hxxp://indeed[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://indeed.com
Sample260818-v84a8seq2t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2008	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315484423804514"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{530E6002-A8BE-49BA-B7DD-51C10439DB34}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3852	3004	msedge.exe	85
PID 3004 wrote to memory of 1856	3004	msedge.exe	86
PID 3004 wrote to memory of 2008	3004	msedge.exe	87
PID 3004 wrote to memory of 1856	3004	msedge.exe	86
PID 3004 wrote to memory of 1856	3004	msedge.exe	86
PID 3004 wrote to memory of 3504	3004	msedge.exe	88
PID 3004 wrote to memory of 3504	3004	msedge.exe	88
PID 3004 wrote to memory of 3856	3004	msedge.exe	90
PID 3004 wrote to memory of 3856	3004	msedge.exe	90
PID 3004 wrote to memory of 3856	3004	msedge.exe	90
PID 3004 wrote to memory of 2144	3004	msedge.exe	91
PID 3004 wrote to memory of 2144	3004	msedge.exe	91
PID 3004 wrote to memory of 2144	3004	msedge.exe	91
PID 3004 wrote to memory of 1260	3004	msedge.exe	92
PID 3004 wrote to memory of 1260	3004	msedge.exe	92
PID 3004 wrote to memory of 1260	3004	msedge.exe	92
PID 3004 wrote to memory of 3332	3004	msedge.exe	93
PID 3004 wrote to memory of 3332	3004	msedge.exe	93
PID 3004 wrote to memory of 3332	3004	msedge.exe	93
PID 3004 wrote to memory of 1840	3004	msedge.exe	96
PID 3004 wrote to memory of 1840	3004	msedge.exe	96
PID 3004 wrote to memory of 1840	3004	msedge.exe	96
PID 3004 wrote to memory of 3712	3004	msedge.exe	98
PID 3004 wrote to memory of 3020	3004	msedge.exe	99
PID 3004 wrote to memory of 3712	3004	msedge.exe	98
PID 3004 wrote to memory of 3020	3004	msedge.exe	99
PID 3004 wrote to memory of 3340	3004	msedge.exe	100
PID 3004 wrote to memory of 3340	3004	msedge.exe	100
PID 3004 wrote to memory of 3340	3004	msedge.exe	100
PID 3004 wrote to memory of 1300	3004	msedge.exe	102
PID 3004 wrote to memory of 4376	3004	msedge.exe	103
PID 3004 wrote to memory of 4376	3004	msedge.exe	103
PID 3004 wrote to memory of 4376	3004	msedge.exe	103
PID 3004 wrote to memory of 3688	3004	msedge.exe	114
PID 3004 wrote to memory of 3688	3004	msedge.exe	114
PID 3004 wrote to memory of 3688	3004	msedge.exe	114
PID 3004 wrote to memory of 5696	3004	msedge.exe	117
PID 3004 wrote to memory of 5696	3004	msedge.exe	117
PID 3004 wrote to memory of 5696	3004	msedge.exe	117
PID 3004 wrote to memory of 5312	3004	msedge.exe	118
PID 3004 wrote to memory of 5312	3004	msedge.exe	118
PID 3004 wrote to memory of 1844	3004	msedge.exe	119
PID 3004 wrote to memory of 1844	3004	msedge.exe	119
PID 3004 wrote to memory of 1844	3004	msedge.exe	119
PID 3004 wrote to memory of 6080	3004	msedge.exe	120
PID 3004 wrote to memory of 6080	3004	msedge.exe	120
PID 3004 wrote to memory of 6080	3004	msedge.exe	120
PID 3004 wrote to memory of 5512	3004	msedge.exe	125
PID 3004 wrote to memory of 5580	3004	msedge.exe	126
PID 3004 wrote to memory of 5616	3004	msedge.exe	127
PID 3004 wrote to memory of 4284	3004	msedge.exe	130
PID 3004 wrote to memory of 4284	3004	msedge.exe	130
