b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
898s
max time network
901s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/06/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (2).bat
Size 44B
Sample260627-s3dsaabw2x
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\or\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4632_1692928821\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\is\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1880	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270483476946882"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{F43E1EB2-58B0-4222-8BF8-504C56CA8159}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4632	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3348	5092	cmd.exe	83
PID 3348 wrote to memory of 4632	3348	msedge.exe	85
PID 4632 wrote to memory of 2836	4632	msedge.exe	86
PID 4632 wrote to memory of 1880	4632	msedge.exe	87
PID 4632 wrote to memory of 1812	4632	msedge.exe	88
PID 4632 wrote to memory of 1812	4632	msedge.exe	88
PID 4632 wrote to memory of 1812	4632	msedge.exe	88
PID 4632 wrote to memory of 5352	4632	msedge.exe	89
PID 4632 wrote to memory of 5352	4632	msedge.exe	89
PID 4632 wrote to memory of 1712	4632	msedge.exe	90
PID 4632 wrote to memory of 1712	4632	msedge.exe	90
PID 4632 wrote to memory of 1712	4632	msedge.exe	90
PID 4632 wrote to memory of 4008	4632	msedge.exe	91
PID 4632 wrote to memory of 4008	4632	msedge.exe	91
PID 4632 wrote to memory of 4008	4632	msedge.exe	91
PID 4632 wrote to memory of 5116	4632	msedge.exe	95
PID 4632 wrote to memory of 5116	4632	msedge.exe	95
PID 4632 wrote to memory of 5116	4632	msedge.exe	95
PID 4632 wrote to memory of 4256	4632	msedge.exe	98
PID 4632 wrote to memory of 4256	4632	msedge.exe	98
PID 4632 wrote to memory of 1744	4632	msedge.exe	99
PID 4632 wrote to memory of 1744	4632	msedge.exe	99
PID 4632 wrote to memory of 5836	4632	msedge.exe	101
PID 4632 wrote to memory of 4136	4632	msedge.exe	108
PID 4632 wrote to memory of 4116	4632	msedge.exe	109
PID 4632 wrote to memory of 544	4632	msedge.exe	110
PID 4632 wrote to memory of 4428	4632	msedge.exe	111
PID 4632 wrote to memory of 4428	4632	msedge.exe	111
PID 4632 wrote to memory of 5648	4632	msedge.exe	114
PID 4632 wrote to memory of 5648	4632	msedge.exe	114
PID 4632 wrote to memory of 5072	4632	msedge.exe	115
PID 4632 wrote to memory of 5072	4632	msedge.exe	115
PID 4632 wrote to memory of 3968	4632	msedge.exe	117
PID 4632 wrote to memory of 1360	4632	msedge.exe	118
PID 4632 wrote to memory of 1360	4632	msedge.exe	118
PID 4632 wrote to memory of 64	4632	msedge.exe	119
PID 4632 wrote to memory of 64	4632	msedge.exe	119
PID 4632 wrote to memory of 4424	4632	msedge.exe	120
PID 4632 wrote to memory of 4424	4632	msedge.exe	120
PID 4632 wrote to memory of 2348	4632	msedge.exe	121
PID 4632 wrote to memory of 2348	4632	msedge.exe	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (2).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7fffb262c188,0x7fffb262c194,0x7fffb262c1a0
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,17651544340547092506,7285695539387886295,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
      4⤵
      System Time Discovery
