d3a3de63fcb43eeed39dd3dd2f
TLSH
T15971950A06F308E1EF8DC271B9E11283797589BF7B636E5E50D695B93B147B043EC058
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 44a6fc8d3de65f466053b8cdda48825c7fa69b03f30689ce25b1d84e210eff2d
MD5 206ff792b5e49044461c182ae441a701
SHA1 23b6d135fcb535250d4f055083fb57716143636f
SHA512 ce62bf8c905a32fffa63d2a3d0d9da0219c79f4a08e4d81369bcc8f3e185b564730663d2b5fd84d0713e2f0ea74c1e4c8afaeaee1dc81e81b866fa0632badc0c
TLSH
T1FD71BEF783B08A6EC91195F0AA146F2BCE590124937C796685E4BF47A3E3072E245B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 84179ac44008760bd1aa96db4af45bbd123b734a26ab1d2808f4304e2f4e409d
MD5 9af760a5a7ad0221c5ccd1fb6765d7e5
SHA1 9ac67eef765ca0eaef9faababe240c418d7cca31
SHA512 b96ef2ffa4c8ae981424d6a350e3a614d889fb3bc172ea7263da56332655a7688faeb2afbf54e2f33d4e51e4065d0f120e8eb27429c951fee907c681936c0e9e
TLSH
T16A819AF783E48A2EC90195F0AA246F2BCE590624937C7C5685E4BF47A3E2472E24164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 da33e3de2bd5ac33bf7bee4180b15c00ec39d79cfeffdd572383186c9c10d4c3
MD5 a45680f9792e6b2d2ed632512f5b1934
SHA1 41dfba0a82e41955bf01c5141d6bfe59613edbf2
SHA512 abcca490e01d54c2df2e615358539436c41b1590f3a5e42768090e46d709e94807d882769353c229c1b2b8d68760209a09f3e870531175661b63a62eb50ce905
SSDEEP 192:sxZGRmyM/jK1Ml8UQpi8/fmsYDHYIdp+4HW6+WNLFJ/YwwVG2vIg5sJ:sxZGAqw8/fmsYDJnHb//IS
TLSH
T10D62F916AE349977CCDBD209BA517F53D6F4547296500D8499FCCB1C06E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 989c663ef614d51908de5c94bce8c5119f164c3824f93e6773825928faa08921
MD5 928a183b9c2d114cfddf03d4582edc08
SHA1 2496061ed49ca0fdce7e3a463bcbb66aec997f5f
SHA512 e78eb2f94b064d6af89fa7d7760973bdf32a7abc2c7715b7a82bccf0df41e77474e5a19da98c46d634881415af7fac0b6b3bc64328f4f12a90f9f75f7ac81da9
SSDEEP 192:sxZGRmyM/jK1Ml8Mi8/fmsL6HYIdpY4HW6+WNLFJ/Yww2V2vIg4J:sxZGAq8/fmsL6JpHb//Mc
TLSH
T112520916AA349977CCDBD209BA55BF53D6F50563D6800D84A9FCCA1C06E7AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 ec339d67c12fd484c4325cdc7803ee76126c4edbcaebeee66d9df9972b184865
MD5 97f50872170a33e22826662f0288c17e
SHA1 05a7cf01c4fd8d6c53d7a8e9cc9d9c64661d82d5
SHA512 1ae1ed989459bee2ffcc031b160abeeabeffd23f2865d68d5767df91086bf0fcc685dcc91affc9d6a9beb7237ea90eb058d950542578eb913368432c82797af2
SSDEEP 384:sxZGXqw8/fmsYr66s8qMpRiYnazAW8pZS15posJWeT+eJnHb//cS:se6w8/fKr4Mnc7WeT+eZHbH3
TLSH
T166D208059924C877CEC39E18743D7E33D9EC50525285CEDA1AECCA1C029E5FCAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c26ebc6281d63dbb1a08db7f5fa68fe35856bdd173a9e9b7725c730f37670e28
MD5 31dd9c166cead21cbfb4e45059bd7676
SHA1 1a9262feba6f04e6950a7571136d459ce49281f0
SHA512 0fe96915da1233a1848d00c4cf24cec0132c854e2a4b47ad699b363e50c69d67e1ba46efb2af23e4164345493e533d86a89a77fadb650c92c5c1c6cefecb2b2d