PID 3004 wrote to memory of 5968	3004	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://indeed.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9851ac188,0x7ff9851ac194,0x7ff9851ac1a0
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16152180293000992952,14456162875720868405,262144 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,4291581832048627398,7531644454557232644,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,2133156206715742748,1129219379635421789,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,16003037717347588501,3842137664430789688,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,13114522876702216526,6274333342924728196,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,13051854099764432788,12004323761151566924,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,16997659420510398382,6340666422293906101,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4976,i,3291747711368008566,17591174025463102354,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14992650983195402045,4039275467231599262,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,17384077733619615562,13656041067714625889,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5828,i,16265866637056452709,7371013310876876913,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,4259881227549169777,7461873306249257324,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,4259881227549169777,7461873306249257324,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3460,i,5101844289313989249,6243573884444770001,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7108,i,244795074314387885,2601637571963306962,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6136,i,6779638381073624552,10426340823550099685,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,12536841594760602285,3952717890115447794,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4468,i,10467683361632489354,9086892778229601986,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5112,i,7577753108891724134,12126348266584338855,2097152 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13250162870853456636,10932402068961402273,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,15147149544807902815,11303895748566904719,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,5732764817085502272,7703669180273172215,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,1695382742787727996,14765383234958731896,524288 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7244,i,8845094271894297425,12667363877532890675,262144 --field-trial-handle=2332,i,4328719726768778678,457915622500067879,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 33KB
SHA256 7b0b7abe7f4cc2a8cf9a1ce70fb3b5b355d56ec55617d89059b21bdc384fa320
MD5 af644b2a43309f33a734cb793673002f
SHA1 2a523d97c1abb65af88e5bb6394e9bf4c68c985c
SHA512 d83ef0260947d8c4f9a76dcce8480d7d875df58c7a1fa3205127b574c9f91d854b93c61498d480a8c6bec3e2c4d4fae329010f7d5e125a0daba0163a1d428546
SSDEEP 768:t0jypE37eSL3EDukK1WoJ5BRElIO1EtSJ3WRVxSi/B5X3EoD/:8FL0DXoJ5BRU1jJG3/B5H/D/
TLSH
