b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928

max time kernel
898s
max time network
901s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/06/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRANTEST/testplusminotaux - Copie (3).bat
Size 44B
Sample260627-s3dsaabw2x
SHA256 b2a6dcdaed01552e0d257db981aa9b1448c9b69a832240a94faa68a6b7d8c928
MD5 af8890f3b8814d1ac27feb0ed2bbdae4
SHA1 0c4edede7c376cba40785e5de7a4176445e37a72
SHA512 8fc5e986a8ca002b4dfb68c99870c98a2faabeb36fb741b9edb1717f271e662f2625fc91ba726758502f9b148ce54179125c1902677a55c17984e7aa6caccc6c
MD5 SHA1 SHA512

Score

7^/10

discovery miner

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270483476534991"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{D0EDCB6E-52CF-4DEF-A853-D58AD88606CE}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4588	5072	cmd.exe	84
PID 4588 wrote to memory of 2804	4588	msedge.exe	86
PID 2804 wrote to memory of 1492	2804	msedge.exe	87
PID 2804 wrote to memory of 3636	2804	msedge.exe	88
PID 2804 wrote to memory of 3288	2804	msedge.exe	89
PID 2804 wrote to memory of 3412	2804	msedge.exe	90
PID 2804 wrote to memory of 3288	2804	msedge.exe	89
PID 2804 wrote to memory of 3288	2804	msedge.exe	89
PID 2804 wrote to memory of 3412	2804	msedge.exe	90
PID 2804 wrote to memory of 4764	2804	msedge.exe	91
PID 2804 wrote to memory of 1748	2804	msedge.exe	92
PID 2804 wrote to memory of 4764	2804	msedge.exe	91
PID 2804 wrote to memory of 4764	2804	msedge.exe	91
PID 2804 wrote to memory of 1748	2804	msedge.exe	92
PID 2804 wrote to memory of 1748	2804	msedge.exe	92
PID 2804 wrote to memory of 4852	2804	msedge.exe	94
PID 2804 wrote to memory of 4852	2804	msedge.exe	94
PID 2804 wrote to memory of 4852	2804	msedge.exe	94
PID 2804 wrote to memory of 1016	2804	msedge.exe	95
PID 2804 wrote to memory of 1016	2804	msedge.exe	95
PID 2804 wrote to memory of 1016	2804	msedge.exe	95
PID 2804 wrote to memory of 1456	2804	msedge.exe	98
PID 2804 wrote to memory of 1456	2804	msedge.exe	98
PID 2804 wrote to memory of 4320	2804	msedge.exe	100
PID 2804 wrote to memory of 4320	2804	msedge.exe	100
PID 2804 wrote to memory of 376	2804	msedge.exe	101
PID 2804 wrote to memory of 1216	2804	msedge.exe	102
PID 2804 wrote to memory of 376	2804	msedge.exe	101
PID 2804 wrote to memory of 1216	2804	msedge.exe	102
PID 2804 wrote to memory of 4004	2804	msedge.exe	104
PID 2804 wrote to memory of 232	2804	msedge.exe	105
PID 2804 wrote to memory of 232	2804	msedge.exe	105
PID 2804 wrote to memory of 2116	2804	msedge.exe	108
PID 2804 wrote to memory of 2116	2804	msedge.exe	108
PID 2804 wrote to memory of 4072	2804	msedge.exe	109
PID 2804 wrote to memory of 4072	2804	msedge.exe	109
PID 2804 wrote to memory of 996	2804	msedge.exe	110
PID 2804 wrote to memory of 996	2804	msedge.exe	110
PID 2804 wrote to memory of 996	2804	msedge.exe	110
PID 2804 wrote to memory of 4332	2804	msedge.exe	115
PID 2804 wrote to memory of 4332	2804	msedge.exe	115
PID 2804 wrote to memory of 2040	2804	msedge.exe	116
PID 2804 wrote to memory of 2040	2804	msedge.exe	116
PID 2804 wrote to memory of 928	2804	msedge.exe	118
PID 2804 wrote to memory of 3844	2804	msedge.exe	119
PID 2804 wrote to memory of 2356	2804	msedge.exe	120
PID 2804 wrote to memory of 2396	2804	msedge.exe	122