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,4619868002918153046,12063136973091212785,262144 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,12813959791835278704,3832358654071762029,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:8
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,12953529263608750681,14441645444845219520,2097152 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,15064840496696679856,3245908830726538803,2097152 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4972,i,350015039927517021,18054741240185180182,2097152 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,1285629560855753385,8979038361306852930,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10027142735067263228,13590881452408606447,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17684507544383122382,5868151394507318522,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17684507544383122382,5868151394507318522,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,11854825839091396900,16966373742398338231,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,17172623715290225980,14634466637275634272,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,9197747590645697726,8859233906981493679,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,16922617844818865859,7256062841535161248,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,14625359147146478322,13874969083349226946,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,16730896006865371389,14659870683141559165,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=780,i,17203718967395191310,9373858657661080878,262144 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,1006188883356343012,2606594801522629453,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,12796175289424187788,8684804967532811847,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,263652528388483028,15765518471431832262,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,3173656430044873615,4406713748590956784,524288 --field-trial-handle=2212,i,6247707205766705825,4985396221630775932,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
      4⤵
      PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 83504b6c4fcb3f11e696b8b82c942fcab1fe48a715284a102528ce07da989bf2
MD5 1e22585a41389eed6975c683e4cbda25
SHA1 c6b67b85976d708401e133117f6302c41a6b6037
SHA512 d7c6e4938f69ef301b15d93899dbd753062de03534f93962ab9f4b70d8f3e00a5edce32e8f2944ab1718a38c58fe8ae3333a19842e4887e8fa7794c75ba4fa1c
TLSH
T141E0260483C6F3AA2307B6CF89BEF71C4450F05DF38FEA9D764660CA665A60156D60E8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1ae29d5c47cdbe0af514a23d0d56d61ff2b43895ad6735b06280e3022796ab35
MD5 f4ad85e2e1a580c06888335258c607a9
SHA1 6c210c70a0ded092c5f584921d6473413afcb4c0
SHA512 d79a1fbdaf07a768295a02fcd45d11ab1b47e9e3b7547925647043d0ae2fa127f14b9a3488aff601d2bff80c75296dea24c2020b02dc894a9dbb42c806a4e649
TLSH
T184E0784744C9F31D5500E8D7939C571C41C03E1FD6C59E4D7F00CD84328B340E6C2554
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6188e5e099a9b355b0b2547e2499cfb30c13506cd69d8dbed92e18b5d268a181
MD5 94687d3380236f41756b12e444d29393
SHA1 4f6d6d1a386b4b1e725f150f18958d5c1f627329
SHA512 f9e5193c4ec16424bf09b7f3c306617aa5f8e7ecd59066b94d8d5dd39149c5086878391b118dda1d899ba2c7d100b24080c1dcf0c6f20bfe1d20c1c95b19a420