T11BE2F24A7A167796D1D002C97BC573B699C6E3475DB080034A226E5CBCFAA0F072BEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 67KB
SHA256 f1199d1cb532b1b7d347a66fa7cce1ea63400d33e05424d6c4d237fd09d272a5
MD5 db9cf7bc052625768be85a41e6c5fca9
SHA1 2aeb6bcd280752fab012e03d503101bb90635d08
SHA512 79f9dd774be0c92d77e6ee992646ef1976d3ba9c5ba88128436fc1b5cb607ed9dc448a4519526e8a0d8c54c1aefab316704f2ad0674351b1c4692561ccf6ab5e
SSDEEP 1536:QnthZPy81HLbA7EPZKWwIvmRGIOlF8RnI1m2H1xaJDuN/JBm3yhUgU:QthtrBI8UV0IOz8mis/JBWCU3
TLSH
T1786302C3919FAE4039623BC66996C13006FC607404B4BBC4FC6EBA04D55B5BE6EC97CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 408KB
SHA256 79aae09edb44084ab715daecdc2ff2c601bffc9f1444db92e4a47cafe956af34
MD5 01dbbf05a80d2f068ac7537031ed83c3
SHA1 e7a8bbf92b835dfb6a2ebce9ce7205fef7b8f121
SHA512 38c28e0d575fd614a47c325d3970c9bc97e8563f47d9c1ad98bc904ea41a2759ec99f2c132ce2999a1823e28f7faa01038037c25e7a5a2a040f4a97eeb02a22c
SSDEEP 6144:RQnFzu6JhU76hCZBa6YGCrlHBrrzNH5EMGS44B+4my+hDBXdRJQ+9FvUvtIBMC71:MuNBM3hNk4UDn7XdRJQ+j8vtIBZ71
TLSH
T1D7942300E26110FBE9045D0AA513C8BA7123B5B29E81941630BDBFF4A4FDD55A8DFAFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 be7c8d2a4f0b5c27217202e0f0f8d2938be1c063f5a2ab68f32111c41ea794bc
MD5 49d60547c6fb43e5388959b225f01725
SHA1 f8a8ac4fa8cf2c67d0cf3effadaa3570dfb1f13b
SHA512 152c6c240229b1f4e3b92b87fd45e06315843ab15a33ce7c515c6e985ca16460654d35429be439e915bd47a1f913d22320214bd57a618ca830ee7e3a4f0f10a2
SSDEEP 192:bB+YaNc5LeqAlfFasc1QbJJueGHP8WZBam:9+HWNkI00LLX
TLSH
T106124234E5D0209ADFA4D1F021B64C0969328DD7F8F24FB3DD199CF492236E5326A4EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ded2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ded2.TMP
Size 3KB
SHA256 ee3d3bf58e725f9fc00eae626bf64c6bf1bdb63fb6c82ea711491cd4e567689f
MD5 3314be8a8a09a617ae513b0ea57eefd8
SHA1 808fa286d392d3e524904d107e8164617c64e8f6
SHA512 c52e4257be095ac13b013e49d1ad08cd7d1f8bd8c18ef8401422cd1a308e3746f35dafef65ccc290551dee4d4d5ac94203a1d91705f29e2b3ef991e827a2cbdd
TLSH
T128717F31B25140EFE79221F124E2528975B0CDDAF9339EB1C15A55F1E639360B6292CB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.crazygames.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 95c7cf855deb49740fdf3d0f07d2f46e297dae0d038492e29910de22a25204ea
MD5 94053af6058922934e7bc6906a82c576
SHA1 d9eeeaa8b3e813006bb55bf049988d712bb5b0d6
SHA512 085fc920a0cb6dad25f005728d7cb3e24c412e3c77e20261657588fa0b2466424de2bf746ec001f1e8738a89acbea0e58a53d9e91bae3c3d36cd2c19540400fa
SSDEEP 384:DG2LO8jMfvJ6ebuPe0eXBTbMXJtnlIL47RGxJ5OQMMMp84ZMVxGF/NQYZzc7g7jG:Do6wD
TLSH
T11352BDF7C3E5862EDA1151F1AA146E1FCF2A0554436C7C2A88E4BF4BA3F2471E111A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 77881cfaaa4a2e02c5d22f03e86dedd81cceb362bbcb0a357c39b3f1218c5c6c
MD5 a14d7342b52b9ca57c3aa51cdf0b8535
SHA1 c78b8cb852dacf0e9528bbf0afa4c14675dae2ce
SHA512 a30493127a1c1d750c769b01d8f0abad656c3651ef3b40883488c9477efcb8ecf59688e0f4a8f3c16f4be994ba4165d25f5f9f40a79d95f7f396da9f6798ed29
SSDEEP 192:sxZ4QUnPRUyM/jK1Ml8UQ+kB/fWsWxDibDUddp/v3cDuEHW6+WNjNPiiqn/xAn/4:sxZunPCqVB/fWsWxD0OcHbheS/Mt