PID 2804 wrote to memory of 2396	2804	msedge.exe	122
PID 2804 wrote to memory of 1792	2804	msedge.exe	125
PID 2804 wrote to memory of 4788	2804	msedge.exe	127
PID 2804 wrote to memory of 4788	2804	msedge.exe	127
PID 2804 wrote to memory of 3604	2804	msedge.exe	128
PID 2804 wrote to memory of 3604	2804	msedge.exe	128
PID 2804 wrote to memory of 4500	2804	msedge.exe	129
PID 2804 wrote to memory of 4500	2804	msedge.exe	129
PID 2804 wrote to memory of 3704	2804	msedge.exe	130
PID 2804 wrote to memory of 3704	2804	msedge.exe	130
PID 2804 wrote to memory of 3952	2804	msedge.exe	131
PID 2804 wrote to memory of 3952	2804	msedge.exe	131
PID 2804 wrote to memory of 3160	2804	msedge.exe	132
PID 2804 wrote to memory of 3160	2804	msedge.exe	132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRANTEST\testplusminotaux - Copie (3).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://viewer.pandasuite.com/bRQoMtfn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://viewer.pandasuite.com/bRQoMtfn
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2a4,0x7ff88b66c188,0x7ff88b66c194,0x7ff88b66c1a0
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,18332388609674915643,10280709334913412274,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
      4⤵
      System Time Discovery
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,9662407339102465419,11602939361236575875,262144 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,10858556383097276256,16060855703885529799,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17676640579222201482,4749295249642270202,2097152 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,12434015596582157735,7172397854187024236,2097152 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,14706533626853641830,6646638931824044518,2097152 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5403699518256045259,529447596197436424,2097152 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,15890618674012975103,13779264706837712618,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,14738875862892186184,3254716073431399023,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6281325227328420834,10913007145762769672,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,6805472538882532697,15493147862598348526,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,457446721382401334,13648602074368886974,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,457446721382401334,13648602074368886974,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,11443732465619632821,10680522130708789452,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
      4⤵
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,3162763661346076173,16092832619631870818,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,11259749367452826593,3889361665927310032,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6576,i,8579579247060989126,11320336756636080642,2097152 