SSDEEP 768:MJ4Tao47pLuL7yWWvyaZy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGYDhLlJX65nro6:MJ4TaokE7yWWvyaZyu1ja/YDhLHq50sP
TLSH
T1AFF20B3B6C0CCB7E4F844E9CEC2A7E8A6EE8018B96D88D5447FA444C03C66EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cb27021c-049f-4516-9734-b16a4f0e9c30\index-dir\the-real-index
Size 1KB
SHA256 ce2d3df69abcb32f97656ec44874d74d16d863d4d47811039b709c4c64cb29f3
MD5 fc715db82bf547b10313d42773a011f7
SHA1 6a7a24970a84bf2652960aa1690a129a2c5c670f
SHA512 46d09d74effbe932862546dffcbf2cf05e687b375dcc372e7cb5b3f9919838a0f0d70198efeccdeecfcd2b30a380ff557ce2cd6825216f0bd78b1674d177f6c6
TLSH
T1613151CE8E45969BDD9449B218B260B833B4C9CC6B11A3535C3D32367C2336A1A9B5DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca262.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cb27021c-049f-4516-9734-b16a4f0e9c30\index-dir\the-real-index~RFe5ca262.TMP
Size 1KB
SHA256 62e066d94e3c02fe7f225fce83e179b232c14121ef205ad92fad5eba72b0eb8e
MD5 24cc9aab8a5eb92e618c51ae7a6c9eec
SHA1 1d2588ee9ed88bbf871c60b36027243369140ef0
SHA512 b0e7c35101dcd6cdd9fadc4e892f79f1292b277c64ea17d29ae09ed1f37bf9eb788c7cee066b66d15ecbac230bdc942ed83f755746007396cb845cfd7ffbf033
TLSH
T1FA31968A4A41870FECD440B60997A4B83379D8405322B387947C6639BC767BD1E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 36ac35baa8fed4fe42ca966315e5326293427ffe3bd6abd890771699ca0a6e2f
MD5 e72c3698ed58249db2dc1726b1ede272
SHA1 8fbe03859f936070e4fbbf9de94b6dc3b4cdda63
SHA512 ba05937c7c45da5d5d162f9937e9d2492654e9eac84394f9dca67b511a542766fcccc4eeb5bc3328a70b0ee535f40984acbb18c5945595195eb6fcf16b6da0ec
TLSH
T1B1E0207B9EE70C60FD7FD7D67071486805457844D585EE4FA42A75D3A0613053846C62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b518c8a71b0838c3f4099c6448750e1a179912324128eb004092bcc86cc50d63
MD5 8dd170f8e801cfe5613cb9ce819b7038
SHA1 2ecf6c5e4c8ca06014cc60474c00c8a4d2cff392
SHA512 f5cc2edf17d11a01b14b7c466c9b1411aab0f0396babac77c9b62ff03e54cd1629a63ac310cdda148339d2a225f15a941e292d16765291fd4aff0dc43cb70d2c
SSDEEP 96:KsOeOROAOkOeOQOwOx7OEOrOsJOsOxKhO4JO+OxtOGOOOzOsOwOSaYYK52u/+sKN:mJIrXJ7bc36rvF4Qpih5yvbSrfYSxLO
TLSH
T170E12942713B129228FD290893A197374E813173311CE6AF7BA921A21D6BE135DFCECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8ab08d8-073a-430a-bb4a-9c3346a4d02f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d8ab08d8-073a-430a-bb4a-9c3346a4d02f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9645e00b48448c75c24777118e5d0c40f1763a598cf079ba15e456cd64214d04
MD5 bd4d81a8386f84043dbceb1dd7073076
SHA1 70f23573caba534062d9f40d37fb36a3c42a4add
SHA512 6854a174832f6bcaf9931c78af6f6130453eac1f657cd4ed75c497d61e1080f68caf2b0fb765ea127fe20e42b2295372aa7a28abebf0fd7249c21b5f0c5bb14f
SSDEEP 384:nAtNn/s3n9SfsNLkJoGmJOHwi4UiX1N+TrP9Imn15wbAjE5:Aj+9UW2Qi83wpImn12bf5