TLSH
T14782F80265342977DCEBD359F901BBA7D6F45062D9904E44E9FCDA1C04EABED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b073c08edc94ec8b9b6711768d746febec02ab5c3a5a92451eddd94d9e665ce9
MD5 50c8062db1398afaa963cc04be62e198
SHA1 ed1f38104f227a87bcea6bd562d6e7a0d324e149
SHA512 0c56fc69e89d924664313b006f87845a44b8ba0c3f68e247c42bde1cfdd7e83b9fa0778c1d04ee525fae55c3b7194f59454bcefaea0bb2d3bf8d8b1b912f9a17
SSDEEP 192:sxZaRUyM/jK1Ml8MkB/fWs6PeIdpv8hHW6+WN+ii/YI6ojHIgrJ:sxZaCMB/fWs6PPAHbK/h9
TLSH
T1B752F7026A346977CCDBD309FA55BB53D6F94472A6910E48A9FCDA1C04E7BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5744def3e70af17d03b527b0f6bd9a538ad89b87ec8722cb844bee30c15b0aca
MD5 cb0290a6aa12080215827079a22e6836
SHA1 75d31175984941daf14e4f5638f06deaa14f3f8b
SHA512 d6f18f1c082c2d85ff1986d2da51d0a26abd7657dccbf7c008f9a484b2d7acb2c9ad95efee42beacabd71e193f8f0337e0efc86dae8b968a1da73f2c261cd8ed
SSDEEP 192:sxZ4QUniRUyM/jK1Ml8MkB/fWsWPIbDyddpv3zDuEHW6+WNjNPiiqn/xAn/YIcon:sxZuniCMB/fWsWPCMfHbheS/fr
TLSH
T1F272F8026634297BDCEBD319F905BB57D6F45062D9904E44EAFCD91C04EABED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 636c28ce19bb1318bff2948fe906cf1b4f42de886bbd9bc3cb3330325d6f7666
MD5 218702d068a75e6853fd4888753bd2ad
SHA1 34952344d3b0e07bcb3737e35345de5bc20622ba
SHA512 96584350448b3ec5eac2a8bb17f6f36337415a489eeb40e53c69539565727638b0217da2266511a43b1ebd714c9b871e7b4aae712822be5a6e9600cf413cc5f1
SSDEEP 192:sxZ4QUnPRUyM/jK1Ml8MkB/fWsWxDibDUddpRv3cDuEHW6+WNjNPiiqn/xAn/YIG:sxZunPCMB/fWsWxD0OKHbheS/0t
TLSH
T1BB82F90266302977DCEBD359F901BBA7D6F45062D9904E44EAFCDA1C04EABED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 eec8dfcc307f51935539fedca219085932ada92c8807c243373ede79959fb255
MD5 1d24d285e88498b374b64044eb18e39f
SHA1 f43dee0ac1c280b00763626e43e2c86d1ade1ad8
SHA512 41eac0f182bd0d34a73b6f937971e65a275e70e5b12fddacb8459a99a3b5684aee359fb6f28468e883e2d687660d4d77353c26c7e3a0eff5e9febe46bb73b6ac
SSDEEP 768:7LsqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9grofM24:7LsqxXlWvJD0Tu1ja54LAs9rfMn
TLSH
T1A1E20B3B694CCB7D4F840E9DEC26AFD66ED801CB66988D5447FA880C03CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 aa70d312e5ff35074a9cb2531253d25dc2b8a090d21e754b9f8551aeb194c628
MD5 1c5a20f782641b87d33f94cfb713b971
SHA1 3d10efe427b0d2fa0a31402bd37d6818c4f45b25
SHA512 952e93637e6e62dc20b329f5260b171b7b28ae9d4d1fb6412647dc91cf899b88bb70d15b6d7c256bdfcf1de27c896043e7fb55ca6c1b750bf3413f4aae888d82
TLSH
T16EA0021B22804081C05252F82697058623376A1D0241571995A92058E9955554D8144C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 edbc0fced328c2b9289497aebba56ad5cc340b199b7b414be65fbdadbe114055
MD5 35227a8d314794a1115107ec486045bc
SHA1 49400ceea1f4759e4c8c8e196c55c7beec04c810
SHA512 a7699b6da4b07f5a116a52af40c1b1d9ffa964dfd374a6b828b4f6905c284b07f1b345975c7c8a803a72073590f2bb6b92648e315f691918ca5855510c0bd5b5
TLSH
T1A8A0021843840459C51632F1155743422361C8503930631F84A97048CC504468D4106D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\temp-index
Size 3KB
SHA256 75d7e7f3e4473b4e1b20b82d902850214bfdb3bb698b000dd496370e6431a265