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,5538493103412435892,13359283233346480372,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,2353278364010936165,3250153501345234900,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,12607522885958051252,17591655908328889649,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,15430301351111260697,17613327481140515256,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,15017235015752044797,4483459199394416245,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,7267365125870278232,5194964258342920902,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,18366228426027568191,1114622631811923610,262144 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,2135187194584136625,4394784537204427731,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,13945424902563234665,13206273863400620310,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17838760675440026235,12006104771439065504,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,14222876778246637458,18299961932159768269,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,2681981819080017374,16973041018503573694,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,817495699090253997,3032176616048800812,524288 --field-trial-handle=2280,i,16921316403147808890,10149732561091126280,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
      4⤵
      PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce9a45431fb053f46812395470c2ff6c9ccd1803075551fd01e4a51c3c4ecd4b
MD5 c8badd2ef76875dd0b2d479d596fe3d1
SHA1 e23e952ecb4d88e34cbd5328967dec2f0f4c9504
SHA512 049fd794e8c8698f9a3908ef9cdd577b41b7919eab42ac9ba4c6f3c4ba05742d9a6be6ee3b7daed591a94beeef3ba099eaaa2b4dcec22661479634920a672af6
TLSH
T16DD080333B1A7000D7955171D423C715533F446574838611F114C84DEDF51D953C2193
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c0f239c7ed32f1c492df19d463edf2073ad4d721081b4a3b14c372062cca32ba
MD5 c315998145f0e2e943e87f7e58d6d900
SHA1 33d11ba46613900b72e84b37dd01a1855d594067
SHA512 bb251b0b7711a8694b23a7203d473d97a43c26db6edaffb49e2fa8046fe77babe795a833ff93e67f2984697d704d9d6ccd1f8ce0d2024615aa3c0d6e5d7ba75b
TLSH
T114D080333B5A7000DB955171D422C715533F44657483C712F114C84DDDF51D953C2193
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 eae17b99fd77d4164416ccbfb05dc2f918c41213e2291f7984384ebdbd1f2764
MD5 3b23cf82c0d766394abd8b13b68b1026
SHA1 3882c0b122b388e1ea1652154e1474f3c872c4ba
SHA512 f59fcaf06453a785e94183017ccd9ef454e4bf857d293e6df77c51fb908403f02ebc838f350848773399a0ab7e0c5b98efa65efb90bcd4684baf8c5b94a3878b
TLSH
T189E07D8484CAF32EA240E8CB537C574C8281B60ED6CABE8E3F048C843607254F6C3598
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 e5641f12e0e87c1ee457a28c93eb86a46e9572bf0995bf48f423f1c7d09593bb
MD5 998f67583351b30d84cb878a51123023
SHA1 32d0fd0f34a32712a4523f5300cee28ad60e97e6
SHA512 14ecdcd72dd69d98173f705a053f6858fca2db0466adf29d8bfa25ef7d858167b1e219b22b5e3846b356cbbfe082148dec961d7a57c96a6bcf48b512d5b26976
TLSH
T170E02648978EF3AA2107A6CF8C7E631C4461F04EFF8FCF5E3306A4C62666A0C42C9080
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 4b01ad725670380bfd8591ade52e56471e8c42b20b242d4a68473b09379a1939
MD5 8ce6ea8eaf142df1b09d7f430e8ce49f
SHA1 8b3b3851d84cb2e8a8ba6857b1afea2009b50539
SHA512 c5655c2be276cd63b8a6c7e033dbfa935b80987a2b72b364f85cb95ebcb954d57444f42583e5d0228270f3368bc67f5fa73c181edbca0b2f5aa7a71c616a0bd3
TLSH
T1C6E02044C6B2F399413198D780FDF3BE0046F80DD58F965D3705BDC41787E415259480
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 275B
SHA256 4cbb8d10697e84290fa40f7935adc3e2f884bb2a702c5cac5fa855b0a1fc9452