TLSH
T1FDE026C484EEE31E9290B4CB4178532CC281F70E97CBAB5E5F14C8C5B206290B292590
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ae99fdfc3fbac7deff206af98556f3993f1c3f40fe1176939f3effc93833bc8d
MD5 9683ee0effa2bfca240118d3a9a92e68
SHA1 7f5846f3cd2adc8fd0788f67733e1a66a9a4502d
SHA512 063dd8a1a4838b395fcd50939ca3e5b24ac72a8407ffd4463838b0b2ee5bb8d41938609e4216ead91f6f1a45a694113987c815ba88fb7d83f6eb6cc2fa33d737
TLSH
T194D02B9AFDEC9E5ED7E41ABD5BA5B4000A4802A2840B9B1300747EC03495AF01E25030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4fec3f7d377f2020a291906448939b3f1e988f578984b96f70717906da9252ce
MD5 a84ed9d7a17724e9377db7189932a92c
SHA1 cb097570d2c83384f95b471df745a893e0ff76ae
SHA512 0b680248a42384abcba4eec45215161603debb072eb2ed66b377ceccb2e0563c23608d5b9e79fa6f6f1eb91506da8852d03255b6f30cc61f88c1ced80265e546
TLSH
T1B5E0E5AAC921DC3748FD172D64150647D700031A2F40855B3A3D51088FB273B168685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ed2f220a8ca0c61dc351ec2ffdbd68e01ea3e27e1bf0d09b01b9a56753e593aa
MD5 51ca66c640202db0b3e98d6be08d9f06
SHA1 3b15167e780af0cf3a59fd9b71c3ab4c18c125bb
SHA512 2a54d7e40d6cc1214c6a2c924d31f5c0229b4d9f5850e378c68b4540c109bf78f17e967b5d0d69125163f90e122fa21fd782ca0f81594b488a0ab28893e4c033
TLSH
T102819215511641EAFF99C032B0E01783717947FE872B3FEF3160A530372576A8742348
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5885b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5885b5.TMP
Size 3KB
SHA256 a4ec3b7127316d3541e46cde74d7c1cff0756e0d5315c978b0bfd06860d4f631
MD5 d16920b025e54f90ec190c9f56e081d3
SHA1 10a9c07928c3194f93694d1bac882c1ea7a894b6
SHA512 e0ba4d489923e01a0858c325a4b62c95940f2ee6c8b896504b886029768a7c93ee32367103a0c514b4f872d985fa6fb5b3f54a4ec8ee2c7e1dc93791db9af0dc
TLSH
T1AE716015551700EAFF98C036B0E14793B47A8BF98B173EAF36A0A5317B2536A4B52388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3f322bcf762721fc041005b8e7471c0d9e84794fa0f71a954d7d0fe5c38ffac4
MD5 048923a664618e03d6acfac9024b45f9
SHA1 e80ce7fd6c06f533869d930f52ff255846e7445e
SHA512 5fa4e220809d49898ff7ec070044ba588818db16280e905a124da827b090efc5fd9fef7ca4b4a697aeb6e7f1172e9d4f3807e255f75d9877755e00f3e9f7c747
TLSH
T13B71DEF783B4866DCA0195F0AA146F1BCE590524937C7DAA85E4FF47A3E3072E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ff7dea544476b8c4b9d9bb6948b117764b1b56d4e80f24f0144dd1f3f9c184fc
MD5 f84f38e6f7c8db5261febde08a0b0397
SHA1 a035ae5088873c7a58427e2cc008c1d96f6cb797
SHA512 a5d6cc37dbc0f2906cd4ad0f291a95648c357d82c9b79169ec685c53d1be455dd9e5e0d4ffe48f4f183d3a7912c46f5d72a0fe731614cbf10f8b8e23464723de
TLSH
T1C171CDF783B4862DCA0195F0AA146F1BCE590624933C7D5685E4FF17A3E3472E241A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b66f8bfc077227507593edd5dd65c2494619cb51b3cd6f7660e06fb092acf527
MD5 ca724ae0afe0ea8e56b03bc050cf8fb1
SHA1 0cefc345f15bcc7ec28362339b6a91a7dee91aa2
SHA512 2fa407042b09b8ff35461e972626b1719e6b4e4632e5f8c7de332962819a7978010afe618ba6028c6c3fd3fd102ed653b0ecc5aaafc75dd851f9e732e05e7c2c
SSDEEP 192:sxZs6R8yMqZjK1Ml8UQfjb/ffsebhuo43Mg1zodp+iIHW6+WNLipGt/YXjDACJHL:sxZRVq7b/ffsqQ1y8HbT/2XFhb
TLSH
T1CF72E816AA348977CCD7D209FA55BB53D7F8452292905E48AAFC8F0C05E7ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 28dd816946897c4ad2461e1b66f56ecad9c10833376915da526e3abbdebc3373