MD5 064f9f81dabd4edb554a243cc8c50669
SHA1 4d97978cc955954343d338cfa19de4c43c7f23eb
SHA512 60631d9e766cf82b392507d722c50b6573e23dccd85a00b6ab2938630dc388ab30330bd61d767ff697eadd68f477e45249113416dc1a02cd125ef6304bc29436
TLSH
T19551C90D4C832B1ADDBC25B318F608113B767DED67995A13B5AC9834BD833362C68B59
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 2KB
SHA256 bde4dbc4e5045364daed8c5302417ef85768490c8d3d2812475ec031db633d78
MD5 95102650103db0cbd5e84d9165fd421b
SHA1 07fc2b315186bfec64fd446f8b2d1149da13db76
SHA512 8de66e9a9bddff757c3df5edf2b4718f256b135c652a42067ec19dffa29109c2a564b04be50e8ea2fd441250e4cfa651a6ffa20ce1f1e16b1499cbb0984900ee
TLSH
T10141A4CD0E458B5FEDA444B300B264B43770A8CC6F519703ACBC227A7C533692DAB6D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585510.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe585510.TMP
Size 2KB
SHA256 bcaa3b28abb63c4abff8e17a34fcb8b654fd6f5907750f9c0f4a457ad3c659a9
MD5 d336b1f36254217b70eaa96fa246b192
SHA1 06350623901f05870cff6a7a7ad6c301fe5500b6
SHA512 c6317dac9b986aae9b66f625690f329255974ab065903dbbecb2bdff5b1593c54740fea8d81c1b92ba488643f0f704d356b9c73e0c9aba1528c214468013dbde
TLSH
T14041868A4E42861FD8D044730993B4A83379D84097127B4BA4FC573AB8A17BD2E9F1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a9959806c5fe93a42d345d398e7422cf249894bb1f3223add7df8e0662e41885
MD5 9b58eee8ab95dccd672c010005a02732
SHA1 e8e6687516621fe86240868724d5d9e3ee5755ef
SHA512 3b6b81b6a5a165ad2fde604629f7877df6e46f977e925156973b0a0d0d1394267f7833f4c5a5699654f9a6e3e33cc5055156f4cf01c943142e140ca83ca1beb7
TLSH
T1DFE068BA2AE70804A8ABC3DE087394960400F828C851EC4F0029929710726603835C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8ee4af1eede1bbb125dbf3ade75fe5fbb191b7f3\2c266bf5-25ee-40a3-9d95-b85a5f30984e\index-dir\the-real-index
Size 336B
SHA256 2fd655e5890aba662d54182a736c8ff4a4da8de7aeb4e6f1b60e03df82efdaa2
MD5 fa7790e87a7b762105a39ed58d6a08ec
SHA1 2dc2b18fbba22cf5599089c9e3d49c2f3af9819a
SHA512 82cddfe8bf0e61fd84a13ff8cb28dd780d8d6a7f8198f8f9e4372857bbf3c55aa99b73467ea975e1d6f544c9e6f35e36e5a2a4e1ff60348fa9cc0aa04e55cc79
TLSH
T1DCE0238834741EC3C193973DE083108276315CA567570F1903E7A338EE887569E55795
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d80c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8ee4af1eede1bbb125dbf3ade75fe5fbb191b7f3\2c266bf5-25ee-40a3-9d95-b85a5f30984e\index-dir\the-real-index~RFe58d80c.TMP
Size 48B
SHA256 483594a41ae0979dad1d771f24b138549bb6131a04c56f48bb099fcb0d8bbd2f
MD5 3db1881e63e16de8e1d2c968d640b2fd
SHA1 07d3041197bee0d0ad4c96f384a6f5107e00758e
SHA512 51d24771d19e1b8316d3de67e6be57f4135c5fa9745978840caeb32a7a4606c172499ca4684260414829d65f6d1463b86c3b22d088a4dc725b4f634b108b980e
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8ee4af1eede1bbb125dbf3ade75fe5fbb191b7f3\index.txt
Size 256B
SHA256 a0c97e1159ad232d829153a4714b603b054532a4efdc5a5eea31bbfbfa1996fa
MD5 e582154f7aa67dd9706be42fd3cde5af
SHA1 56b0ff78f8201bf89bce6f288f80a69e6685e188
SHA512 d69a3f163d011389cbbd740a91a892964bc21ba5e43b7b26839cbef1b003ee82755c14aa583c401d8b8c8bb394058d29c8c5984f755acef28f0909dc6e7d3248