MD5 e9ca1e5f3b82e24935458e4ba4be9e1a
SHA1 80765cfddb9fc6e0426f7a373e753560105c2b90
SHA512 dbbcfe0062578b2aa2763f94ade669ae77e37f3108d02a8c9f611dd133a848074190e48a0c81a64fbaf64ce7b1041c48f8b336edd86dc5781b821a9ea735bcb1
TLSH
T14ED02BA9BDDCD9CEC3D00EBF9B72B4000B6551A28C1B9B131560FCD032806F01F2A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2bdd9ddb672a64d6fc2e0c16edc8e7edbbd04ea057b118e780ed3073e3cc5728
MD5 ef5ce173e74e75c4568b2dcf86a43a3e
SHA1 7191a886e724549092ca04bd2251349975609fb3
SHA512 d60b0f7fc5ebbc547a1269fc52542d4f56b9e102f2c5b1999306aebd9230ee9054134028ff393cf66936123d704a585b2f4652cfcd8c288a4ad8e3fb52176355
TLSH
T19C710925018B4DF0EF79E63DF8ED12957276CA708ACF5FB21B201C76F61372A8964468
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a841.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a841.TMP
Size 3KB
SHA256 8fc42f927ccf15c4191d1c508580fb363fa0727f90af47f91b0935b1386e60d5
MD5 663f6d4b87a7caa05334ef6eaf996799
SHA1 1b58ddfa474f07f8fadb98fcfa1a9cd29c4bb15e
SHA512 bf564d52eb6d5aeeeab89cc7ba5db83fd9e904cd204e15099d470b0ba489c555d72b926d2c91d805757e091223f079d860767cb99b789d602fdf0063df8cd667
TLSH
T18571E514424B4CF0EF79E63EF8EE12547136CA709ADF5FB11B201C36F90372988A8428
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 21d19c761ef3ac6d379c34463b019b09553c0b97a6b44c81735edbdd887f04f4
MD5 d986d29331fd7e84412be81baa7e23ee
SHA1 aaa79df361c227e9befb6713ec7dfa7ce92e6afa
SHA512 ae6d9d204980af81b5602e5b8cb57395658204a009a71a86bb82294c4f3272fda26ed247c22b978ae2e6e1392eff06d0735b53251d5404487d443320e96b6da7
TLSH
T1B371CEFB83B0866ED90195F0AA146F2BCE590124937C796685E4FF47A3E3072E241B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 83a12955607c5c5586e20c23aa8734a3ed87c861d000a2e92bd71b3eee62a02b
MD5 277891e742758c3cc21cbabe6cd69977
SHA1 c05c2072e31bf9a1c5e981cc3b12fc6249f9babb
SHA512 b14b7bf85bfc6e793ae6fd20326c6141bf4e7c7207d22ce3280a2028c83625b0afaac3aca99727054c6fc6b9b8c0e986ad37880df8b110c2d61bd59d1d544f0d
TLSH
T18A71ADFB83E4862EC90195F0AA146F2BCE5D0624937C7D5A85E8FF4793E2472E24164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 602c03e0ab7cfeb19bbc244938487ee4ff88fd401256bbca0c95a2a0b6fb8194
MD5 3cc68a971db3493a853c2250660eb228
SHA1 fd551a682c783b5a55ee53ac51a16c1ba3624082
SHA512 e44698826504bed2b647d4745f2762e163ceb18538c515467fc1f9ba7de0e195a8dbd2f7ad949beb173bf6d1690f93f5dff9a6e816a976efadd346f01692a0e7
TLSH
T1E371ACFB83E4862EC90195F0AA147F2BCE5D0624937C7C5A85E4FF47A3E2472E24164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d4abf16f44ccdb606abf64beafcaa1bdd75bf8a6d09510739b195409fd667fcc
MD5 70406d2ffa99255589b51c71d59a983b
SHA1 91db22fc6a28b1b584f2142e1d7426b5fd858393
SHA512 35bb3fbb345fbbfc4da283b71e4b0df7de53175acb0b0463bed29136ed458d495af8d5f3ab6487b6d57b9f72b0c9d5f73871064ac71047bb0019371ace3ac316
SSDEEP 192:sxZJRqKyM/jK1Ml8MiV/fNsEOQH4XlIdpY5HW6+WNLzh/Yn/WWqaCIg4J:sxZJkKqV/fNsENeWQHb5/TRc
TLSH
T13052E952AA389977CCDBD208F951BB53D6F5156292900D849EFCCA1C01E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 91cf606afef5ddf50af325678f17c8e3ed7981d997d323b19584d7c6e2388434
MD5 d9e324ad3a3eb8a4480db75861c925a4
SHA1 2074843924c5e55cbe5e0bb1068c3b2bb3bafef8
SHA512 c4826cc38dadb8c97f268cb0288ccc68a675555fcba02d1ba24c3ee5e9bd765e8417ad82efa8877a805f9862cc260a63415ffcef4a9ccf7e8a61b0f0af545972