MD5 37d4bd749517975effaaa326ff3be74a
SHA1 806e595cd19a6dfcecdb64ff08722d184aa4cfc5
SHA512 1b4747f991b1b20209c37111d4fe729b26c3912e019c198d7f6e71ee49c51422a6d75f7720a8d93d7ebaa1b686181794af570b07b8ce97791a333e6a2f6b4f08
SSDEEP 192:sxZs6R8yMqZjK1Ml8Mjb/ffstbDuo43Mg1zodp+iIHW6+WNLipGt/YXjDrCJHIgH:sxZRV7b/ffsFS1y8HbT/2gj7
TLSH
T18872E816AA3899778CD7D209FA557B53D7F9452392904D48AAFC8B0C05E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d7795d9488432078f357b3422c751a301d472d1d217edbd1c24ce11d2e77fe5a
MD5 d535c9708b70f18c68f511c6e799dcff
SHA1 b0a59212522a3eff00f329b41dbe40b2a83e39c5
SHA512 ade394dd40dab3d6f65fcf96be0c7ec86effaeaf49d55164fdb7f697e5ea2b862655015810bd000d02e4123f2e9f20cc6707306c5e69b6daf8aa500cf7325078
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWeHiLl42vJ4ro6:/Zk4PfeEnXDWvXt4hu1jaLeHiL+QJDWV
TLSH
T1A6F2FA3B680CCB7E4F804E9CEC2ABE9A6EE8018F5698CD5447F9444C03C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index
Size 2KB
SHA256 ae197c82679ac159abfc7f41f9040939104dd38934b59f4754a27ef99687a528
MD5 a1ecb417b1543c9e6652b923bbcfc62e
SHA1 4c523a3fbcf116699d2864431a91e4760fb9b83e
SHA512 1914e81add7a94c41bb02aaf961e4d75e665378875b9822d5fb823bd5dcce0b176cd3e824f49ccea642584f2ba1c8680058789990a661f01719ede403936263a
TLSH
T1E751848E4D15965BE9F842B310B360903BF098CC2B1196135CED2236A88776E2C1B7A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb713.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index~RFe5cb713.TMP
Size 2KB
SHA256 7065ba834f4981cce291574a953107c8fd1f95309d2da8ef61f07929aa657f79
MD5 512b4d70303b1632a698b9a96d8db538
SHA1 ccf1aee389f08b38bf5dc0845ad06823ca3c82c6
SHA512 f1c7b5b3eb280b83528088d4826b7b0ba0dfc5e69095fd4a920ccd2e662222a0843173490fee93f5003e5652ad0ba00c8077ae444f8ddb29caa002d374753e11
TLSH
T1D651858E8E42863EDDD441B309D3A4A43739A90096557F4374FC9636ACD23AD7E1F2C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 78bbcbf229152b35923945f06bcd2218948be0451d01c5d263b459e9c2118913
MD5 bc27a846d1ae71f509a05e74188fd11b
SHA1 5828581a9c952693a97a2acb85490e3f90424f08
SHA512 08db5b1572d6e1b56c90fa98b91308fe2df4a47bff0fca0eda76a5b857c94d522aa90fcebec0058b8ff20bfa8d230d0cca8175918d04627c32aa3d8311ccfa7d
TLSH
T150E0C0FB2CD31D00ED7FC3C1347224514A1135988904AC4F102E92C3B0A16142813C73
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 abcae74ddcf839d5f0297f5ff3b593601d4d2750c78213d72b3dd47f4f5bab27
MD5 681d4d13124123bd972217b1264d5f0b
SHA1 f4f540887f5a1ef3a0e4d410891bb08b3505a85a
SHA512 87d4daeb7a0d8800b0e945131e8819e5c1b1e3f5873f14af4432ef1f103611e0057779e98d065145e69db45aa5aacb04c72dada7e4b20c38375e596e5cc5518f
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1eNJ6:EJGnYNSv9PpHV/qjQ36
TLSH
T1B9B22D13313A03423CBE2518A2A69A779E4232B3301DE66F77A904754E6BE125DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b4be26f24f7ccc4bb315239e67a75b9879207928acdddb35894a6ffd5651fa34
MD5 a7a0661d974a75de4ac4cdceed3b45d7
SHA1 0ddb36dcfcdd55e81b10e5bdf7dc007295c3cbcd
SHA512 c5e7e45d8e4db4606e1ee1a1d72cdbf7c968c221f23270beeed058fe1ad134721440cfa141e32e3d0d81f905ab3bb3bd50be09fba5e7f2938c0d7fa417b7b667
SSDEEP 384:nmDiF9CcmyWCs3sNJ8TUNTUlImkrzoNmfsvweflV635Q1JUahkP+lFYS/4RHy/79:muFccps36wgledVEQ1dhkoFYS/4g
TLSH