TLSH
T1BCD0A7D73656A552373686CE10BAB2CCD86BB18CC9A0CBD44CA42242039591B6921F26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d83a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8ee4af1eede1bbb125dbf3ade75fe5fbb191b7f3\index.txt~RFe58d83a.TMP
Size 261B
SHA256 5d24b78c31878225c6a8b54a8cefec506227a073ee0b9f35ca2c060683c0a071
MD5 d6bc4425ce45aacf1ef783307450d63d
SHA1 7ad7723369388775cc80160f75d22804c7d1c6d2
SHA512 7b66559b2796e7ec70d62a9fe38f869b1db0c958734ffcbe8a2db4382c8e52717d91393c6f41857396cf36b229a10de0fe5898298c53ee5fdf4339bde4bcf11f
TLSH
T153D0A7D73255A552373646CE10BAB2CCD8AB7D8CCA90CBD45CA4324203B591B9921F26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 288B
SHA256 b29acb5a72b05a7457d191ef3cc0e5f155e0eedf801ca763c7c544ddd3e3fa37
MD5 4d9c67002c3fc7cf4351a2d055582d17
SHA1 0b9f90f683a20cd13dbadcd624cd0cb418bbf27f
SHA512 7dc17285498d817fd0f3886c0202a8fe40e9893b7288a222f069f58e144a49eac0977edeb646499561b1b89dcc681720e5933d9b632cf68f6949bb6065acc1da
TLSH
T156D02315C9544255C124C379419101C73338C156965F33DE4064712B3E6A0574667181
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d0e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d0e7.TMP
Size 48B
SHA256 fb0fcfcf4b291b42f84c4f2150f7da0e23584f0cc0a3dc7a5c00f64e4055521c
MD5 d000f82261935db536826d51eb6becb3
SHA1 452ea93b5d1e8ebe565bd7c0a478ad600fba3385
SHA512 bea99e67fdfa5011b94a3407379f604bc74138baa879750e7c7723099b9779036b49ed6c94aebe6d85a28b77847055c94281be6e602cfe96d8076d9ffa7067d6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1b15ffc3bdeb86b7b43fec9177a71e2d51cc3235850a6363c29a607ad575ef62
MD5 b4e9a4206584726d65cea12973ec2c49
SHA1 c0124c2f916c1d62805a98c2d039d384aca6b018
SHA512 deec3104082f4fcb50bd673dbf30552952cc516729255bad9513828fe69b050ec94a7d3139ab3001ced534219aa5ae491c51aaf1491073e8d8b951b478f8587d
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyZaIPK/q8vy5kIXKtuMisPAcmiekuH:KYbaKYIKqawK/q+KkgKtuqi
TLSH
T19E91034A767A1252383E2958B266C6370F8235733118B47F3FF854624FAAE110CBD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590b51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590b51.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dc67e1235c1a935ea1992b8287f8c472e186452d799a4d52e076a0a89c886ce2
MD5 54790e60c6e0e93a011816cae303ab95
SHA1 06dd4add892cabeb0397810b0e171f32a600e850
SHA512 c43ab58e47d8657b71bad6ff5d366f86252a231c4ca835b4c710fe02d864daab1035650d13089a473f5dacacc92d79093bbe35d84cc53fb1aeea3a0e63997b1d
SSDEEP 384:1piFiZcIKsNZ8TUNTUlIlDDTj9buVR02VRNmOfI9zJySllYJTfY81FwkgFBuj:mFQKgwg1a0UHmOA9zJZuTH7MBuj
TLSH
T13BD23BF218D35876D9AE6747B77E2E034EBCC067B5859980B3D85A0DCD961BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5a268e2f54ec8500563d3f23f65012c769decca887ebc9bbeceb5e8aa1399225
MD5 fc2131226556847620cc5d74cdde24b9
SHA1 0e9053a657688d55319491d415a7639cef2d0405
SHA512 ff6f41c62e53525de928e74052cf82fd4287bc24545575c8a93803dc1f900a83f2a11e102154d293b87014a7e4e4de4718a1e5bc971610993f494888513ec33f
SSDEEP 384:7ZcIhsNHDDTj9buVF02VRNmOfI9aJySllYJTfY81FwkgFBuj:jhOu0UHmOA9aJZuTH7MBuj
TLSH