SSDEEP 384:sxZJk1qYV/fNsVH66s8qMpRiYnazAW8pZS15posJWeT+j5bmmWiHb5/s9b:sxNYV/fgH4Mnc7WeT+jIyHb9sF
TLSH
T1B9D20805A924C8778FC35D18B47D7E33D9EC50525285CEDA1AECCA1C029E5FCAB4786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 9e92467a4da319a47ee4c82517b67102f3ed50689fe79beb5ff318f03200a54f
MD5 1325cc31e605a098026720ad1727e892
SHA1 41d9b9765888f6976b4bfd68c7ca75fe5cdad308
SHA512 e51eead4c68a27d9e0713619f9e0ad100672717907a745164ad0d58cb546eb332d9b47caa82b9c56ae41e721ceae8155f621078786095e7f83443b4877489497
SSDEEP 768:36QRMkQ7pLuL70UWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshsro/Ac:36QRMkcE70UWv0sTgu1jakTLROh3/Axm
TLSH
T159F2FB3B684CCB7E4F844E9CEC2A7E8A6DE8018B56D8895447FA884C03C77EE51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6265b350-bfe0-4fa4-9770-1f37078466b1\index-dir\the-real-index
Size 1KB
SHA256 6974fc89feac1b0bad30723fc51b8ffd5257af46aae0c75b32a1c43905c7ea1a
MD5 4dae57a29aa1d3fa3f73bd2ece5c4b20
SHA1 9361f70bf8908aedc46307229bf3ed5023105ea2
SHA512 8113178cb852f218bade86664b25482b51fc6c4d2cacf282855736523337fdd04ceba4f143150a294d6bb94d5758ac7e0859388cd0e78daae069ef1b6e4e2e18
TLSH
T1B521024C8E52959FE9644DB2007774A033B0C9DC2711A3639C7C63372D2235A29171CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd3b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6265b350-bfe0-4fa4-9770-1f37078466b1\index-dir\the-real-index~RFe5cd3b3.TMP
Size 1KB
SHA256 eb0e0ae31ddb90b7bccbe0b2742fba8b0ce67d12aedcaa24397c5a9505333160
MD5 bf51f6ac6028914f8bf566de128c4a17
SHA1 f297424df9b439ef5f851da56fd19cef1cb0384f
SHA512 8ed8563e9fc64051833b5a62484e55ff3c5c57b7f6fcb3dc682ec328f900b35ff49ea95f781f4f9f81c6d4d9e268089841188706dcf33ce333b253d883c5d6c9
TLSH
T1A521108E4A925A0FE9D044B60557B4F83374C9006322B3D3957D633A2C3579D6A8F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b606ab3e4df7c99a0d0bccf5d5cb4b95280306333798fe4d4604addc5ab67733
MD5 cc1fe77e1313d89579242e354551bd02
SHA1 e9636a720745c7448feaf061d3b88845574c9b6a
SHA512 89e0473455705d5126e10319aba7ac8969c71e21ec430ff123e5b16301fad400f371be8007b37b95df319599637038df91de7434a670fff2279e454b0f330ac1
TLSH
T15BE068B23FD72920A86F83C2283210A901497A18D408BD9E042672D3E0B67513801C51
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a3b21137fd9d2a9f9abd1309ced1bc766345b3c2ae92df37d54b01f4aab83026
MD5 c6039ff233cdac221803e0293c7c798f
SHA1 0999a07a4fe25b7e47bfcaa7aec9e5280e65dde2
SHA512 7d34ff712b62b6a241bbf2564946ced624271b9a7c1304048d898563db84e9477c9ead6a26ddb9b9644db0981ef73fa885ee9d4e594eab0f32c63f9ebf0a08ca
SSDEEP 96:KYzGKgrzSXDNpdgJxkzrrgKD1rlgH7rUFTtaUgKxCePGKQo:Qc/vUo
TLSH
T19091F442303B128134FE6819A2A7A62B4D41B1B37158EA6F3F6D51E60E27F110EFD6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6af3eaf-66a8-4f40-a478-35ccee783dde.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6af3eaf-66a8-4f40-a478-35ccee783dde.tmp
Size 14KB
SHA256 063d264ebaceddf280c55c986a8e655ac8b9e0ab4d725238526c8d193cfa0905
MD5 dd0b37b3dcec4458edbe74e1b02def46
SHA1 21a3762ef30bcb14000d68e622ba200abc0d74de
SHA512 ac0a17ff914b6e4c60d34e9416de931419a648f5094f696282eb7635c1753e28c8ac9eccdcc02528b08d7a76d2529f52115247414c0b5e76c80714f71548f829
SSDEEP 192:sxZJRqKyM/jK1Ml8UQhiV/fNsVNQHZbmmlIdp+5HW6+WNLzh/YnjWBqaCIg5rJ:sxZJkKqYV/fNsVK5bmmWiHb5/sRb