T1E1B25B36ECA8CEBBEDF64FCAEB4A7A47DEE00163858859D4DAD81D1D008719D1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a949a0fb408d4044ec3ad7cee0c042002e578473e9ae7bdd7a60b2bec66e79ca
MD5 667a3069c748fce2f7d472e64182feab
SHA1 465cd4fbb0dd8570802a9393f0ee788c842f5781
SHA512 8ddfb9d54a6651e5d25823425e999aa156c216835ff1f02f8866f0f68c09e42178f7298082e1b86f70acd772bac52a24c4101f4ec9d902bfb75087e03070a20b
SSDEEP 384:nliF9CcmyWC+K3sNH8TUNTUlI4k+zoNmGBMrweflV63CrsgQ6JaNHy/7IgT:sFccp+K3YwgUdRVhHQ6Jai
TLSH
T1B3B22A32DCA4CEB7ADE64AC9F75A7A03DEE0426386C85AD4DADC1D1D019B19C134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0c669cd6ee4a390f19644bbb571ce94e469a398fa980f45233af2e3e1bab035b
MD5 ad8ed1bc18ae900966f4c809d0f173fa
SHA1 0011766be4f5e659721c08e5ff8c4acede33a517
SHA512 a95001540f98209c7f390ea9aa9634217e54ff03006dfb54ef5021f5fa195c1ad293abc2c82ce5f24202f95c93268b5343658c17cd830132c061f3f74ac23dcb
SSDEEP 384:nliF1tNn/s3n9SGK3sNH8TUNTUlI4k+zoNmOBMrweflV63CrsgQYJmn15wbAjENH:sF1j+95K3YwgUJRVhHQYJmn12bft
TLSH
T1C6D25B32DC64CE77ADE78AC9B74B7A07EEE0426386C85AD4D9D80D4D01DB29C030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b1f1f236edf4300e19d2e8e01a5a8cdafd1f884c4fca88f66c71ec08188a6352
MD5 c86642619722503dca0710abb3db6fcf
SHA1 fc289399b45381aff5b2e94538bff061001cf6d9
SHA512 e1b463e216183e03ce1b4ebcfde9d5f03de666c1c8838d1ecf6b756cef13dd37f8de0d8131b5248ffccbe38e2845cf417792092ec81a93c913ab86dcf58b2a2f
SSDEEP 384:nciF1tNn/s3n9SGK3sNH8TUNTUlI4k+zoNmOBMrweflV63CrsgQYJmn15wbAjENH:HF1j+95K3YwgUJRVhHQYJmn12bft
TLSH
T146D25B36DC64CE77ADE78AC9B74B7A07EEE0426386C85AD4D9D80D4D01DB29C130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 00a29ec8b6b024e267027995f506e19dd58319f1ca6aa2245ccce647c7d74b71
MD5 94303d622df7bdec68a5f6c3a63b5f6b
SHA1 a0d479da70979298955eafc16b3caed40856d693
SHA512 7fa2af8a1d062422ad318a038246cd322737bdc79655bdba6d8ab359f1d358b7608a775f51acebc2d3a7e411f3f450176d8cbb050ab6206c7eeab55ab5fd2b55
SSDEEP 384:nniF1tNn/s3n9SxKK3sNH8TUNTUlI4k+zoNmOBMrweflV63CrsjJmn15wbAjENHn:iF1j+9XK3YwgUJRVhMJmn12bft
TLSH
T1F5D24B36DC64CE77ADE38AC9B74B7A07EEE0426386C85AD4D9D81D4D01DB29C130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b25f3c59cfb65eef6b8c77175c4b1ce6f01dfc6162390003602518e02d8d010a
MD5 f386336ad553fe6b4033da1b9b56d060
SHA1 afa8cb91837846d30bcc1676673cdd30fef7a8d0
SHA512 468a7ff21393e67b75aed885c7be95f7c87c49db85c4520d65134584b8b15ae707adb5ecdaeb49e37d8430d3d2a362f45c9910034b3ba1de9cadd2e8c5ff3921
SSDEEP 384:nTiF9CcmyWCs3sND8TUNTUlImkrzoNm2aIweflV63CrsgQ6JhkP+lFYS/4RHy/79:+Fccps3owgl96VhHQ6JhkoFYS/4g
TLSH
T1A1C25B32DC94CA7BECE68AC9EB4B7A47DEE04263C68859D0DAD81D1D01DB1AC034BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fc01ef8ea8a2d4b090e005d8af5b7c81c419e73ac7b986602fc49127becd9551
MD5 a498d79e8a08382e9871f8431efbf476
SHA1 adb3998adda45381b187436468201baea9ecd0f6
SHA512 c415c5dc92dcb6f9483831dca5651657f7d5b8b98ab445de7eeb182f25eba40949c5443ff8724ffc61846100debea38fb1baf1a9d63a737aaa850d1da385a30c
TLSH
T16F41D759A6E91148B3B77E56ABF6A86E487F79772F07C19D00110D8F0A62B41C872733
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4632_1491093820\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_964266828\_locales\en\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download