T136927D316C346C7759EAB285B98B36074EF8D03BD7CA6A80C5EC5F1E02DB99C131B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dd74a19ff9781aed79f03da1538c9c98e759cea59c62b2b508a1b065f7189b14
MD5 542a21116dd04d99bd66a5f7df98fc17
SHA1 5f6cddebaaf76558b7a2fd4b0e67b68f2d7c98d6
SHA512 f23d854ef90aab3baf37fad975495cf7cff3aee5947af118ec62d42d054464d3f1a6cd8aa6a85371d2d12fc8ba3cbd3b982ecdd36425e6d92a2956eec5e2092e
SSDEEP 192:9ON66JkRyQmiUybCYB+RNmOmos19RCVcvq6fU6:9ON66Uu+lB+RNmOfI9LJU6
TLSH
T1F912093678386C7B5EE26945F48732434EA5512BEE8A7F80D5DC1E0C01DFA9C130E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e61be5dc81d4713979251d6f2b907b5f7aa1f1ff57d9bae0b920382e88d9fce8
MD5 12523ca436903682be6d9e6fbf003442
SHA1 ae4f4c9eba8be4bd59e669d2c5b661ba1cf5f280
SHA512 e4c2ef18ff47783713c506ca26a869bc3a122fac44b5e7aeee1df99f0c0150060d04152bf0477efa79efdd46f558a3af93e00ab5e095965d9fe6d82b0eb63ce4
SSDEEP 384:uZcIhsNHho9bXVJTVRNmOfI9aJySllYJTfY81FwkgFBuj:MhrxxHmOA9aJZuTH7MBuj
TLSH
T169928E322C346C7759EAB645B98B36074EF8D037D7CA6A80C5EC5F1E02DB99C131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 542933b6504ebb407ba30f37e7b626b3bdd6b5e75631405eb333ae601ca5ded2
MD5 d5da205e87d57dde0eb370c7903ac38e
SHA1 5cbe23dc1a62844bc83f99bb4c7a446412c5c9d9
SHA512 dccf2ce020c0a90d30054010092cd9058bd54a3288a53d43463b25dc722b32826f51cf8f8a542e5348ecc8be90437c2feeefd9f06edd0760e61bedfa5fe7c631
TLSH
T109E00103521150FAC11C433010931B202AF3802002B393596A2441681C237002E35F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe587cbd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe587cbd.TMP
Size 392B
SHA256 a2b006ee132a44f00dd222d829686c61d5f3e736b55cd7a918a6dfec53a03d50
MD5 936351416e8ade4988d3df07339fe747
SHA1 6659f0926d257daeccc27be9bce9998ea38483de
SHA512 f42ebcd7a70dc9e83d49351913f16cb122c95e46ba23a4c93c70d179e52fdaee33af26616ebe4f123f04fbc74a5cf97d3ed13662a8d9df14ba397aae2f86d8d3
TLSH
T181E00203531150E7C11C433010C31B203BB38020039393596E2441781C217002D25A40
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f7fd13a0-5454-4d16-b8e7-b0dd82180678.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7fd13a0-5454-4d16-b8e7-b0dd82180678.tmp
Size 8KB
SHA256 4e1bbff421ea163e1a5684e4e573d488935b90dd727aaeb1497d1891eb0fdc50
MD5 4a69e9aad2ecff590bfa7fa62ab29353
SHA1 b8e43b70162966f6a759e379911be58b6148158d
SHA512 a8f81f980c5e444b6c049f97514885155ac561ecd9225743c9b642e5ca7c7dc7fabd45aa11096000b18583d947702b64bb66a51a4bce83502d2e7fedeefff7ea
SSDEEP 96:mqONk6SQsjpfHkRQ9865ih/cIPURHl8h4otop5WTDUBsPvvk40KQN0YsOmXxdwWf:tONX6JkRtQmiUy0YW+RNmOmoTh3uRvU6
TLSH
T13102D935BD382CB79EF26E49B98727135FA5207BB9952B80DAD81F0C01D765C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5ed424d6e2fdd8d3406d3b4091a365d3d51b1e04f0dbf23d552bace74808ed2e
MD5 50845829f1881deb8a4e78b427f8ff3d
SHA1 fdea7b796888c63b59b5a26ad4f56ef8072dcd4a
SHA512 d38ea9c466ff25dcdb27afa0970f2aabbcdbb789e3220d023ffb13bbc038171fc530d6f6169f3145b57cdd81bbd0282b2f1dcbb7dae5f29f9b92108fd5081cd5
TLSH
T1A141379CA6F91148B3776E1AAFF6A86D447F78772F06D54E00010E4E4A63B40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download