TLSH
T1B852E856AA349977CCDBD208F951BB53D6F5547292900E44AAFCCB1C02E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 8cc3cae79efe94ac7800aeb3d99d7d958d34c01e2229d5b7f982984d11777701
MD5 b700130f6ad5844cdf36fec28a63f1f4
SHA1 e540f53bcc2caee00d49964f803da9b111492f48
SHA512 1e8165348268190b33b65a120d5178384d6469a2c01267ac2d4876fed5a70b6a558ff480ffe830875d7a2347aa64bf6d5e815e3d4b21e0fbfa4292a99d5e57fa
SSDEEP 384:nHtNn/s3n9SzzsNTuksmk897eizjDDf4t54at5mGc1ZX3Smn15wbAjEPq:Hj+9QaNXf8txnDkR3Smn12bfPq
TLSH
T1DAA23936EC35DE2B6DE392C6B20736479EE4416787C81AD4C9EC2F4C05DB29D130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca2be7075dfe9d182dda5493542a913098fd39aeb51b4131a04eb2727842ac80
MD5 cfd435a900e339978ad15a6a800a4b25
SHA1 40f0fc8ac3221ec0cb611011433959a3cdbf7db9
SHA512 c57131fd6a0a0c9b3510bde3afe8571278250b7e622245300e9f5641a3fdb0bbc586dd4be05c840c34d619cbc54aa1841f7179bb4624a6d80db5f071daab790a
SSDEEP 192:CONL6G+bgQmiUyLKDE54aP156jzoSRYc/8OyXYU6:CONL6HgdDE54at5mGcyIU6
TLSH
T1DB02E935B8746CAB9EF3AE45B4872B135F98112BE6C16B54D6EC2B1C41DB24C130B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 30fa2f6a6d0bddf8033105c3f631af658f1db035d0d12922f6cb9795e764410b
MD5 547048a83435f17348ec9551cc04c084
SHA1 694db1146936f9bfd41ce6e50081fd2e93913d5d
SHA512 fe64a297d0895288c044501a28c4e34a25ea7220d881015f27a7ab4dd6e6f8322ce30b593c9f701bf442efc41b46eb9c9f2132d087b5d54c2e9bb6e3eefbf7f7
SSDEEP 384:nltNn/s3n9SfsNTuktmk897eizjX54at5mGc1ZXRSmn15wbAjEPq:lj+9UaeXf7xnDkRRSmn12bfPq
TLSH
T15A927C339C386D6B1DE3D485B54B36075EB8813BD7C42A54D6EC5F0D02DF288231AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4e28090d82bd3cb033735b1c29ed5ab46d88c5012f29471e9f3403051c52b2ad
MD5 12bbad698c7d7fd3d3781a1aa6107cf2
SHA1 f81a9926dd4ebba1802d88fbf33b54cfaff9da45
SHA512 0bbcfdd7bc501e3e13a9318f2e8ae0f149643ad65c8fad8ab2b5dedc57fe6e5f967c11ef8ce56d718b491b7e3fe0be2c415f30f7b119b60bf6805e8d16ce13a4
SSDEEP 384:n5tNn/s3n9SfsNTuksmk897eizjX54at5mGc1ZXRSmn15wbAjEPq:5j+9UaNXf7xnDkRRSmn12bfPq
TLSH
T152927C33AC385D6B1DE3E485B54B36075EB8813BD7C42B54D6EC5F0D02DF288231AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd22812b8bc47cd7904526eaed004fc5ef9c630dc9ad7e36dc5f15971c90219c
MD5 973bffa405f33d13d6ad866c1f537f23
SHA1 1cfa3c64c41f0ee2812e7335adda56a447d74392
SHA512 64c6f5aed0096d7e7b41e97bdcdbfbb509399f981cd0c84e3794c56c962dc1fa381405628e5e0bcc4b1e43594da75a1ca76c29e605b1998aab6a279af5e04934
SSDEEP 192:NONn76G+baQmiUyfKxE54aP156jzoSRYc1ZX38ShLqUSU6:NONn76HWrxE54at5mGc1ZXVSU6
TLSH
T1B3121B36AC74AC6B5EE3E441B48736135EA54227EBC5AF50D6EC2F1C02DF25C170E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5ba86d53aec7ee760606eaf34c534f95d1f75e25e7920452220de0407da1a71f
MD5 da60675fc03ec4385173d149986b812d
SHA1 90b25d9d98e6598db3c91794c6e705f2ec6053d1
SHA512 6ccb45acb6eedc402aaa6d8a237da1ed9d2e423bb45a32457f2f128c6d116b94d19b1075baefb02d54ff587825b0a1b572b32c6b14b27a381152b14d124fc97a
TLSH
T1C6412B6CBAFA1108B3B7AF5A6BF6786E487F79372E06D45D10110E4F0622A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

577325f6-93df-4966-93fd-8ddf14b5732c.tmp

Path C:\Users\Admin\AppData\Local\Temp\577325f6-93df-4966-93fd-8ddf14b5732c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2804_85291084\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download