TLSH
T13A927C369C2D8C360D93A485F04B36175FA4947BD7C82FA8D9EC5F0C06DB398531BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d224d38e3bc8daab9afd4c413c1c1612c0aa8817a7fef7635e186a1681b8cd1a
MD5 bb5aaa93e78dd090f38d500def73e2b4
SHA1 ca002cd7139cdbeff6b9e483a27a40999aa11d17
SHA512 dd572e3726b176d3cf32d619c4b73de4a103c05d635364a8da073805790b56b6f20f1d46d90088f3d845f42026e14c86200db0e4077ea07dad108b00dde3b135
SSDEEP 192:mQJONT6zZU77QmiUyqBzmaU9X1N+TRwE7FlU6:m2ONT6t2tzzmaU9X1N+TrHU6
TLSH
T12A020A39A87D6C7A8EE3AD05F4873B135FA4102BDA952F94CAE81B1C05C765C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 cba8a76615bbaa6c0e986577ec546db1eb3e7fa10a02d00669ec18c8dd85cbaf
MD5 d0adf22856acfaacd6c964cc6388da0c
SHA1 09bf6a45e619b18714bbcb33abc49bd6ce1b8311
SHA512 37c9e7eddb4bad85899ba0b8a622ed507f48151fec7825bb6af7c812b9a5fc4f1ea2376721298884c2eb39ea2f90f5e702d596383e1b4b5c084fb6bfe1dcf5a0
SSDEEP 384:nCiF1tNn/s3n9SbzsNV8TUNTUlIlkJoGmJOHwi4UgDfQdX1N+TrPnImn15wbAjE5:JF1j+9QEwgH2QiVt3wbImn12bf5
TLSH
T197B23936DCA8CA3BADE39BC5F60776179EE041A786C85AD8D9D85E4C02C72DC130BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 576580931b1abd18dfb18e1dbdb3ab895a8e84143bbb488af9d0050313f97cfb
MD5 08c26d0c26345eacdc0ba2ba7e4f8a0b
SHA1 c5d283d641c065899b8c5ac60a3630671eb14cd1
SHA512 0a33884021676ae4de7472992338516d771d27389a482560e2b0292a4b62259d77a536a9b7670a3a3db35e54bab96f09f5607dcdc8222bd906a099b50a7e3415
SSDEEP 384:n/tNn/s3n9SfsNLkQoGmJOHwi4UiX1N+TrP9Imn15wbAjE5:/j+9UR2Qi83wpImn12bf5
TLSH
T1CA927C369C3D9C360D93A485F04B36175FA4947BD7C82FA8D9EC5F0C06DB398131AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f4c2eecad065d1d00c2df10a0f4a97273ceb35b8ff5411241e28e70388ad461
MD5 5ada9599b862c3c537cad7044672c241
SHA1 b23cf088fa76261c2b76252aad41fbaced89814f
SHA512 acdb40837df89766b27eee073d0e466af5b7bfc091ce7a4c599b88238cc496d99492d191e58cc01beade4db2fcf253320aae61301321a0047caf71f819395fc2
SSDEEP 192:6ONW6zZUQ7QmiUy4BzRU9X1N+TrPWBs/mq8U6:6ONW6tttJzRU9X1N+TrP5IU6
TLSH
T1F6120A36A868DC3A0D93A541F08736135FA1512BDB896FD4C9EC2B1C06DF65C630B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 263805c035b46700bb4c61611f7406ea0d4b36240264c4375cf3658dd3d9d0de
MD5 328e2839b5b597df998423ad59fc4ef6
SHA1 8ce87f06f95c3659c2ca54045050025e240be157
SHA512 20082d20a5460c35627b93a3fb690a4c846dbe3f6ed39bcd4624403639a774a30c2f9ecba1c84dd9421f0a301db4d366ad9f824476a43477befbb5f3c558b040
TLSH
T15941F85CBAF91148B3B77F56AFF6A86E887E7D372A06C45D00110D4F0A23A44D961B37
MD5 SHA1 SHA512 TLSH

Submit Download

8241c83d-8a1a-498b-a1df-3bd1d6bd4dee.tmp

Path C:\Users\Admin\AppData\Local\Temp\8241c83d-8a1a-498b-a1df-3bd1d6bd4dee.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1180_61660260\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download